Frameworks, analysis, and guidance across TPRM, supply chain risk, and vendor governance.
Software Supply Chain SecurityWhen a critical vulnerability affects a software supply chain tool, your first instinct might be to patch. However, if the exploit window was already open, patching alone won t secure your environment
Regulatory FrameworksThe UK government s August 2026 amendments to the Cyber Security and Resilience Bill (CSRB) introduce supplier blocking powers, a direct regulatory intervention into vendor selection for critical infr
Software Supply Chain SecurityThe Challenge On August 28, JFrog patched CVE-2026-82329, a critical flaw in Artifactory that let attackers forge administrative access tokens without authentication. Researchers at watchTowr found at
Incident ManagementYour routers aren t just passing packets. According to Sygnia ’s analysis of the Fire Ant campaign, they re serving as surveillance platforms for sophisticated state-backed actors. These actors exploi
Get weekly security insights and compliance updates delivered to your inbox.
Regulatory FrameworksA vendor intake team meeting three weeks after Judge Rita Lin s August 27 ruling overturning Anthropic s supply chain risk designation sparked important questions. The team realized they d been treati
Regulatory FrameworksWhen a federal judge rules that a government agency acted illegally in designating a vendor as a supply chain risk, you re witnessing the consequences of political motivation overshadowing documented
Software Supply Chain SecurityBrowser extensions often fall into a governance blind spot. Once approved and installed, they re frequently forgotten. This oversight can lead to vulnerabilities. A recent supply chain attack turned 1
Software Supply Chain SecurityAustralian Federal Police arrested two men in Western Australia, aged 21 and 23, suspected of running TeamPCP, a cybercrime operation that compromised at least 3,800 GitHub repositories and launched a
Incident ManagementWhen attackers breach third-party applications through social engineering, your incident response begins with a crucial question: what access did that vendor have, and who controls it now? The McKesso
Software Supply Chain SecurityThe Question at Hand The FBI s advisory following the TeamPCP supply chain attacks recommends pinning all GitHub Actions workflows to verified commit SHA hashes instead of using floating version tags.
Software Supply Chain SecurityYour team assesses commercial vendors with questionnaires, contract reviews, and risk scoring . Then someone merges a pull request that pulls in 47 transitive dependencies from crates.io, npm, or PyPI
Regulatory FrameworksOverview On August 13, 2026, the European Telecommunications Standards Institute (ETSI) released 17 draft cybersecurity standards. These cover a range of products from operating systems to internet-co
Monitoring & PerformanceYour auditor shows up tomorrow. Can you prove your vendor s SOC 2 controls have been in place continuously since your last review? If you re relying on point-in-time assessments, you can t. This check
Supply Chain MappingThe Question at Hand Your cargo security budget just got reviewed, and your CFO wants to know if real-time visibility tools, like GPS trackers and IoT-enabled containers, should be standard on every s
Incident ManagementYou re reviewing a vendor s security questionnaire. They ve answered Yes to encryption in transit. You check the box and move on. Then 157 gigabytes of factory schematics, badge request forms, and pas
Software Supply Chain SecurityYour vendor security questionnaires ask about patch cycles and incident response plans. But you re missing the foundational question: Does this vendor build software that creates the same vulnerabilit
Software Supply Chain SecurityThe Challenge Software artifact signing has long relied on the flawed assumption that teams can securely handle cryptographic keypairs across numerous release pipelines without failures. This traditio
Software Supply Chain SecurityIn September, over 180 NPM packages were compromised by the Shai-Hulud worm, which exfiltrated secrets to 207 public GitHub repositories before most teams even realized they were affected. The attack
Software Supply Chain SecurityIntroduction Cuprate, an alternative implementation of Monero s node software, faced a significant supply chain risk as it approached its beta release without reproducible builds. This meant users dow
Software Supply Chain SecurityLast week, a question arose in a financial services TPRM Slack channel: How do I assess risk when the vendor is the developer toolchain? This came shortly after the Rust Security Response Team disclos
