News and Tech Update

CISA just gave software supply chain security a long-overdue refresh. Working with the NSA, the FBI, and a roster of international partners, the agency released the 2026 Minimum Elements for a Software Bill of Materials, updating and replacing the baseline that the National Telecommunications and Information Administration published back in 2021. Five years is a long time in software security terms, and the update shows. The timing isn’t random. The revision incorporates feedback from more than 90 comments submitted during a public comment period, and CISA circulated a draft in 2025 specifically to update elements like SBOM author, software producer, and component version for better clarity. This wasn’t a quiet policy tweak. It was a deliberate, multi-year rework built on real feedback from people who actually generate and consume SBOMs for a living. What’s New The headline change is scope. The minimum elements now apply to SBOMs across all software types, including...

Tricentis today revealed it is acquiring Tabnine to gain access to a knowledge graph that will be used to provide context to AI agents that have been trained to automate a range of testing tasks. Once the acquisition is complete, Tricentis plans to integrate the knowledge graph developed by Tabnine, dubbed the Enterprise Context Engine, into the company’s Agentic Quality Engineering Platform. Coupled with a vector model, that knowledge graph makes it possible to extract entities, relationships, dependencies, and architectural patterns from repositories, documentation, tickets, application programming interfaces (APIs) and infrastructure metadata in a way that is much easier for AI agents to consume and understand. The end result will be a platform that continuously ingests code, documentation, tickets, and APIs, providing organizational intelligence in real time and enabling multiple AI agents to share memory and context to both verify outputs and better understand the potential dow...

The gap between how fast AI writes code and how reliably teams verify it is quietly becoming a balance-sheet risk. Enterprise leaders are learning to measure it before it forces repayment. Every engineering organization that adopted AI coding assistants over the past two years has quietly taken on a liability that never appears on the dashboards leadership actually reviews. Developers now generate more code than their teams can meaningfully verify, and the gap between the two compounds on every passing build until an incident forces the account to settle. The cost tends to land late and all at once, usually as an outage or a failed audit that traces back to a change nobody fully checked. For the executives who answer for delivery risk, the trouble is not the tooling their engineers reach for but the plain fact that verification capacity never scaled to match the new pace of output. The Liability That Never Reaches the Dashboard Leadership reporting evolved to track the things that ...

Not long ago, some business leaders seemed to view enterprise search as a “nice-to-have.” Or, at the very least, they considered it more of a supporting utility than a strategic, business-critical platform. Organizations use enterprise search tools to help employees locate internal documents and enable support teams to surface relevant information. And, of course, retailers have long needed search to help customers navigate their product catalogs. But historically, expectations have been relatively modest: Users entered a few keywords and received a list of links, and then they did the remaining legwork themselves to figure out which results were relevant. It’s little surprise, then, that many companies have historically relied on self-managed open-source solutions like Apache Solr for enterprise search. But even though the role of enterprise search has changed, many organizations’ approach to search has not. The rise of GenAI has trained customers to expect companies’ search tools ...

OpenAI has released its Codex Security command-line interface and software development kit as open source software under the Apache 2.0 license, providing a new way to bring its AI security scanner into development workflows. The CLI can scan repositories, review staged and unstaged changes before a commit, compare findings across scans and export results for use in other code-scanning tools. Teams can also run it in CI and set a severity threshold that returns a failing status when a completed scan identifies a finding at or above that level. OpenAI recommends starting with advisory results before allowing findings to affect the CI check. Because the client code is public, teams can inspect and adapt the CLI or SDK to fit their own tooling. But that openness stops at the integration layer, as the service that performs the underlying analysis remains under OpenAI’s control. “OpenAI open-sourced the client and kept the scanner. That is distribution, not openness,” said Mitch Ashley, ...

Las Vegas, USA, July 29th, 2026, CyberNewswire Catches rogue AI agents – and stops them in live production before they cause damage Sweet Security , the proactive runtime enforcement company for cloud and AI, today announced its further expansion into AI security with Agentic AI Blocking . Sweet now blocks rogue agent behavior in real time – extending Sweet’s runtime enforcement from the cloud to the AI agents that are acting alongside it. Eighty percent of the world’s businesses are already AI enterprises, and their agents take on identities, reach sensitive data, and act on their own. Yet no one verifies that the behavior an agent carries out is the behavior that was intended. Every other security tool detects and alerts; by the time a team reads the alert, the agent has already acted. “AI has collapsed the cost of attack, and it has put autonomous software inside the enterprise. Someone has to decide, in the moment, what an agent is allowed to do,” said Dror Ka...