Operations | Monitoring | ITSM | DevOps | Cloud

Thanks to AI, vulnerability disclosures are exploding. In mid 2026, we're seeing 130+ a day and climbing, with roughly a quarter already being exploited in the wild before they're even disclosed. The result: security teams that used to have 30 days to respond now feel pressure to issue patches in a few days or hours. This video covers why "are we safe?" isn't a question you get to answer once: That last drill is what separates teams that panic when a real incident hits from teams that already know the answer.

Think of an SBOM as your ingredient list. A common language describing everything that goes into a piece of software, every dependency and version, in one place. This video covers why SBOMs have gone from niche to mandatory, and why they're harder to pull off than the concept suggests: The concept is simple. Operationalizing it across a large, diverse tech stack is where it gets hard.

CRA compliance is similar to other frameworks, like ISO 27001, SOC 2, GDPR, or PCI DSS, in that the same approach applies: define your scope, figure out your product classification, then work through the list of controls. This video covers why that's less daunting than it sounds: CRA compliance isn't a one-time milestone. If you're selling into Europe, you need to continuously meet it.

Hardened base images are a great secure foundation. They're minimal, security-vetted, and have few dependencies to worry about. But almost nobody ships a bare base image. Teams build on top of it. This video cover whys that "on top of it" layer is where the risk actually lives: Skip the base image hardening and you're building on a shaky foundation. Skip artifact management and you're leaving everything built on top of that foundation ungoverned. A strong posture uses both.

An SBOM is more than a compliance checkbox. It's literally a bill of materials for your product: every software component that makes it into what you ship, plus the metadata that tells you whether it's safe to use. This video covers what that metadata actually does for you: An SBOM earns its keep when it shows you what's actually there, version to version, on a continual basis.

A documented policy only works if every engineer remembers it, every time, under deadline pressure. That's the gap policy-as-code closes. This video covers what that actually looks like in practice: The instructions don't change. What changes is whether something actually enforces them, or just hopes someone reads them.

MIT and Apache 2.0 are the easy licenses. Generally, they let you do what you want. Copyleft licenses are the ones that come back to ask questions later, especially once you're generating revenue off the component. This video covers why license compliance gets challenging, and what actually keeps it under control: The goal isn't avoiding open source. It's knowing what's actually in there before a license or a vulnerability surprises you.

There's a common assumption that the EU Cyber Resilience Act is a hardware and IoT manufacturer concern. Actually, it affects any SaaS company selling into the EU too, and that's a gap in awareness worth closing. This video covers what the CRA is actually there to do and what it means for your own software supply chain: Securing your customers' supply chain starts with being able to account for your own.

You don't need a complete compliance program on day one to make real progress on CRA. You need to close the most visible gaps first. This video covers where to start: None of this is CRA-specific busywork. It's the same foundation most mid-sized software companies need regardless of the framework.

Open up an AI model and what's actually inside is a floating array of decimal points. No one can look at that and confirm it hasn't been tampered with, doesn't contain bias, or wasn't trained on poisoned data. This video covers why that changes how you need to think about trusting a model: If you can't unpick the model itself, you have to be able to trust its origin.