Open-source attacks move faster than most AppSec programs can respond. When a vulnerable or malicious package reaches production, the question becomes whether your team can see what is actually running, understand the real exposure, and respond before it turns into an incident. The ADR Readiness Assessment helps benchmark how prepared your security program is for that reality. 11 questions. About 3 minutes. Take the assessment: na2.hubs.ly/H08lK170

AI is killing SCA and ASPM as we know them. AI-generated code is creating security risks that may never get a CVE. No advisory. No severity score. No finding to prioritize. For CISOs, that raises a question: What does your security strategy look like when there’s no CVE to act on? SCA and ASPM help us manage known vulnerabilities. But prioritization can’t protect us from risks that never enter the queue. We need to ask more than “What do we need to patch?” What should the code running in our applications be allowed to do? Should a third-party library be able to launch a shell? Read sensitive files? Make an unexpected outbound connection? We can set and enforce those boundaries before a CVE exists. Patching and prioritization remain essential. But protection cannot wait for disclosure. In my latest blog, “AI Is Killing SCA and ASPM as We Know Them,” I explore what comes next for third-party code security. na2.hubs.ly/H08kMS_0

The vulnerability apocalypse is coming. Anthropic just announced free AI-powered vulnerability scanning for open-source maintainers. Now imagine thousands of projects opting in. An explosion of vulnerabilities. Overwhelmed maintainers. Security teams drowning in CVEs. Enterprises unable to patch fast enough. AI is accelerating vulnerability discovery faster than organizations can remediate. And attackers don't need to wait for a CVE anymore. Why should your security strategy depend on one? Raven’s latest perspective on the future of application security. Read the full blog: na2.hubs.ly/H08kC3P0

🚨 Last chance to register. We’re live tomorrow. Join Raven and James Berthoty of Latio for Before the CVE: The 14 Software Families AI Will Target First. We’ll reveal original research, explore how AI is accelerating pre-CVE attacks, and demonstrate live exploits traced to the exact open-source library, function, input, and runtime call chain responsible. 📅 Tomorrow, October 8 ⏰ 12 PM ET / 9 AM PT 🔗 na2.hubs.ly/H08fd710 Can’t attend live? Register anyway and we’ll send you the recording.

AppSec teams need more than infrastructure-level visibility. EDR is still an important part of the security stack. It helps teams monitor processes, files, network activity, system calls, and suspicious behavior across endpoints and workloads. But when the issue is inside a production application, AppSec needs deeper context to understand which library, function, request, and execution path caused the behavior. That is where ADR fits. EDR shows what happened on the workload. ADR adds the application context needed to understand why it happened and what developers should fix. See how ADR and EDR work together: na2.hubs.ly/H088x-Q0 #ADR #EDR #ApplicationSecurity #RuntimeSecurity

Is it possible to PREVENT the exploit without knowing the vulnerability? Yes, if you can see and control what code is doing at runtime. Unknown exploits may not have a CVE, signature, or rule yet, but they still have to execute. Runtime security focuses on that behavior, helping teams stop dangerous actions before they become a successful attack. More on preventing unknown exploits: na2.hubs.ly/H083q7k0 #RuntimeSecurity #ApplicationSecurity #ZeroDay #Cybersecurity

Compliance frameworks increasingly expect organizations to prove how production applications are protected. DORA. PCI DSS. SOC 2. ISO 27001. NIST. FedRAMP. The challenge is turning runtime security into evidence auditors and security teams can actually use. Cleared for Runtime looks at how production visibility, prevention, and runtime evidence can support those requirements. na2.hubs.ly/H083pQN0 #Compliance #RuntimeSecurity #ApplicationSecurity

AI is changing more than how software gets built. It is changing how quickly attackers can study public code, identify weaknesses, develop exploit paths, and move from discovery to execution. Security models built around known vulnerabilities and completed patches were not designed for that speed. The next generation of application security needs to understand what code is actually doing in production and prevent dangerous behavior at the moment of execution, whether a CVE exists or not. Join Raven on October 8 for Before the CVE, where we will break down the 14 software families we believe deserve the closest attention in the AI era. Save your seat: na2.hubs.ly/H0825Wj0 #AIsecurity #RuntimeSecurity #AppSec #Cybersecurity

