Composition Analysis Stories

Global Stories

Composition Analysis stories

Endor Labs adds buildless C support to AI SAST tool

Developers can now scan C code earlier in the process, as Endor Labs says its buildless AI SAST found 96 of 102 known bugs in tests.

By Joseph Gabriel Lagonsin • 4 min read • Last week

Digital Transformation

Sonatype warns AI is speeding software risk growth

Enterprise software teams are facing far more vulnerabilities as AI-assisted development multiplies application output and speeds exposure growth.

By Mark Tarre • 4 min read • Last week

Data Protection

Supercharged security: Cyber risk in the age of frontier AI

Hong Kong saw a record 15,877 cyber incidents in 2025 as AI speeds attacks and shortens the window to exploit software flaws.

By Daniel Kwong • 3 min read • This month

Ransomware

Google warns of rise in open source supply chain attacks

Malicious packages are now spreading faster across code repositories, with Google saying open source ecosystems face the sharpest rise in risk.

By Sean Mitchell • 5 min read • Last month

Cloud Security

Checkmarx launches Fusion hybrid scanning tool for AI code

The hybrid system aims to help security teams spot serious flaws in AI-generated code faster, as production code becomes harder to review.

By Mark Tarre • 4 min read • Last month

Data Protection

Automotive cyber vulnerabilities more than double in Q2

Greater exposure to remote attacks is worrying carmakers, as high-severity automotive cybersecurity flaws jumped to 161 in the second quarter.

By Sean Mitchell • 4 min read • Last month

Application Security

Ossprey raises USD $2.65 million for supply chain security

The round will fund hiring, product work and overseas growth as investors back tools to counter AI-driven software supply chain risks.

By Sean Mitchell • 4 min read • Last month

Data Protection

Cisco launches Antares AI models for code flaw pinpointing

Security teams could cut hours from patching work as open-weight Antares models narrow flaws to the relevant code segment.

By Sean Mitchell • 4 min read • Last month

Network Security

Qualys joins Chainguard's Athena security coalition

The coalition has now processed more than 40,000 findings, underscoring how quickly open source flaws can spread across corporate systems.

By Mark Tarre • 5 min read • Last month

Application Security

Lineaje launches AI vulnerability elimination factory

The tool aims to help developers cut vulnerability backlogs and reach no exploitable flaws within 90 days as AI coding expands risk.

By Mark Tarre • 4 min read • Last month

DevOps

BellSoft launches hardened Paketo builder for containers

Security and compliance teams can now patch buildpack-based containers from a single hardened base, rather than chasing Dockerfiles across repositories.

By Sofiah Nichole Salivio • 4 min read • Last month

Application Security

CleanStart launches Clean Libraries to secure AI code

Developers face earlier checks on risky open-source dependencies as AI coding tools speed up software assembly and raise supply chain concerns.

By Joseph Gabriel Lagonsin • 3 min read • Last month

Application Security

Targeted open source malware attacks on developers soar

Malicious package advisories jumped from 21 in 2023 to 1,576 in 2025, as attackers increasingly target developers before code reaches production.

By Joseph Gabriel Lagonsin • 4 min read • Last month

Application Security

Checkmarx named leader in Gartner supply chain quadrant

Enterprise buyers are treating software supply chain security as a standalone priority as Gartner creates a dedicated Magic Quadrant for the category.

By Joseph Gabriel Lagonsin • 3 min read • Thu, 25th Jun 2026

Cloud Security

Chainguard named Gartner leader in software supply security

The recognition underlines rising demand for tools that secure software builds before attackers can exploit open source dependencies and pipelines.

By Mark Tarre • 4 min read • Wed, 24th Jun 2026

Stories from Other Regions

Composition Analysis stories

Digital Transformation

CleanStart expands Middle East, Africa security push

Rising use of AI coding tools is widening software supply-chain risks for businesses across the Middle East, Türkiye and Africa.

By Sofiah Nichole Salivio • 4 min read • Last week

DevSecOps

Cloudsmith adds cooldown policies for software supply chain

Malicious packages can now be held back before reaching developers, as Cloudsmith expands repository controls amid rising supply chain attacks.

By Mark Tarre • 4 min read • Last week

Malware

Chainguard joins AWS Security Hub for supply chain

AWS customers can now buy Chainguard Libraries through Security Hub Extended, as open-source dependency attacks push firms to tighten supply chain checks.

By Sofiah Nichole Salivio • 4 min read • This month