Operations | Monitoring | ITSM | DevOps | Cloud

When an auditor tests a control, they ask two questions about each change: was the control met, and what evidence shows how that result was reached? Most automated controls can answer the first. A Rego policy returns allow: true or allow: false, but says nothing about what it checked. Engineers can hand-write violation messages to explain a failure, but a passing check leaves no record at all. When an auditor asks how a change passed, someone has to reconstruct the answer.

Kosli has been selected for the fourth edition of the Scaleup Programme run by Plexal and Barclays Eagle Labs. Following a competitive application process, we’re one of 25 high-growth UK technology companies chosen to take part. The programme is built for companies where growth for scaleups starts to present new challenges, with particular focus on scaling commercial performance, customer expansion, funding, and capital planning.

As AI accelerates software development and expands its scale, Deutsche Bank is taking a leading role in ensuring the technology can be adopted safely, securely, and responsibly across regulated industries. As an investor, Deutsche Bank’s Corporate Venture Capital arm participated in Kosli’s Series A funding round, reinforcing the bank’s view that automated governance will be a key enabler of AI-assisted software delivery in regulated industries.

In April, Anthropic disclosed that its new AI model, Claude Mythos, had found a vulnerability in OpenBSD that survived 27 years of human review. Mozilla used the same model to find 271 security flaws in Firefox in a single evaluation pass.

Since November, Kosli’s own engineering team has been running a live experiment: what happens to code review when the thing generating the code - and increasingly, the thing reviewing it - is an AI, not a person. Alex Kantor, Kosli’s Director of Technology, walked through that experiment in this webinar: what broke, what it cost to fix, and what four “obvious” assumptions in a standard code review control turned out not to hold once you took the human out of the loop.

Norsk Tipping is Norway’s state-owned gaming operator, running 2,500 to 3,000 production releases a year across iOS, Android, web and backend systems. Like every regulated organisation at scale, the platform team has to hold two things in tension: maintain strict deployment controls that stand up to audit, and keep the path to production open so that 100 engineers can ship safely.

Kosli recently released kosli evaluate trail, a command that evaluates selected attestations in a Kosli trail against a Rego policy file. We used it to build a complete and useful solution for tracking Snyk container vulnerabilities for cyber-dojo (an open-sourced browser based online tool for practising TDD which Kosli uses for demos). You’ll read about what we built, why we built it, how we tested it, and specifically.

Good docs are how developers work with a product, from first look to daily use. That’s been true for a long time, and it’s becoming more true as developers increasingly hand that work to agents on their behalf. During the last quarter, we’ve been migrating docs.kosli.com from a static Hugo site to Mintlify, and now it’s finally live. Early reactions from our customers: “A marked improvement over the old docs in layout and usability.” “Looking sharp!”

We’ve built a multi-LLM PR reviewer that runs on every pull request in a couple of our own repos. Two independent models look at each change in parallel, each wearing a set of “persona hats” tuned to a specific area of the codebase. They compare notes, duplicates get stripped out, and the PR author ends up with a single review comment rather than a wall of noise.

Kosli gives your organization a complete picture of software delivery - every build, scan, deployment, and compliance event tracked. Until now that picture was most useful to the people managing governance. However, developers shipping code had to ask someone else what versions of their code were running, how long it was taking to get to production, or what their deployment frequency was. Repositories change that.