Secure Design and Development

Securing Your Cloud Supply Chain: Vendor Risk in Practice

Your cloud security is only as strong as your weakest vendor. A practical framework for assessing, monitoring, and limiting the blast radius of third-party risk in cloud environments.

Prompt Injection Defense in Production AI Systems

As AI agents move from answering questions to taking real actions, prompt injection stops being a curiosity and becomes a production security problem. Practical mitigations for teams building with AI.

Modern Authentication Architecture: Passwords, Passkeys, and Beyond

How passwords, passkeys, cryptography, and secure design fit together into a coherent authentication strategy, for teams designing systems, not just using them.

Cryptography Basics: How Encryption Protects You

You rely on encryption dozens of times a day without noticing. Here's a practical, non-mathematical explanation of how it works and why it matters for secure design.

NIST Releases Updated Guidance on Securing AI Model Supply Chains

NIST has issued new guidance on vetting third-party AI models and training data, treating a poisoned model the same way mature security teams already treat a compromised software dependency.

Security Teams Report New Vulnerability Patterns in AI-Generated Code

A survey of application security teams finds AI coding assistants reproducing a distinct, recurring set of flaws, and doing it identically across many unrelated codebases at once.

Google DeepMind Open-Sources AI Red-Teaming Framework for Prompt Injection

DeepMind has open-sourced a testing framework that automates prompt-injection red-teaming, giving smaller teams access to a class of security testing previously limited to well-resourced AI labs.