Articles on application security, tools, and best practices.
RSS Feed7 min read
Since September 11, 2026, if you sell software in the EU and discover an actively exploited vulnerability, you have 24 hours to report it. You can't report what you can't detect — and the fine for failing to do so reaches €15 million.
7 min read
AI-generated code introduces known vulnerabilities in 45% of cases, and the number isn't improving with bigger models. The problem isn't that AI writes insecure code — it's that it breaks the arithmetic of code review. The 2026 data, and what to do about it.
8 min read
CVSS 9.8 is not a budget. Gerion's Financial Impact Engine translates every security finding into an estimated remediation cost — so your next security sprint is prioritized by real impact, not score.
8 min read
Terraform, Helm, Kubernetes, Dockerfile — infrastructure as code brings speed and repeatability. It also brings insecure configurations that reach production from the very first deployment.
4 min read
SAST analyzes your code. SCA analyzes your dependencies. They cover different territory and need each other — running only one leaves half your attack surface unwatched.
5 min read
An AWS token in a public commit, a Stripe key in an internal repo. Leaked secrets are the most expensive and most avoidable vulnerability. We break down the numbers.
4 min read
Gerion unifies SAST, SCA, secret scanning, and IaC into a single platform — and translates every finding into real financial impact. Today we open Early Access.