I'm not asking about conventional vulnerability scanning. Traditional endpoint security tools may not inspect files inside containers because the container filesystem is isolated from the host. Do you…
I'm putting together a software supply chain security plan for a mid-sized team, but most of the material I've found comes from vendor blogs. We already generate SBOMs…
When I first built a deployment pipeline, I stored database passwords and API keys in the platform's encrypted secrets store and assumed that was sufficient. I've since realized…
Tools like Trivy, Syft, and Grype are useful, but a single successful scan only tells you what was known at that moment. If a new CVE is published…
Security scanners are useful, but a single successful scan in CI only tells you that the dependencies looked acceptable at that moment. If a new CVE is published…
Last month, one of our services started using a package I had never seen before. It had only a handful of stars, a single maintainer, and had not…
I have 12 years of infrastructure experience, starting in desktop support and hardware repair before moving through data center work, monitoring, asset management, and systems administration. I currently…