10 stories
Where do application security programs lose time and create a backlog? Not in the detection itself, but in the gap between detection and an approved fix. Every finding that reaches your team opens four questions before anyone can act on it: Detection only surfaced the problem.
CISA’s latest directive shifts the focus from severity or number of findings to the actual risk context when deciding how to remediate. For federal cybersecurity teams, that shift is becoming increasingly important as vulnerabilities are discovered faster than teams can fix them.
The regulators are done with “Trust as policy”. That chain used to be an internal maturity problem, something a security program could work on over time: A developer trusts AI-generated code because it compiles. A reviewer trusts an AI-generated summary because it reads plausibly.
For most software teams, security is a race against a clock. The median time from vulnerability disclosure to weaponization has collapsed from 840 days to 1.6 days, and 80% of exploitations now occur on or before the day of disclosure. That’s bad.
Black Hat USA 2026 didn’t introduce the AI security problem, but made it clear how fast that problem is becoming operational. An independent study initiated and funded by Checkmarx helps explain why.
Now available in Early Access for SAST within Checkmarx One, Checkmarx Fusion adds a new detection layer that advances vulnerability-finding accuracy beyond what rules-based scanning or an AI model can achieve alone.
Learn why a hybrid application security strategy combining deterministic tools and AI delivers better protection, lower costs, and faster remediation for AI-generated code.
New research: 65–75% of frontier AI agents’ working patches resurrect vulnerabilities that were already found, fixed, and buried. In 2023, a path traversal vulnerability in Starlette, one of Python’s most popular web frameworks – was found, disclosed as CVE-2023-29159, and fixed. Case closed.
Checkmarx One for Government (CxG) has officially achieved FedRAMP Certified status at the Moderate Impact Level.
Modern applications don’t just run on code anymore. They run on models, agents, embeddings, datasets, and autonomous tools like MCP servers. Developers are pulling pre-trained LLMs from Hugging Face, integrating open-source agent frameworks, and wiring up AI pipelines faster than security teams can…
Showing 10 of 10 stories
You're all caught up.
Get the top AI news and tools straight to your inbox every week.
Weekly · AI news
Join 15,000+ AI enthusiasts
