Enterprise perimeter defenses are fundamentally built on an obsolete assumption that the developer’s workstation is a secure, trusted anchor point. The massive security breach executed by the threat group TeamPCP, resulting in the exfiltration of 3,800 internal GitHub source code…
Tag: DZone Security Zone
Phantom APIs Are Eating Your Attack Surface, and Most Security Teams Are Still Looking the Other Way
I’ve spent the better part of fifteen years staring at API traffic logs for a living, and I can tell you the job has changed twice. The first shift came with microservices, when a handful of monolithic endpoints became thousands…
The Breach Was Never at the Door
I’ve lost count of how many breach disclosures I’ve read where the first sentence is some version of “no evidence the perimeter was compromised.” It used to strike me as corporate hedging. Now I read it as the whole story,…
Data Governance Checklist for AI-Driven Systems
Editor’s Note: The following is an article written for and published in DZone’s 2026 Trend Report, Cognitive Databases, Intelligent Data: Unified Infrastructure for Vector Search, AI-Optimized Queries, and Hybrid Workloads. Many teams find governance gaps only after a retrieval system surfaces…
Testing Strategies for Web Development Code Generated by LLMs
Large Language Models (LLMs) can automate the development process by producing a substantial amount of web application code in just a few minutes. Nonetheless, it is important to bear in mind that these models are pattern-based and not deterministic. Work…
AI Is Finding Bugs Faster Than Enterprises Can Patch — Here’s What Data Security Teams Should Do
I have spent the better part of a decade building data protection products for global enterprises. Cloud DLP, CASB, SSPM, Behavior Threats, AI Access Security, ISPM, etc. The kinds of things that sit between a user, an agent, or an…
Top Java Security Vulnerabilities and How to Prevent Them in Modern Java
With the increasing number of security threats, organizations have invested heavily in cybersecurity initiatives to protect their applications, infrastructure, and sensitive data. Security vulnerabilities are rarely introduced intentionally. Most of them creep into applications through shortcuts, overlooked edge cases, outdated…
OpenAPI, ORM, SVG, and Lottie
This is the third follow-up to Friday’s release post. Saturday’s was about how you iterate; yesterday’s was about new platform APIs in the core; today’s is about a run of pieces that change how you write the structural parts of…
The Real-Time Revolution: Why Blockchain Needs Data Stream Processing
Blockchain is an extremely data-driven technology because its primary function is to store, verify, and coordinate independent records in a secure, distributed data network. Without this information, no transaction, smart contract execution, or network activity would be valid, and it…
The Trust Problem in Modern SaaS: Why Your Authentication Succeeded, and You Still Got Breached
Most SaaS breaches do not happen through failure. They happen through valid authentication being trusted too far, for too long, across systems that were never designed to question each other. That distinction is worth sitting with. Because if authentication failed,…
Conversational Risk Accumulation: Stateful Guardrails Beyond Single-Turn LLM Checks
Why Long Chats Need Session-Level Guardrails (CRA) Who this is for: Anyone building chat features, support bots, internal Q&A, coaching tools, RAG assistants. The Usual Setup (and What It Misses) A typical flow: This article has been indexed from DZone…
I Reverse-Engineered 50 API Breaches. The Same Five Mistakes Keep Appearing.
Between December 22, 2025 and January 15, 2026, an attacker spent 24 consecutive days inside Navia Benefit Solutions’ systems. They quietly and methodically pulled Social Security numbers, dates of birth, health plan enrollment details, and COBRA records belonging to 2,697,540…
Why Your AI Agent’s Logs Aren’t Earning Trust
When you are triaging an incident at 2 AM, caused by what your agent did, the only thing that matters at that moment is whether you can understand why the agent did what they did. Eighteen months into the agentic…
Minimus Expands Enterprise Security Platform with General Availability of Advanced Supply Chain Controls
This article was provided by TechnologyWire and does not represent the editorial content of DZone. New York, United States, June 8th, 2026, TechnologyWire This article has been indexed from DZone Security Zone Read the original article: Minimus Expands Enterprise Security…
Prompt Injection Is Real, So I Built a Python Firewall for LLM Pipelines
LLMs are becoming part of everything. They read web pages, summarize PDFs, inspect emails, process customer tickets, call tools, write code, and sometimes even make decisions inside automated workflows. This article has been indexed from DZone Security Zone Read the…
Compliance Automated Standard Solution (COMPASS), Part 11: Compliance as Code, the OSCAL MCP Server Way
(Note: A list of links for all articles in this series can be found at the conclusion of this article.) In the previous installments of this series, we traced the arc from raw compliance intent — regulations such as NIST…
Building Threat Intelligence Pipelines Using Python, APIs, and Elasticsearch
Threat intelligence becomes operationally valuable when indicator data can be collected continuously, normalized into a consistent schema, and queried fast enough to support enrichment and detection workflows. Standardized exchange formats such as STIX and transport protocols such as TAXII exist…
Identity in Action
Switching from one single sign-on (SSO) vendor to another is a complex process that involves more than just changing technologies. This is a high-stakes identity operation that impacts security, user experience, following the rules, accessing applications, and keeping things running…
Compliance Automated Standard Solution (COMPASS), Part 10: How OSCAL Mapping Paves the Way for Continuous Compliance Scalability
(Note: A list of links for all articles in this series can be found at the conclusion of this article.) The Scalability Wall In previous posts of this COMPASS series, we demonstrated how OSCAL enables compliance-as-code from Catalogs through Component…
The Missing `bandit` for AI Agents: How I Built a Static Analyzer for Prompt Injection
If you’re building LLM agents with LangGraph or the OpenAI Agents SDK, your architecture might already be vulnerable — and no runtime tool will catch it before you ship. The Problem Nobody Is Talking About Everyone is building AI agents.…