[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:software-supply-chain":3},{"control":4,"products":25,"stories":69,"lessons":113,"related":138,"compare":143},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.","Analysis of the open-source components in your software, blocking of malicious packages, software bills of materials (SBOMs) and protection of build pipelines.","Malicious npm and PyPI packages are published every day, and one poisoned dependency can reach thousands of companies. Knowing what is inside your software, and stopping bad packages at the door, is also becoming a legal duty for products sold in the EU under the Cyber Resilience Act.",[11,12,13,14],"Does it detect malicious packages, not just known vulnerabilities?","Can it block a bad package before a developer installs it?","Does it produce SBOMs in standard formats such as CycloneDX and SPDX?","How does it rank vulnerabilities that our code can actually reach?","Risk: compromised or vulnerable open-source components enter our products. Control: component analysis with malicious package blocking, and an SBOM for every release. Owner: engineering lead. Measure: releases with an SBOM, and open critical findings.",[17,18,19,20],"NIS2 Art. 21(2)(d) and (e): supply chain and secure development","EU Cyber Resilience Act Annex I: vulnerability handling and SBOM","CIS Control 16: application software security","ISO\u002FIEC 27001:2022 A.8.25 and A.8.28: secure development and coding",{"name":22,"slug":23},"Supply Chain","supply-chain","2026-10-16T12:48:27.564394+00:00",[26,34,42,47,55,61],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":43,"product_name":44,"url":45,"description":46},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":56,"product_name":57,"url":59,"description":60},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"total":70,"last_days":71,"recent":72},840,249,[73,78,83,88,93,98,103,108],{"slug":74,"title":75,"published_at":76,"brief":77},"german-military-drone-operations-disrupted-by-cyberattack-6ce23a","German military drone operations disrupted by cyberattack","2026-11-13T17:31:56+00:00","German drone maker Quantum Systems hit by cyberattack targeting update server.",{"slug":79,"title":80,"published_at":81,"brief":82},"the-take-home-test-that-runs-on-your-work-laptop-inside-the-accurasofthire-fake-2d9b52","The Take-Home Test That Runs on Your Work Laptop: Inside the AccuraSoftHire Fake Interview Campaign","2026-11-13T17:04:34+00:00","Fake interview campaign uses poisoned npm packages to deliver malware to developer machines.",{"slug":84,"title":85,"published_at":86,"brief":87},"artex-attackers-adopted-this-ai-pentesting-tool-in-three-months-leaked-secrets-a-8d732f","ARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In.","2026-11-13T15:22:30+00:00","Attackers are using the AI pentesting tool ARTEX, with leaked secrets providing the fastest entry.",{"slug":89,"title":90,"published_at":91,"brief":92},"in-other-news-new-cisa-director-nominee-connected-car-hacking-baker-tilly-data-b-096388","In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach","2026-11-13T15:20:00+00:00","Security news roundup includes crypto theft, Baker Tilly data breach, OpenAI agent issues, and Siemens advisory policy.",{"slug":94,"title":95,"published_at":96,"brief":97},"quantum-systems-drones-back-in-the-air-after-malware-scare-7ac3b3","Quantum Systems drones back in the air after malware scare","2026-11-13T13:14:00+00:00","Quantum Systems drones grounded after malware found in QBase control software update.",{"slug":99,"title":100,"published_at":101,"brief":102},"your-pinned-mcp-server-may-not-be-as-pinned-as-you-think-2165b8","Your pinned MCP server may not be as pinned as you think","2026-11-13T05:30:22+00:00","MCP servers can drift from pinned versions, exposing AI coding assistants to dependency risks.",{"slug":104,"title":105,"published_at":106,"brief":107},"openai-launches-security-products-tells-orgs-they-re-doomed-if-they-don-t-use-th-5fbc1d","OpenAI launches security products, tells orgs they’re doomed if they don’t use them","2026-11-12T20:48:45+00:00","OpenAI