Stay ahead of what’s next in Agentic AppSec.
Explore research, guides, webinars, analyst insights, and technical resources on securing AI-generated code and modern, AI-first software development.
AppSec
Stop Drowning in the 30%
A product security engineer described their AppSec pipeline as roughly 70% automated and 30% still manual. That manual slice is where teams get stuck, and where context-aware prioritization belongs.
Agentic Remediation Just Got Bigger: Now Fixing Vulnerabilities in Your Dependencies, Not Just Your Code
Legit Security's Agentic Remediation now tackles vulnerabilities in dependencies, ensuring faster, verified fixes and enhancing AppSec in an AI-driven landscape.
Claude Mythos 5 Can Find the Vulnerabilities. But Which Ones Actually Matter?
Discover how Claude Mythos 5 enhances vulnerability detection in AppSec and learn to prioritize findings effectively.
Your AI Agent Has New Skills. Can You Trust Them?
Discover how VibeGuard 2.0 enhances security for AI agents, ensuring visibility and control to prevent dangerous…
Secure Fast, Not Slow: What We Learned Building VibeGuard 2.0
Secure Fast, Not Slow. Read more from Legit's CTO and Co-Founder, Liav Caspi, on what we learned building VibeGuard 2.0.
GitHub Locks Down npm: What the New Install Defaults Mean for Your Supply Chain
In July 2026, GitHub is going to change how npm install works for the first time in npm's history - and it's going to…
The Government Just Made Our Case: Stop Fixing Everything, Fix What Matters.
On June 10, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a new directive on how federal…
Agentic AppSec: closing the remediation gap and automating application security
Application security has spent a decade getting brilliant at half of its job. This is about automating the other half…
Fable 5 Is Here. The AppSec Problem Hasn’t Changed.
Anthropic’s release of Fable 5 has reignited discussion about what AI means for cybersecurity. When the company…
The Missing Security Layer in AI-First Development
AI coding agents have changed how developers work. Alongside the productivity gains comes a new challenge: how do…
Scaling Our Vision: Welcoming Tamar Nulman and Omri Arnon to the Legit Team
Welcoming two world-class leaders to the Legit Security family: Tamar Nulman, our new VP of HR, and Omri Arnon, our…
Mythos: Just One Piece of the Cybersecurity Puzzle
Anthropic’s new AI model, Mythos, is being framed as a “cybersecurity reckoning.” Read more here.
Axios Hijacked: npm Account Takeover Deploys Cross-Platform RAT to Millions
Malicious Axios versions 1.14.1 and 0.30.4 were pushed to npm from a hijacked maintainer account. See what happened…
When AI Writes the Code, What Changes for Security?
Takeaways from our RSAC 2026 CISO panel: why AI-written code moves the AppSec control point, how disposable software…
When Your Scanner Becomes the Weapon: From Trivy to LiteLLM
A security breach linked to a compromised Trivy binary exposed LiteLLM. Learn how to protect your infrastructure now.
The Trivy Supply Chain Compromise: What Happened and Playbooks to Respond
Aqua Security's Trivy vulnerability scanner was compromised, exposing sensitive data. Learn how to respond and secure…
Legit Security Named 2026 AI Code Innovator in AppSec, Leader in AppSec Management
Legit Security recognized as a leader in AppSec for innovating AI code security. Discover the award-winning VibeGuard…
Legit License Scanning and Policy Enforcement
Legit’s SCA license scanning detects and classifies open-source licenses and enforces license policies in pull…
Software License Scanning vs. Manual License Review: The True Cost of Compliance
Compare manual license review with automated license scanning: coverage, speed, consistency, and cost, and when each…
Upgraded Custom ASPM Dashboards: Build Security Views That Match How Your Teams Work
Legit Security Custom Dashboards let teams build security views for executives, AppSec, DevOps and compliance, using…
Executive Brief: Questions AI is Creating that Security Can't Answer Today
AI-assisted development is outpacing AppSec governance. See the audit questions security teams can't answer today and…
Technical Architecture Guide: Fixing Code Issues Early to Protect Developer Flow
How AI-assisted coding changes SDLC architecture, why late security feedback breaks developer flow, and how pre-commit…
The AI Security Maturity Model for AI-First Development Teams
A five-stage maturity model for securing AI-assisted development, from shadow AI and reactive cleanup to proactive…
When Security Incidents Break: The Questions Every CISO Asks (And How We Securely Built a Solution in Record Time)
How Legit built its Threat Feed with AI-assisted development, secured the AI-generated code with VibeGuard, and…
Enterprise POV: Why AI Policy Without Enforcement Fails at Scale
AI usage policies don't scale without enforcement. Learn why enterprise AppSec needs guardrails at the moment…
What Breaks First When AI-Generated Code Goes Ungoverned?
