How Sonatype Guards the Software Supply Chain from Code to Cloud
Modern applications are built on open-source packages, containers, APIs, and AI models operating at machine scale. In its 2026 State of the Software Supply Chain report, Sonatype highlights how shift-left security is evolving into end-to-end supply chain governance—combining upstream firewalling, contextual SCA, automated remediation, and continuous SBOM management to secure components from intake to cloud.
The npm Attack That Turned Provenance Attestations into Camouflage
Software supply chain security relies heavily on build authenticity, but cryptographic verification is only as strong as account security. Discover how recent npm attacks exploited trusted publishing workflows to generate valid provenance attestations for malicious packages, exposing why origin tracking must be paired with runtime dependency inspection and continuous identity protection.
Cisco Expands AI Agent Security With Astrix and WideField Deals
Cisco is strengthening AI-driven identity security through its Astrix Security acquisition and planned WideField Security deal. The strategy enhances non-human identity governance, AI agent visibility, and session-level investigation capabilities across enterprise environments and Splunk.
SailPoint Acquires Entro Security in Reported $200 Million Deal
SailPoint has acquired Entro Security in a reported $200 million deal to strengthen machine identity protection. The acquisition expands SailPoint’s identity security platform with secrets discovery, credential monitoring, and governance for service accounts, API keys, tokens, certificates, and AI agents.
Thousands of Public Google Cloud API Keys Exposed with Gemini Access After API Enablement
For over a decade, developers were told something simple: Google Cloud API keys aren’t secrets. They were often embedded in frontend code to power services like Maps, analytics, or Firebase, visible but largely harmless. That assumption just broke. Recent research by Truffle Security uncovered…
From AI Assistants to Attack Infrastructure: How Grok and Copilot Can Be Abused as C2 Proxies
AI-powered tools such as Microsoft Copilot and xAI’s Grok can surf the web, fetch URLs, summarize information, and perform automated tasks for developers. However, security researchers have shown how such capabilities can be exploited to enable potentially more sinister activities. Web-enabled AI…
Introducing AI Security Code Review
At Endor Labs, our mission is to help application security teams cut through the noise and fix what matters. That often means reducing false positives from legacy tools. But it also means catching false negatives — high-impact security changes that never trigger an alert in the first place. Today,…
