There is a lot of buzz regarding reachability and exploitability. Also, following latest Black Hat, there are ~1000 new CVEs reported against Linux kernel (a lot of them relate to privilege escalation). Additionally, a lot of our assumptions, such as those about network isolation, may not hold true in reality. With that, today frequently it… Continue reading It’s 2026. It’s faster to fix CVEs than argue about them
The IDE is Now Just a Large Attack Surface
For years, a lot of thought and investment went into Integrated Development Environments (IDEs). Agentic development seemed to be their triumph, with tools like VSCode + Copilot, Windsurf, and Cursor bringing development experiences to the next level. But the same agentic development led to the decline of IDEs. The issue is that agents, and not… Continue reading The IDE is Now Just a Large Attack Surface
CI/CD Security Principles in 2026
This is a follow up on my older post “7 Best Practices of Modern CI/CD“. Points outlined there still hold true, but they are missing several important security considerations. Today, in 2026, CI/CD pipelines have become one of the key supply chain attack vectors (refer, for example, to the recent Trivy compromise). That warrants an… Continue reading CI/CD Security Principles in 2026
The last line of defense must not be AI
The frequently circulating answer to the question of how we govern AI doing the work at scale is “AI turtles all the way down”. Meaning that more AI downstream can solve any problems originating upstream. I believe we can now clearly see it’s a fallacy – the same way our world does not rest on… Continue reading The last line of defense must not be AI
ReARM: Governing AI Coding Agents Demo
New ReARM Pitch – Governance for Agentic Coding
This was recorded at CIS Ottawa 2026. Slides available here.
When the Paradigm Shifts: A Zero-Trust Model for AI Agents
“When a paradigm shifts, everyone goes back to zero” (Joel A. Barker in his book “Future Edge”). These days I find two types of people when talking about AI. The first type consists of those who doubt AI can do things properly. In my space, specifically, that would be coding. The argument goes something like… Continue reading When the Paradigm Shifts: A Zero-Trust Model for AI Agents
Talked about QA and Cyber Security at OnPod
Had great conversation with Kristen Tilgner at OnPod Studios podcast about QA and Cyber Security in the AI era. This touched and expanded on some points I made in my recent blog post on quality assurance and the work we do with ReARM.
Time to Start Treating Dev Machines as Untrusted
Shai-Hulud, Shai-Hulud 2.0, Trivy, LiteLLM, and now Axios, and many smaller compromises bring us to the realization that existing supply chains are highly vulnerable. A common thread across of these attacks is that once you download and install a compromised package, the usual behavior of the malicious code inside is to steal tokens and other… Continue reading Time to Start Treating Dev Machines as Untrusted
Want to Survive Current Tech Era – Learn to Be a Good QA
The amount of messages I see these days on our Discord and other platforms from humans and bots desperately looking for jobs is at spam-like levels. Couple of years ago, these were mostly coming to me in the form of LinkedIn inmails selling development contracts. Looks like now there maybe no budgets left for inmails… Continue reading Want to Survive Current Tech Era – Learn to Be a Good QA