The first five things that break when AI-generated code goes ungoverned, from visibility and technical debt to…
Vibe Coding Is Moving Faster Than Security - Market Research Agrees
Vibe coding is reshaping the SDLC, but security is falling behind. Explore new Gartner research on AI code risks and…
From Chatbot to Code Threat: OWASP’s Agentic AI Top 10 and the Specialized Risks of Coding Agents
Explore the OWASP Agentic AI Top 10 and how autonomous coding agents introduce unique risks to the SDLC. Secure your…
4 New AppSec Requirements in the Age of AI
Get details on 4 new AppSec requirements in the AI-led software development era.
Introducing VibeGuard: AI Security & Governance for the Age of Intelligent Coding
Find out how Legit is giving organizations the visibility, control, and protection needed to safely adopt AI coding…
Securing AI-Generated Code: What Does It Look Like in Practice?
Get details on our recent survey on the security of AI-generated code.
Introducing Legit AppSec Remediation Campaigns
New capability delivers faster fixes, measurable compliance reporting, and reduced friction across enterprise AppSec…
CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code
Get details on our discovery of a critical vulnerability in GitHub Copilot Chat.
Survey Reveals Consumer Sentiment on AI-Created Apps
A new Legit survey reveals 1 in 4 consumers would abandon apps over AI code vulnerabilities. Explore the data on AI…
The Risks of AI-Generated Software Development
Get details on how AI is introducing new risk to software.
How AI Is Changing the Software Development Process, and Product
Get details on how AI is transforming software, and how it is developed.
“Shai-Hulud” npm Attack: Supply Chain Attack Details
Get details on the Shai-Hulud npm, a major worm. Discover the number of compromised npm packages, the dangers, and how…
A Fresh Look & an AI AppSec Teammate
Smarter navigation, faster insights, and better visibility from Legit
Application Security in 2025: Why Scale, AI, and Automation Are Reshaping Priorities
New survey results shed light on the state of AppSec in 2025.
Upwind and Legit Security Partner to Deliver True Code-to-Cloud Application Security
Get details on the benefits of the Legit + Upwind combination.
Meet Legit MCP: AI-Powered Security That Works Where Your Team Works
Get details on the newly released Legit MCP Server.
Remote Prompt Injection in GitLab Duo Leads to Source Code Theft
The Legit research team unearthed vulnerabilities in GitLab Duo.
The 2025 State of Application Risk Report: Understanding AI Risk in Software Development
Get details on the AI risks Legit unearthed in enterprises' software factories.
Announcing New Legit ASPM AI Capabilities
Get details on Legit's new AI capabilities.
Strengthening Software Security Under the EU Cyber Resilience Act: A High-Level Guide for Security Leaders and CISOs
Get guidance on key tenets of the EU CRA and how Legit can help address them.
What to Look for in Application Security Posture Management (ASPM)
Get details on the key capabilities for an ASPM platform.
How Legit Is Using Classic Economic Tools to Prevent Application Vulnerabilities
Prevent vulnerabilities and learn how Legit uses data-driven methods like the Lorenz Curve and the Gini Index to…
Legit Scans for Secrets in SharePoint
Get details on Legit's new ability to scan for secrets in SharePoint.
The Power of Identifying Continuously Vulnerable Repositories (CVRs)
Legit Security is redefining application security by analyzing CVRs, helping enterprises prevent vulnerabilities from…
Legit and Traceable: Better Together
Get details on Legit's new partnership with Traceable.
Next.js Vulnerability: What You Need to Know
Get details on this recent vulnerability, how to respond, and how Legit can help.
Legit Announces New Vulnerability Prevention Capabilities
Get details on Legit's new capabilities that allow AppSec teams to prevent introducing vulnerabilities.
GitHub Actions tj-actions/changed-files Attack
Get details on this recent supply chain attack and how to avoid similar attacks.
