Operationalizing Secure by Design: a CISO’s guide to closing the gap between policy and reality
We’ve been listening to dozens of CISOs. In roundtables, peer forums, customer and prospect calls, on the record, off the record, at event floors and …
Best Practices
Cybersecurity best practices including how to guides, security awareness and other practical guidance for AppSec and ProdSec teams.
Why traditional DAST Tools fail modern AppSec teams (and how to fix it)
For years, development and security practitioners have treated dynamic application security testing as a critical final safety check before code goes live. However, the external …
Real-world attack surface monitoring at massive scale: how the UK Government protects over half a million public sector domains
Scaling application security and attack surface monitoring inside a single enterprise is a massive headache. In June 2026, the Department for Science, Innovation and Technology …
Attack Surface Monitoring vs DAST: Why security teams need both
Attack Surface Monitoring has become a critical component of modern cybersecurity programs. As organizations scale their cloud environments, applications, APIs, and third-party services, so does …
Shadow AI and the evolution of Shadow IT Security – What to do when your code moves faster than your security
Let’s be real. Shadow AI is already reshaping Shadow IT Security, whether organizations are ready or not. Chances are that your developers aren’t waiting for …
Baking accessibility into our product foundation
TL;DR: Building for everyone, faster. We’re moving from the why to the how. To scale accessibility without losing speed, we’ve overhauled our foundation: A New …
Why inaccessible cybersecurity is a security risk: our path to accessibility
In cybersecurity, an inaccessible tool isn’t just a nuisance: it’s a vulnerability. With the European Accessibility Act tightening regulations across Sweden and the EU, “good …
The API vulnerabilities nobody talks about: excessive data exposure
TLDR: Excessive Data Exposure (leaking internal data via API responses) is the silent, pervasive threat that is more dangerous than single dramatic flaws like SQL …