CISA 2026 SBOM Minimum Elements mandates per-component digests or hashes as a minimum element. I believe this is the most controversial and problematic change in the requirements. That is if we want those hashes to have some meaning. Apparently, there are 2 intended meanings: Here is why verification is an issue. My favourite example is… Continue reading Component Hashes in SBOMs
Category: Cybersecurity
It’s 2026. It’s faster to fix CVEs than argue about them
There is a lot of buzz regarding reachability and exploitability. Also, following latest Black Hat, there are ~1000 new CVEs reported against Linux kernel (a lot of them relate to privilege escalation). Additionally, a lot of our assumptions, such as those about network isolation, may not hold true in reality. With that, today frequently it… Continue reading It’s 2026. It’s faster to fix CVEs than argue about them
The last line of defense must not be AI
The frequently circulating answer to the question of how we govern AI doing the work at scale is “AI turtles all the way down”. Meaning that more AI downstream can solve any problems originating upstream. I believe we can now clearly see it’s a fallacy – the same way our world does not rest on… Continue reading The last line of defense must not be AI
ReARM: Governing AI Coding Agents Demo
Towards Perfect Vulnerability Management System
Here I would like to summarize my thoughts on what constitutes a perfect vulnerability management system, what frequently gets missed, and what elements we already have in the latest ReARM release. I Not Only Vulnerabilities First of all, a management system should cover all security findings, not only vulnerabilities. That includes things like SAST /… Continue reading Towards Perfect Vulnerability Management System
SBOM Developments for December 2025
Happy New Year 2026! Following my previous post about SBOM developments for July 2025, this is another one about things that happened in the community since. Again, this is mostly for myself as a reference storage but I’m happy if other people find this useful too. 1. ENISA SBOM Landscape Analysis December 2025 – important… Continue reading SBOM Developments for December 2025
My TEA Talk from OWASP 2025 Global AppSec USA
Slides available here.
How to Use ReARM to Check if Shai-Hulud 2.0 Infiltrated Your Dependencies (video)
I recorded a video showing new batch search for SBOM components functionality in ReARM:
My Talk on TEA at KubeCon NA 2025 Pre-event
I was giving another talk on Transparency Exchange API at Open Source SecurityCon 2025 in Atlanta on November 10: “Transparency Exchange API: Where To Find Product SBOM?” The YouTube recording is now live and available below. You can also find slides here.