Blog
Field notes on securing software & AI
DevSecOpsJul 22, 2026· 7 min read
Can AI Replace Your SAST? What Code Review with LLMs Actually Finds
We ran traditional SAST tools and LLM-based reviewers against the same vulnerable codebases. The results say less about which tool wins — and more about how to combine them.
Read article →Agent SecurityJul 10, 2026· 6 min read
Prompt Injection Is the New SQL Injection — and Agents Make It Worse
When an LLM can call tools, read email, and write to your systems, a malicious string stops being a curiosity and becomes an attack path. Here's how we assess it.
Read article →Threat ModelingJun 24, 2026· 5 min read
Threat Modeling AI Applications: Start Before the First Line of Code
STRIDE still works — but AI systems add new assets, new trust boundaries, and new failure modes. A practical walkthrough of how we adapt classic threat modeling for LLM-powered products.
Read article →