Skip to main content

Posts

GitHub Widens the Door on Advanced Security Trials

Security tooling has a familiar adoption problem. The organizations that need it most — the ones scaling fast enough that their attack surface is outgrowing their process — are often the same ones that can’t justify a sales call and a signed contract just to see whether a product fits. They want to turn it on, run it against real repositories, and see what it actually finds before anyone talks pricing. GitHub just made that path available to a lot more of them. The company raised the eligibility ceiling for self-serve GitHub Advanced Security (GHAS) trials, moving the cap from enterprises with up to 100 licenses to those with up to 300. Any GitHub Enterprise Cloud organization under that new threshold can start a 30-day trial directly from the “Billing and licensing” page in their enterprise settings, no sales conversation required. During the trial, an organization can add any number of committers and turn on both GitHub Secret Protection and GitHub Code Security acr...
Recent posts

Why AI Agents Shouldn’t Guess at Vulnerability Exploitability

Vulnerability prioritization is not a language problem. The safest agent architectures use models to interpret and explain, while deterministic systems traverse the evidence. Ask a security team a simple question: Of the vulnerabilities your scanner reported this morning, which ones can actually be exploited in production? The honest answer is often that nobody knows yet, and proving it can take hours or days. That makes it tempting to point an AI agent at the scanner output and ask for a prioritized list. The agent will respond immediately, in fluent prose, with a confident rationale. But if the evidence required to determine exploitability is not in the input, the answer is still a guess. Better model quality does not solve missing data. Exploitability Is a Property of a Path Exploitability is not simply a property of a vulnerability record. In production, it depends on relationships. To determine whether a vulnerable library matters, a team may need to establish that the packa...

Atlassian Aims to Fill Context and Governance Gap for AI Coding Agents

Atlassian today extended the capabilities of its portfolio to provide teams of artificial intelligence (AI) coding agents with the level of context needed to build and deploy applications in production environments at much higher levels of scale. Code Context, built on Atlassian’s Teamwork Graph, makes it possible for AI coding agents to generate more reliable output by, for example, vetting ideas for architectural feasibility before a line of code is generated, while Agent Context Controls makes it possible for DevSecOps teams to govern which agents can operate in a space and exactly what they’re allowed to see. Additionally, Atlassian is adding to its Jira and Confluence platforms for managing software development projects an ability to continuously scan for well-defined, unassigned work items that can be delegated to a Jira Coding Agent that creates a pull request for review. An AI Review capability provides a dedicated agent on every pull request, checking it against those coding...

Test Creation Was Never the Bottleneck

Something specific happened to software delivery in the past two years. The 2026 survey data is unusually clear about what it was. Sonar’s 2026 State of Code Developer Survey found that AI-generated or AI-assisted code accounted for 42% of code committed by respondents , with developers projecting that share to reach 65% by 2027. GitLab’s 2026 AI Accountability Report, a Harris Poll survey of 1,528 developers and technology buyers across six countries, found that 85% agree AI has moved the bottleneck from writing code to reviewing and validating it. Both figures get quoted often. The part that gets left out is that the bottleneck didn’t wander downstream on its own. Engineering organizations moved it there. The Half That Got Automated Was Already Cheap PractiTest’s 2026 State of Testing Report puts AI adoption across testing organizations at 76.8% . Where that adoption went is the more useful number. Teams use AI for test case creation at 69.6% and for scrip...

SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise

Austin, Texas / USA, September 9th, 2026, CyberNewswire Ninety-five percent of organizations believe they have visibility into their AI and machine identity exposures, yet only 36% are actually monitoring them. SpyCloud , the leader in identity threat protection, today released its annual SpyCloud Identity Threat Report , a survey-based study finding that non-human identities (NHIs) – the AI agents, service accounts, API keys, and authentication tokens that connect to internal systems – have become the most common route attackers take into the enterprise. SpyCloud 2026 Identity Threat Report, Source: SpyCloud The survey found that compromised NHIs (31%) are nearly 2x as likely to be the primary entry point compared to phishing and social engineering (17%), the second-ranked answer. NHI-related misuse was also the most commonly reported identity-based event type at 42%, yet the vast majority of organizations aren’t watching for them. While 95% of organizations believe they have ad...

GitHub Quietly Fixes One of Dependabot’s Oldest Headaches

Every security team that has run Dependabot against a private registry knows the drill. You need a personal access token, a safe place to store it, a reminder to rotate it, and a way to update it in dependabot.yml before it expires and quietly breaks your dependency updates. None of that is hard. It’s tedious, and people skip tedious security chores. GitHub has now closed that gap for its own registries. As of this week, Dependabot can authenticate directly to GitHub Packages, the GitHub Container Registry ( ghcr.io ), and other GitHub-hosted package registries without a PAT. It uses the same GITHUB_TOKEN mechanism that already powers GitHub Actions workflows, requesting packages: Read access and presenting that token automatically when it pulls a dependency. If a repository already has access to a package through the “Manage Actions access” setting, Dependabot inherits that access the same way an Actions workflow would. That last part is the real change. Dependab...

DevOps in Financial Services: Moving Fast Without Losing Control

DevOps is often associated with speed: shorter release cycles, greater automation, faster feedback and increased developer autonomy. In financial services, however, speed is only one part of the equation. A platform supporting banking, payments or other regulated financial workloads also has to account for security, traceability, resilience, access control and operational risk. A deployment that reaches production quickly but cannot be adequately explained, audited or recovered is not necessarily a successful deployment. This changes the way DevOps needs to be implemented. The goal is not to choose between speed and control. The goal is to design delivery systems in which the controls themselves become part of the engineering workflow. Compliance Should Be Designed Into the Pipeline One of the easiest mistakes to make in regulated environments is treating compliance as something that happens after engineering work is complete. A team builds an application, creates its deploymen...