Supply Chain Security 101
Everything you need to know about software supply chain security in the age of open source.
- ComplianceAppSec
What are CIS Benchmarks?
Learn what CIS Benchmarks are, how Level 1 and Level 2 profiles work, and how the CIS Docker Benchmark applies to hardening container images for compliance.
- AppSec
What are software vulnerabilities and CVEs, and why do they matter?
Learn what makes a software vulnerability, how the CVE Program, CVSS, and CWE score them, and why unpatched CVEs put your data and compliance at risk.
- AppSecSoftware Supply Chain
What is OpenVEX?
OpenVEX tells scanners whether a CVE actually affects your software. Learn how the OpenVEX specification works and how to pair VEX documents with SBOMs.
- Tools & Buyer’s GuidesAppSec
How to select a secure base container image
Choose a secure base container image using 9 criteria: known CVEs, package count, rebuild frequency, size, signing, SBOMs, and more. Includes a self-assessment.
- AppSec
CVE remediation: How to find and fix software vulnerabilities
Learn the four steps of CVE remediation: inventory your software, scan for vulnerabilities, triage with CVSS, KEV, and VEX, then patch and rescan to confirm.
- Software Supply ChainAppSec
How to prevent software supply chain attacks
Learn how to prevent software supply chain attacks with layered controls over what enters your code, how it's built, and what you release.
- AppSec
AI supply chain attacks: What they are and how to defend against them
Learn how to protect your critical systems against AI supply chain attacks.
- AppSecSoftware Supply Chain
AI supply chain security: Risks & best practices
Learn best practices for AI supply chain security to ensure you integrate AI into your applications safely.
- AppSec
Make dependency ingestion part of your exposure management
Malicious packages reach builds in hours, but remediation takes weeks. See why exposure management should start at the registry pull, and how to measure it.
- AppSec
Managing open source vulnerabilities and malicious packages
Learn how to manage known open source vulnerabilities, screen malicious packages before execution, and choose the right control for each risk.
- AppSecSoftware Supply Chain
What is malicious code? Examples, how it spreads, and how to stop it
Malicious code hides in trusted packages and pipelines. Learn how supply chain verification stops it before it reaches production.
- AppSecSoftware Supply Chain
Malicious dependency attacks in the software supply chain
Learn about malicious dependencies and how to secure your software systems against them.