Operations | Monitoring | ITSM | DevOps | Cloud

CircleCI Chief Legal & People Officer on why learning fast, experimenting, and staying curious matter more than ever.

Thanks to AI, vulnerability disclosures are exploding. In mid 2026, we're seeing 130+ a day and climbing, with roughly a quarter already being exploited in the wild before they're even disclosed. The result: security teams that used to have 30 days to respond now feel pressure to issue patches in a few days or hours. This video covers why "are we safe?" isn't a question you get to answer once: That last drill is what separates teams that panic when a real incident hits from teams that already know the answer.

Think of an SBOM as your ingredient list. A common language describing everything that goes into a piece of software, every dependency and version, in one place. This video covers why SBOMs have gone from niche to mandatory, and why they're harder to pull off than the concept suggests: The concept is simple. Operationalizing it across a large, diverse tech stack is where it gets hard.

Connect Codex to CircleCI and give your coding agent direct access to the CI feedback it needs to keep working. In this tutorial, we’ll walk through setting up the CircleCI CLI and CircleCI plugin for Codex, then show how Codex can check pipeline results, validate your CircleCI config, diagnose failed builds, trigger new pipelines, and keep iterating on a fix until CI is green. Instead of bouncing between your terminal and CircleCI to copy logs and errors back to your agent, you can bring the full CI feedback loop directly into your Codex session.

CRA compliance is similar to other frameworks, like ISO 27001, SOC 2, GDPR, or PCI DSS, in that the same approach applies: define your scope, figure out your product classification, then work through the list of controls. This video covers why that's less daunting than it sounds: CRA compliance isn't a one-time milestone. If you're selling into Europe, you need to continuously meet it.

Hardened base images are a great secure foundation. They're minimal, security-vetted, and have few dependencies to worry about. But almost nobody ships a bare base image. Teams build on top of it. This video cover whys that "on top of it" layer is where the risk actually lives: Skip the base image hardening and you're building on a shaky foundation. Skip artifact management and you're leaving everything built on top of that foundation ungoverned. A strong posture uses both.