launches AI security tools and warns organizations they need them to survive.",{"slug":109,"title":110,"published_at":111,"brief":112},"aspm-in-the-ai-era-part-3-fixing-risk-at-the-speed-of-code-85c5a6","ASPM in the AI Era Part 3: Fixing Risk at the Speed of Code","2026-11-12T18:32:24+00:00","Wiz Code introduces automated workflows to accelerate vulnerability remediation for engineering teams.",[114,118,122,126,130,134],{"slug":115,"title":116,"published_at":117},"fake-interview-assignments-weaponize-npm-packages-to-compromise-developer-machines","Fake Interview Assignments Weaponize npm Packages to Compromise Developer Machines","2026-11-13T18:21:36.396+00:00",{"slug":119,"title":120,"published_at":121},"compromised-update-server-grounds-german-military-drones","Compromised Update Server Grounds German Military Drones","2026-11-13T18:20:23.075+00:00",{"slug":123,"title":124,"published_at":125},"baker-tilly-breach-and-ai-privilege-escalation-highlight-third-party-and-access-control-risks","Baker Tilly Breach and AI Privilege Escalation Highlight Third-Party and Access Control Risks","2026-11-13T16:21:20.633+00:00",{"slug":127,"title":128,"published_at":129},"leaked-secrets-and-a-backdoored-ai-tool-give-attackers-cloud-access-in-minutes","Leaked Secrets and a Backdoored AI Tool Give Attackers Cloud Access in Minutes","2026-11-13T16:21:03.622+00:00",{"slug":131,"title":132,"published_at":133},"mcp-server-pinning-drift-exposes-ai-coding-assistants-to-malicious-dependencies","MCP Server 'Pinning Drift' Exposes AI Coding Assistants to Malicious Dependencies","2026-11-13T06:20:23.867+00:00",{"slug":135,"title":136,"published_at":137},"ai-powered-security-tools-raise-questions-about-dependency-and-risk","AI-Powered Security Tools Raise Questions About Dependency and Risk","2026-11-12T21:20:37.136+00:00",[139],{"slug":140,"name":141,"problem":142},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"socket\u002Fsocket":144,"jfrog\u002Fjfrog-xray":150,"sonatype\u002Fsonatype-firewall":162,"github\u002Fadvanced-security":175,"snyk\u002Fsnyk-open-source":189,"jfrog\u002Fjfrog-curation":198},{"hq_country":145,"also_provides":146,"reviews":147,"affected":148,"reported":149},"US",[],[],0,43,{"hq_country":151,"also_provides":152,"reviews":153,"affected":160,"reported":161},null,[],[154,157],{"label":155,"url":156},"PeerSpot: JFrog Xray user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fjfrog-xray-reviews",{"label":158,"url":159},"Gartner Peer Insights: JFrog Software Supply Chain Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fjfrog-software-supply-chain-platform",18,9,{"hq_country":145,"also_provides":163,"reviews":164,"affected":148,"reported":174},[],[165,168,171],{"label":166,"url":167},"PeerSpot: Sonatype Lifecycle user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsonatype-lifecycle-reviews",{"label":169,"url":170},"Gartner Peer Insights: Sonatype Repository Firewall user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fsonatype-repository-firewall",{"label":172,"url":173},"PeerSpot: Sonatype Repository Firewall user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsonatype-repository-firewall-reviews",2,{"hq_country":145,"also_provides":176,"reviews":180,"affected":187,"reported":188},[177],{"slug":178,"name":179},"secrets-management","Secrets management",[181,184],{"label":182,"url":183},"Gartner Peer Insights: GitHub user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fgithub-826147115",{"label":185,"url":186},"PeerSpot: GitHub Advanced Security user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fgithub-advanced-security-reviews",36,6,{"hq_country":151,"also_provides":190,"reviews":191,"affected":148,"reported":148},[],[192,195],{"label":193,"url":194},"PeerSpot: Snyk user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsnyk-reviews",{"label":196,"url":197},"Gartner Peer Insights: Snyk Open Source user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fsnyk-open-source",{"hq_country":151,"also_provides":199,"reviews":200,"affected":160,"reported":161},[],[201,202],{"label":155,"url":156},{"label":158,"url":159}]