Practical articles on secure SDLC, CI/CD, the supply chain and regulation — CRA, DORA, NIS2 and UKSC. Articles on regulation cite the provisions they rely on.
How the CRA splits obligations between economic operators, and when an importer or distributor becomes a manufacturer under the regulation.
When the Article 14 CRA clock starts, who receives the notification and what each of the three reporting stages has to contain.
The eight mandatory elements of CRA technical documentation under Annex VII: when to draw it up, how to keep it current and how long to retain it.
How the CRA differs from NIS2 and Poland's amended National Cybersecurity System Act, who receives reports in Poland and why the deadlines don't line up.
Since 11 September 2026 the CRA requires reporting actively exploited vulnerabilities within 24 hours. Who it covers and what your process needs.
Threat modeling catches security problems at the cheapest point — at design, not after a pentest. What STRIDE is and how to build it into delivery.
Most organizations have security policies. Few have mechanisms that actually enforce them. The difference becomes apparent during an incident.
Zero Trust is a security architecture based on the assumption that no user, system or network should be trusted by default.
Most negative experiences with implementing security in pipelines stem from implementation errors, not from the DevSecOps idea itself.
VRA blocks the contract. Analysts look for answer consistency, knowledge of your environment and evidence — not declarations.
Static API keys and cloud access tokens in pipelines are one of the most common attack vectors. The problem is structural.
IBM, Verizon, GitGuardian — what the data says about security incident costs and why companies selling to Enterprise pay double.
GITHUB_TOKEN with write on everything, actions without SHA pinning, secrets in logs — 10 mistakes that co-occur and reinforce each other.
An Evidence Pack is the technical documentation that proves your pipeline security controls actually work — not just that you claim they do.
Software Bill of Materials describes what software is built from. Regulations and Enterprise requirements mean its absence blocks sales.
SOC 2 auditors increasingly examine CI/CD pipelines. Here's what they look for and how to prepare.
Secrets in pipelines leak regularly — often not through attacks but through configuration errors that exist for years.
VRA questionnaires are getting longer and more technical. Here's what security analysts look for and how to respond effectively.
Between build and production deployment an artifact can be replaced. Without integrity verification — there is no way to detect it.
NIS2 requires auditing software suppliers. If you deliver software to entities covered by the directive — you must prove supply chain security.
DORA requires ICT security controls including CI/CD systems. If you sell software to financial institutions — your pipeline is in scope.
Your CI/CD pipeline holds production keys — but it's secured like a dev tool. What is hardening and why do companies ignore it?
No articles in this category.