Building an AI SDLC on Thin Ice: What Worked and What Backfired
Writing code was never the hard part of software engineering. That was true before LLMs and it’s still true now. The hard parts were always understanding the problem, choosing an approach you won’t regret in six months, and keeping a system comprehensible to the people who have to maintain it. Code was the mechanical part. […]
Your Agent Produced the Right Answer. It Still Did the Wrong Thing.
Introducing PolicyEval, the open-source library that scores AI agents against their policy, not just their output. The first two posts in the series (#1, #2) landed on something uncomfortable. AI coding assistants ship vulnerability patches that compile, pass tests, and still break production. Roughly one in five. The fix wasn’t a smarter model – it […]
Your AI Patches Still Break Production? The Fix Isn’t a Better Model, It’s a Better Workflow.
In our previous post, we showed how general-purpose AI coding assistants produce vulnerability patches that compile, pass tests, and still break production. The data was clear: a persistent ~20% defect rate across compatibility, correctness, and precision – not because the models can’t code, but because they skip the critical step of understanding the APIs deltas. […]
Stop the whack-a-mole game: Turning npm Supply-Chain Chaos into Automated Remediation
In the span of a few weeks, the JavaScript ecosystem has been hit by back-to-back software supply-chain incidents. First came the s1ngularity/Nx compromise in late August. Then, this week, the Shai-Hulud campaign arrived with a twist: a self-replicating, worm-style payload that moved quickly through the npm ecosystem. Public write-ups from SCA and CNAPP vendors have […]
The Rise of AI Agents in Cybersecurity: Insights from RSA Conference 2025
RSA Conference 2025 in San Francisco confirmed that AI agents are rapidly transforming cybersecurity, moving from simple copilots to autonomous systems capable of executing complex, multi-step tasks. This shift is already reshaping how organizations detect, respond to, and manage cyber threats, but the journey toward full automation, where AI can not only identify but also […]
The State of Remediation: Why Security Backlogs Keep Growing
In the ever-evolving world of cybersecurity, organizations are facing an overwhelming challenge: the growing backlog of unresolved security findings. Despite advances in detection technologies, the gap between identifying security findings and remediating them continues to widen. Security Findings? Let’s define what we mean by Security Findings. Sometimes also referred to as vulnerabilities, these security findings […]