Supply Chain Security – Noise

Tame Dependabot: Group your updates, slow the cadence, keep security fast

Bruno Borges — Wed, 29 Jul 2026 16:00:00 +0000

Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project.

The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog.

What Happened Between OpenAI and Hugging Face?

Wade Woolwine — Thu, 23 Jul 2026 12:47:05 +0000

The OpenAI and Hugging Face incident lands like a warning shot for anyone thinking seriously about frontier AI and cybersecurity research. A model evaluation crossed the neat boundary of a research environment, reached a live third-party production sys...

AI is Changing Vulnerability Discovery and your Software Supply Chain Strategy has to Change with it

Wade Woolwine — Thu, 23 Apr 2026 13:25:47 +0000

Wade Woolwine is Senior Director, Product Security at Rapid7.The headlines around Glasswing have focused on how quickly AI can surface vulnerabilities, which has naturally caught the attention of security leaders. In my conversations with teams and cus...

Threat Landscape of the Building and Construction Sector, Part One: Initial Access, Supply Chain, and the Internet of Things

Jeremy Makowski — Fri, 07 Nov 2025 14:00:00 +0000

In 2025, the construction industry stands at the crossroads of digital transformation and evolving cybersecurity risks, making it a prime target for threat actors. Cyber adversaries, including ransomware operators, organized cybercriminal networks, and...

Unlocking security updates for transitive dependencies with npm

Bryan Dragon — Thu, 19 Jan 2023 20:24:01 +0000

How Dependabot integrated with npm to address security vulnerabilities on transitive dependencies and increase the likelihood of success for JavaScript security updates by 40%.

One developer’s journey bringing Dependabot to GitHub Enterprise Server

Landon Grindheim — Tue, 07 Jun 2022 19:55:45 +0000

A personal story about building the feature you want and sharing it with the world.

What’s Changed for Cybersecurity in Banking and Finance: New Study

Jesse Mack — Tue, 10 May 2022 15:27:36 +0000

The results of a new VMware study show a changing landscape for cybersecurity in banking and finance.

How to Strategically Scale Vendor Management and Supply Chain Security

AJ Debole — Tue, 26 Apr 2022 15:07:10 +0000

Here are simple changes that can help you provide more impactful supply chain security guidance and controls to decrease risk.

InsightCloudSec Supports the Recently Updated NSA/CISA Kubernetes Hardening Guide

Alon Berger — Thu, 14 Apr 2022 18:00:00 +0000

The NSA and CISA recently updated their Kubernetes Hardening Guide. Here's how InsightCloudSec supports the updated guidance.

GitHub Availability Report: March 2022

Jakub Oleksy — Wed, 06 Apr 2022 18:45:52 +0000

In March, we experienced several incidents resulting in significant impact to multiple GitHub services.

Prevent the introduction of known vulnerabilities into your code

Courtney Claessens — Wed, 06 Apr 2022 18:13:40 +0000

The new dependency review action and API prevents the introduction of known supply chain vulnerabilities into your code.

An Inside Look at CISA’s Supply Chain Task Force

Chad Kliewer, MS, CISSP, CCSP — Mon, 14 Mar 2022 14:05:18 +0000

In this guest post, Rapid7 customer Chad Kliewer writes about his experience on CISA's new task force created to enhance supply chain resilience.