Family 14 of the Raven Power List: Identity-String Normalization Primitives — "The Double." Two names, one face. Normalization and encoding primitives decide when two different strings count as "the same." Get it wrong and you get spoofing, filter bypass and account confusion — one identity wearing another's face. The Double's risk hides in the gap between what a filter checked and what the system finally used. That gap only appears at runtime. The 14th and final family in our new research. Download the research: na2.hubs.ly/H07-3Dd0 #AppSec #ApplicationSecurity #Cybersecurity #OpenSourceSecurity

👀 Have you registered yet? On October 8, we’re going beyond CVEs to reveal the 14 open-source software families AI will target first, why runtime visibility matters, and how Raven traces an exploit to the exact library, function, input, and call chain responsible. 📅 October 8, 2026 ⏰ 12 PM ET / 9 AM PT 🔗 na2.hubs.ly/H07-6Lf0 Can’t make it live? Register anyway and we’ll send you the recording. 📩

The malicious package didn’t strike during installation. It waited until the application used it. That’s the end of the story and the beginning of a much bigger security problem. Our latest analysis explores what the Checkmarx indexed-btree discovery means for software supply chain defense, and why protection can’t stop at installation. The attacker moved. The security boundary has to move too. Read the full story: na2.hubs.ly/H07-Z9j0 #SoftwareSupplyChain #npm #AppSec #RuntimeSecurity

Family 13 of the Raven Power List: Object Binding / Object-Structure Mutation — "The Locksmith." It quietly reshapes what objects are. Binders and mappers mutate object structure from external input — prototype pollution, mass assignment and, downstream, RCE. The damage is subtle: fields and behaviors change without an obvious break. You can't read the Locksmith's work in a CVE list. You see it at runtime, when attacker-shaped input rewrites an object's structure. One of the 14 most powerful families in software. Get your copy: na2.hubs.ly/H07-3CD0 #PrototypePollution #ApplicationSecurity #Cybersecurity #OpenSourceSecurity

Family 12 of the Raven Power List: Output-Side Injection — "The Messenger." What it writes, others obey. Libraries that emit HTML, logs, headers and mail send data into systems that act on it — browsers, log pipelines, mail servers. That downstream trust is why XSS, log injection and header injection sit here. The Messenger's risk isn't inbound; it's what leaves. And only runtime shows what it actually wrote, and who read it. 14 families run the core of software. This one carries the outbound word. Get the research: na2.hubs.ly/H07SJDB0 #XSS #ApplicationSecurity #Cybersecurity #OpenSourceSecurity

Your application is 85% open source. AI is finding new attack paths through it - faster than any human security team can keep up. These attacks don’t require a conventional software flaw. They are able to manipulate capabilities that trusted libraries already have. On October 8, join Raven’s Roi Abitboul and Omer Yair, alongside Latio’s James Berthoty, to see: → Where CVE tracking falls short → How AI accelerates exploit discovery → How trusted libraries become attack paths → A controlled exploit traced to the exact library, function, input, and call chain Before the CVE: The 14 Software Families AI Will Find First 📅 Thursday, October 8, 2026 ⏰ 12:00 PM ET / 9:00 AM PT 🔗 na2.hubs.ly/H07SJxZ0 #ApplicationSecurity #OpenSourceSecurity #Cybersecurity #AISecurity

JP Morgan's recent report is stating that 77% of the code in modern applications is open source. That means attackers can study most of your application without ever getting inside your company. AI makes that advantage more consequential. Models can analyze public libraries at machine speed, trace dependencies and find dangerous execution paths long before a vulnerability has a CVE or defenders know what to look for. This isn’t an argument against open source. Modern software wouldn’t exist without it. It’s an argument for visibility. Our latest article looks at the maintainers holding the software ecosystem together, the transitive dependencies hiding inside modern applications and why security teams need to watch every library at runtime. Read the full article: na2.hubs.ly/H07SLkq0 #ApplicationSecurity #OpenSourceSecurity #RuntimeSecurity

Six compliance frameworks. One recurring challenge: proving what actually happened inside the application. Runtime security acts like an application flight recorder - capturing execution context, protection decisions, outcomes, and coverage. Our new whitepaper, Cleared for Runtime, explores how these facts can reduce application risk and audit friction across DORA, PCI DSS, SOC 2, ISO 27001, NIST SP 800-53, and FedRAMP. Read the whitepaper: na2.hubs.ly/H07SJcV0 #AppSec #RuntimeSecurity #Cybersecurity #Compliance