PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

GenAI DevOps: More Code, More Problems

bishopfox.com | blog | #ai-security | #devops | #ci-cd | #application-security | #genai | #guardrails | #secure-by-default
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

GenAI lets non-developers ship production code that bypasses review fail-safes; Derek Rush's 15 guardrails, such as templates, secrets management, and CI gates, make the secure path the easiest route.
Published
Collected

Related coverage

blog · bugcrowd.com
Savant Forge: Automated offensive testing to keep pace with AI-generated code
Bugcrowd's Savant Forge combines fuzz testing with symbolic execution to surface real exploitable vulnerabilities in CI/CD pipelines, while Savant Runtime tracks live third-party components in production to support SBOM compliance.
blog · about.gitlab.com
How to design GitLab for enterprise scale
A guide to enterprise GitLab rollouts comparing GitLab.com, Dedicated, and self-managed models, with planning guidance for runners, availability, disaster recovery, and pipeline performance at scale.
blog · about.gitlab.com
How to calculate DevOps platform total cost of ownership
GitLab's guide to DevOps platform TCO: beyond license fees, CI/CD compute, AI usage, tooling and staff time all count — model a fixed one-year scope and watch for tool sprawl inflating spend.
blog · wiz.io
The Jenkins Threat Landscape
Wiz data: Jenkins runs in over a third of cloud environments; 59% have instances vulnerable to critical core flaws, 87% contain end-of-life versions, and 48% use highly privileged service accounts.
blog · bishopfox.com
AI & Security Risks: Reviewing Governance and Guardrails
AI panel recap: boards push adoption while security teams race to keep up; AI risk is probabilistic, third-party-dependent, and easily over-permissioned—so start with inventory and least privilege.
blog · xbow.com
How Attackers Are Using AI & What Defenders Must Do
Attackers are running AI driven attack chains from recon to exploitation in minutes. Here’s what actually changed, and why defenders need AI pentesting to keep pace.
Back