Operations | Monitoring | ITSM | DevOps | Cloud

SAST vs SCA vs DAST vs IAST: a clear breakdown of what each scan finds, when to run it, and how to combine them across your SDLC. Most AppSec teams don't run one type of scan - they run several, at different points in the pipeline, because no single tool sees the whole picture. This article breaks down SAST vs SCA vs DAST vs IAST: what each one actually tests, where it fits in the software development lifecycle (SDLC), and how to combine them without duplicating effort or drowning developers in findings.

Interactive Application Security Testing (IAST) finds vulnerabilities in running applications by monitoring code from the inside. Learn how it works and where it fits. Interactive Application Security Testing (IAST) is a method for finding security vulnerabilities in an application while it's running, by instrumenting the code and observing how it behaves during normal use or testing.

At Tigera, we spend a lot of time thinking about agent security: identity, policy, runtime controls, and the record left behind after an agent acts. Coding agents create an interesting problem because, in most organizations, they didn’t arrive through the front door. Few companies ran a platform evaluation and rolled Claude Code out to 500 developers. Developers installed it themselves.

Technically: no. In practice: maybe. Lot’s of teams are experimenting with shorter duration certificates from Let’s Encrypt to get ready for the 47-day mandate. Those certs come with a big gotcha: no more Common Name. A modern browser is perfectly happy with a TLS certificate that has no Common Name. Your VPN or mail server might have other opinions. And since those are probably things you’d like to keep working, there’s a little more nuance to the answer.

Compare the best AI security solutions in 2026: LLM security, model monitoring, and AI-powered SOC tools, plus buying criteria and vendor questions.

CI/CD security best practices for 2026: secrets management, scoped access, dependency scanning, signed artifacts, and audit logging in one checklist.

Australia’s critical infrastructure landscape has changed significantly. The Security of Critical Infrastructure Act 2018 (SOCI Act) has evolved from a framework focused primarily on identifying critical assets and reporting incidents into a broader risk-management and operational-resilience regime. The 2024 reforms reinforced that direction, increasing the focus on the systems, data, and technology dependencies that underpin Australia’s essential services.

A patch release that never says the word “security” just closed four real security gaps in Mongoid. If your Rails app runs on MongoDB, 7.6.2 is the kind of release that’s easy to auto-merge and easy to regret not reading first.

A couple days ago, I told you how a spammer got a certificate for dev-docs.trackjs.com, and that we only found out because Google emailed us. Google knew because the spammer claimed the hostname in Search Console. An attacker running a phishing page wouldn’t have done that, but they would still need a certificate. Every publicly trusted certificate gets written to a public log, and we track that log in our database. We just weren’t watching it. Now we are, and you can too.