Skip to main content

Posts

Are LLMs Equally Good (or Bad) at Building Secure Software?

In the tricky business of choosing the right artificial intelligence coding models for security and cost, development teams need to keep in mind two important factors. First, even the best and best-known AI coding assistants vary widely in performance, both between and within individual frameworks. Each has strengths and weaknesses, and there is no across-the-board best of the bunch; a model that leads the pack in one framework may be in last place in another. And second, when it comes to generating secure code, you don’t necessarily get what you pay for. The real costs of using AI agents can mount quickly depending on an agent’s use of tokens, and some models are more inclined than others to make extensive use of them, but there’s no correlation between cost and the level of security provided. Those are among the findings of an in-depth study conducted by Secure Code Warrior and the Royal Melbourne Institute of Technology (RMIT) to evaluate the security behavior of leading AI codin...
Recent posts

What the Microservices Era Can Teach Us About AI

The most expensive mistake teams are making with AI agents right now is treating them as microservices with a language model bolted on. The approach is understandable; microservices are the architecture most platform engineers know best, agents feel like services that happen to think, and the migration path looks familiar. But the analogy only holds long enough to lead you somewhere painful. Microservices changed how software gets built. The idea was to help teams work independently, ship faster and scale efficiently. In those days, shipping software meant one giant codebase compiled together, tested together and released on 12- or 18-month cycles. Then the cloud came along, and teams needed to ship in weeks or days. The only way to do it was to split systems apart and let each piece move on its own schedule. It worked, but the systems underneath stayed simple in one crucial way: they were deterministic. Distributed systems are hard, but the behavior was predictable. A service receiv...

Cloudsmith Extends Policies and Controls to Secure Application Binaries

Cloudsmith this week revealed it has expanded the policy management and continuous risk detection capabilities it makes available within its software artifact management platform to now include policy templates, cooldown policies, and expanded evaluation triggers. Alison Sickelka, vice president of product for Cloudsmith, said these additions to the platform will make it simpler to prevent malicious packages from inadvertently being incorporated into the binaries that DevOps teams deploy in production environments. For example, policy templates written in the Rego programming language can now be used to provide a set of baseline controls that are consistently implemented across a DevOps workflow. Additionally, DevOps teams can now implement a set of cooldown policies that prevent any recently made available software package from being indexed. That capability ensures that only versions of a validated package are exposed to application developers, noted Sickelka. That’s crucial beca...

Deterministic Robots, Agentic Reasoning: Balancing Reliability and Flexibility in Software Test Automation

Summary: Scott Robohn explores how UiPath Test Cloud mitigates the “release gap” caused by rapid, AI-driven development by offering a platform that blends a combination of deterministic automation, AI agents, and human oversight. By distinguishing between deterministic “robots” for efficient, cost-effective regression and flexible “agents” for complex reasoning, the platform empowers quality engineers to use agentic reasoning selectively while managing AI-related consumption and cost. Drawing on his network engineering background, Scott advocates for adopting these software testing principles to build greater resilience and adaptability within NetDevOps and broader IT infrastructure domains. Intro I had the pleasure of serving as a delegate for the UiPath Test Cloud Tech Field Day Showcase . I’ve heard a lot about UiPath from my consulting clients and in the market over the last few years, so I jumped at the opportunity to be a part of the delega...

Microsoft’s GitHub Hit by Major Outage as AI-Driven Demand Strains Infrastructure

GitHub, the Microsoft Corp.-owned code hosting platform serving more than 180 million developers, is still reeling from a widespread outage on Monday that severely disrupted software development pipelines globally. The hours-long incident was the latest in a relentless series of reliability failures for a service struggling to keep pace with an unprecedented surge in artificial intelligence (AI)-assisted coding traffic. The disruptions began around 9:40 a.m. EDT, initially manifesting as performance degradation across core services. The issue rapidly escalated, causing error rates to spike near 20% for web interface and API traffic, while archive and raw repository content downloads suffered a staggering 50% failure rate. Key capabilities — including GitHub Actions automated testing, webhooks, GitHub Pages, and the AI pair-programmer Copilot — were heavily compromised. Downdetector logged thousands of user reports at the peak of the disruption, with minor outage spikes simultaneousl...

Is Your New DevSecOps Tooling Reducing Work Or Just Adding to It?

Security belongs in the software delivery pipeline. The harder question is where, how often and at what cost. Many pipeline teams eventually add security scanning to CI/CD, and relatively few go back afterward to measure what it actually cost the delivery process. Security coverage went up. Something else changed too, and it is rarely measured with the same rigor. “Shift left” gets treated as a free upgrade: catch problems earlier, at lower cost, with no real downside. That is true for the cost of fixing a vulnerability. It is not automatically true for the cost of running your pipeline. A security control can be worth adding and still change your delivery economics in ways worth naming honestly, rather than assuming they net out to zero. What Changes When Security Enters the Pipeline SAST, SCA, container scanning, secret scanning, and dependency analysis all do real work, and none of them are free to run. Each one is a pipeline stage with its own execution time, and many scale wit...

GitHub Hit by Widespread Outage, Halting Work for Global Developers

A major technical outage struck GitHub on Monday morning, disrupting workflows for millions of developers worldwide for several hours as critical services, automated testing pipelines, and artificial intelligence (AI) coding tools suffered high error rates. The hosting platform — a subsidiary of Microsoft Corp. that supports roughly 180 million users — first reported performance issues around 9:40 a.m. EDT. The disruption quickly escalated as thousands of users flooded outage-tracking platforms like Downdetector to report failing repositories, broken downloads, and degraded performance. At the peak of the incident, GitHub confirmed error rates of approximately 20% across its web interface and API traffic. Core functions faced even steeper degradation: raw repository content and archive downloads suffered error rates near 50%, while enterprise authentication features like SAML, OIDC, SCIM, and Team Sync were broadly impacted. The chaos broadened by mid-morning when GitHub confirmed d...