Understanding software supply chain security is one thing. Putting it into practice across a real pipeline, with real deadlines and real constraints, is another. Most organizations recognize that their software supply chain is a growing attack surface, but translating that awareness into concrete, repeatable practices is where the work gets difficult. But why should your team tackle this now? According to Sonatype, over 99% of open source malware identified in 2025 occurred on npm. And the first self-replicating npm worm emerged, spreading autonomously across developer environments and compromising hundreds of packages within days. Meanwhile, Verizon’s 2025 Data Breach Investigations Report…
Author: drweb
If your goals are accelerating flow and maximizing value in your organization, consider grabbing yourself a ticket to this year’s Flowtopia Live on Wednesday, June 24th. Flowtopia is a community of value stream practitioners, and this is our annual online jamboree where we gather to share, learn, and celebrate all things flow-related.Over 12 hours, we are featuring 50 live and interactive sessions with an incredible line-up of speakers, including transformational leaders from enterprises including Axians, Caisse des dépôts, Delta Airlines, Deutsche Telekom, Genomics England, Metlife, Parchment, Paymentology, Nationwide, NHS, Raytheon, RELEX Solutions, Sky, WIN Brands, Zayo, and many more!What’s onWhat’s…
We keep adding new AI capabilities to Redgate Monitor, where it makes sense. Check out this new feature we’ve added for alerts. This is a great addition to help a busy Ops staff cope with a large database estate.This is part of a series of posts on Redgate Monitor. Click to see the other posts.Alert Index AnalysisOne of the new things we’ve added in Redgate Monitor is an AI analysis of your alerts. This isn’t for every alert. Right now, we have three where this works in preview:Long-running queryblocking processDeadlockThis is documented on its own page.You can see this if…
Allstacks this week added a shared workspace capability to its software engineering intelligence platform that makes it simpler for product and software engineering teams to create specifications for artificial intelligence (AI) agents that organizations plan to develop and deploy.Product Studio provides teams with a place to plan, draft, and refine product requirements using the context that already exists in a software-as-a-service (SaaS) application platform that is used to track the relationship between codebases, customer feedback, delivery history, design files, and strategy documents.Additionally, Allstacks has included an adversarial AI reviewer tool that scores every specification against engineering feasibility, team capacity, security,…
In complex software systems, our traditional definition of operational health has always been comfortably binary. For over a decade, site reliability engineering (SRE) teams have relied on the industry-standard ‘Four Golden Signals’ — latency, traffic, errors and saturation — as the ultimate truth of platform stability. If our API-response times are hovering at sub-100 ms, network throughput is steady, CPU cores aren’t pegged and the HTTP 500 error rate is flatlined at zero, we sleep soundly. We check our Grafana dashboards, see an entirely green pasture and assume that our platform is delivering flawless value to the business. Then came production AI. With organizations rapidly transitioning from deterministic, code-driven microservices to non-deterministic, LLM-powered applications,…
Not every infrastructure pull request deserves the same review path. A tag change in a development account and a network-policy change in production should not create identical reviewer load. When every change is treated as high risk, reviewers stop trusting the signal. In IaC review, I have seen reviewers spend too much attention on low-risk changes while subtle production changes move through with weak context. Risk scoring is useful when it redirects human judgment instead of pretending to replace it. Risk-based review gives platform teams a more useful pattern. The system scores an IaC change using evidence from the diff, environment, resource type,…
Sales professionals can no longer rely on the comfortable, long-term playbooks that served them well for years. Trying to maintain a predictable, steady enterprise sales pipeline inside the financial technology sector right now feels a lot like attempting to build a house on sand. We’re not running through standard industry cycles anymore; we are actively rewriting its foundational infrastructure every single quarter, forcing corporate revenue leaders to completely rethink how they pitch complex solutions to deeply cautious decision-makers. It is a high-pressure environment where a prospective client’s institutional priorities can completely pivot overnight – meaning that surviving, let alone hitting…
The emergence of AI has brought endless possibilities and innovative opportunities in today’s ever-changing, fast-paced technology landscape. AI is helping development teams produce software significantly faster than ever before. AI-enabled DevSecOps tools can automatically scan code, infrastructure and other configurations for security issues throughout development, accelerating the overall process. The introduction of agentic AI into the software development life cycle (SDLC) ensures less time and effort are spent on risk assessments and that incidents can be remediated far more quickly than with traditional methods. The Need for an Agentic Layer in DevSecOps Presently, many organizations use AI as part of the DevSecOps process to automate security tasks and improve efficiency in delivering and integrating code…
Most conversations about CI/CD reliability start in the wrong place. Teams debug flaky pipelines, investigate intermittent failures, tune alerting thresholds and optimize build times. All of that work is legitimate. However, the decisions that most directly determine whether a CI/CD pipeline is reliable or not were made months or years earlier, during tool selection. By the time teams are debugging pipeline reliability, they are usually dealing with the downstream consequences of upstream decisions that seemed reasonable at the time. The software development tools a team chooses shape their CI/CD pipeline in ways that are not always visible during evaluation. Understanding those connections is the most practical starting point for teams that want reliable pipelines…
Cloudflare this week acquired VoidZero, the maintainer of open source tools such as Vite, Vitest, Rolldown, Oxc, and Vite+ that are used widely to build web application frameworks.Rita Kozlov, vice president of product management for Cloudflare, said this acquisition will ensure the financial stability of a set of open source tools that play a critical role in the ongoing development of web application frameworks such as Angular, React and Astro, an open source framework that Cloudflare acquired at the beginning of the year.As part of that effort, Cloudflare also announced it is committing $1 million to help support Vite maintainers…