Product Security
Secure development, SBOM, vulnerability handling, and product security engineering.
Ransomware Groups Are Shifting to Data Extortion Without Encryption
Encrypting a victim's files takes time and leaves forensic evidence. Increasingly, ransomware groups skip it entirely and go straight to exfiltration-and-extortion.
Why Supply-Chain Attacks Keep Working: Lessons from SolarWinds and xz-utils
Two of the most consequential software supply-chain compromises on record share a root cause that most vendor-risk programs still don't test for.
The CVE Program's Funding Scare and What It Means for Vulnerability Management
A near-lapse in the CVE program's federal funding in 2025 was a real wake-up call about how much of global vulnerability management runs on a single point of failure.
Why MFA Fatigue Attacks Keep Succeeding Against Well-Defended Organizations
Push-notification MFA fatigue — spamming a user with approval requests until they tap 'approve' out of frustration — keeps working against organizations that have already deployed MFA correctly.