Security debt as 'known vulnerabilities left unresolved for more than a year' now affects 82 percent of companies, up from 74 percent a year ago. High-risk vulnerabilities, meaning flaws that are both severe and likely to be exploited, have risen from 8.3 percent to 11.3 percent.
Rather than relying completely on scans that are run as code is moving through a continuous integration/continuous delivery (CI/CD) pipeline, Checkmarx Developer Assist can eliminate 90% of vulnerabilities before they enter the DevOps workflow, said Kinsbruner. That's critical because the first generation of AI coding tools are creating more vulnerabilities that, unless discovered and remediated, are actually making applications less secure than ever, he added.
Company CEO David Mytton said the release of v1.0 of its Arcjet JavaScript SDK makes it possible for developers to address many of the issues as applications are being developed that DevOps teams would otherwise need to address later in the software development lifecycle (SDLC). Additionally, Arcjet is beta testing a similar SDK for Python developers, who often have even less application security expertise, added Mytton.
Security RX App treats application security as a runtime reality, not a static to-do list. Gone are the days of sifting through thousands of alerts for vulnerabilities in code that is not even in production: Security RX Focus on what matters first: Automatically filter out vulnerabilities in libraries sitting in a repo undeployed, so you can easily fix what's live first.
The Zero Trust security market is expected to be worth $88.8bn by 2030, at a compound annual growth rate of just over 16%. And this investment is urgent: according to research, 98% of CISOs expect cyber attacks to increase over the next three years. These attacks can have huge consequences: US financial services firm Equifax incurred $1.4bn in settlements after a single vulnerability in a web application was exploited by hackers.
Beskar is a Rails engine that fills that gap with layered protection: WAF that detects vulnerability scanning patterns (WordPress, config files, path traversal) Impossible travel detection using geolocation and Haversine calculations Smart rate limiting that identifies attack patterns (brute force, credential stuffing, distributed attacks) Risk-based account locking with automatic responses Persistent IP banning with escalating durations Installation is deliberately simple - drop it in your Gemfile, run the installer, add one line to your User model. Runs in monitor-only mode by default so you can tune thresholds before blocking real traffic.
AI-assisted developers produced three to four times more code than their unassisted peers, but also generated ten times more security issues. "Security issues" here doesn't mean exploitable vulnerabilities; rather, it covers a broad set of application risks, including added open source dependencies, insecure code patterns, exposed secrets, and cloud misconfigurations. As of June 2025, AI-generated code had introduced over 10,000 new "security findings" per month in Apiiro's repository data set, representing a 10x increase from December 2024, the biz said.
But hidden in there is a tiny flaw that explodes into a huge problem once it hits the cloud. Next thing you know, hackers are in, and your company is dealing with a mess that costs millions. Scary, right? In 2025, the average data breach hits businesses with a whopping $4.44 million bill globally. And guess what? A big chunk of these headaches comes from app security slip-ups, like web attacks that snag credentials and wreak havoc.
"Canonical is the number-one Cloud OS provider in the market with the Ubuntu containers, and VMware by Broadcom, with our VCF Foundation, is the number-one private cloud platform," said Prashanth Shenoy, VP of product marketing, VMware Cloud Foundation (VCF) division of Broadcom, during a media briefing. "So those two organizations coming together really helps our customers build Kubernetes-based modern applications."