Legit SLA Management & Governance – Built for Enterprise-Scale AppSec
Get details on Legit's powerful SLA management capabilities.
The 2025 State of Application Risk Report: Understanding Toxic Combinations in Application Security
Get details on the most common toxic combinations Legit unearthed in enterprises' software factories.
The Ultralytics Supply Chain Attack: How It Happened, How to Prevent
Get details on this recent supply chain attack and how to avoid falling victim to similar attacks.
Announcing Legit Context: The Missing Link to True Business-Driven ASPM
Get details on Legit's new capabilities that allow AppSec teams to focus on the issues posing real risk.
Announcing Legit Root Cause Remediation
Get details on Legit's new capabilities that allow teams to quickly fix what matters most.
Announcing the 2025 State of Application Risk Report
Use the data and analysis in this report to prioritize your 2025 AppSec efforts.
White House Executive Order: Strengthening and Promoting Innovation in the Nation’s Cybersecurity
Get details on this new cybersecurity Executive Order and its implications.
How to Prevent Risk From Unknown Build Assets
Find out why unknown build assets are a growing problem and how Legit can help.
Legit Scans for Secrets in ServiceNow ITSM Tickets
Get details on Legit's ability to scan for secrets in ServiceNow tickets.
Announcing Legit Secrets Detection & Prevention 2.0
Get details on Legit's new secrets capabilities.
How to Reduce Risk From Exposed Secrets
Understand how secrets end up exposed, and how to prevent this risk.
Unlocking the Power and Potential of GenAI in Software Development
GenAI's rapid adoption brings with it significant challenges in security, governance, and visibility.
How to Reduce Risk From Developer Permissions Sprawl
How to Reduce Risk From Developer Permissions Sprawl. Get steps to prevent risky permissions sprawl in your SDLC.
How to Reduce Risk From Misconfigured Build Assets
How to Reduce Risk From Misconfigured Build Assets. Get steps to prevent risky misconfigurations in your SDLC.
Software Security Best Practices: Where to Focus First
Software Security Best Practices: Where to Focus First. Get our recommendations on where to focus your software…
How to Mitigate the Risk of GitHub Actions
How to Mitigate the Risk of GitHub Actions. Get highlights of our research into the security of GitHub Actions, and…
The Risks Lurking in Publicly Exposed GenAI Development Services
The Risks Lurking in Publicly Exposed GenAI Development Services. Get our research team's analysis of the security of…
ESG Survey Report Finds AI, Secrets, and Misconfigurations Plague AppSec Teams
ESG Survey Report Finds AI, Secrets, and Misconfigurations Plague AppSec Teams. Find out how your peers are managing…
Preview of State of GitHub Actions Security Report: Security of GH Workflows Building Blocks
Security of the Building Blocks of GitHub Actions Workflows. Understand the security status of GitHub Actions…
Why Legit Security Immediately Joined the New Coalition for Secure Artificial Intelligence (CoSAI)
Why Legit Security Immediately Joined Google’s New Coalition for Secure Artificial Intelligence (CoSAI). Get details…
Security of Custom GitHub Actions
Security of Custom GitHub Actions. Get details on Legit's research on the security of custom GitHub Actions.
Announcing The State of GitHub Actions Security Report
Announcing the State of GitHub Actions Security Report. Get details on Legit's research on the security of GitHub…
EU Cyber Resilience Act: Updates and Important Requirements
Ensure compliance with the EU Cyber Resilience Act. Learn CRA essentials, how to secure digital products, and how…
What is ASPM? Application Security Posture Management 101
Learn how Legit Security enhances Application Security Posture Management (ASPM) by automating key processes to ensure…
Security Challenges Introduced by Modern Software Development
Security Challenges Introduced by Modern Software Development. Understand how modern software development is changing…
Don’t Protect Your Software Supply Chain, Defend the Entire Software Factory
Don't Protect Your Software Supply Chain, Defend the Entire Software Factory. Find out why a too-narrow definition of…
Securing the Gateway: Why Protecting Build Systems Is Crucial in Modern Software Development
Securing the Gateway: Why Protecting Build Systems Is Crucial in Modern Software Development. Understand why securing…
Verizon 2024 DBIR: Key Takeaways
Verizon 2024 DBIR Key Takeaways. Get key data points and takeaways from the 2024 Verizon Data Breach Investigations…
New Survey Finds a Paradox of Confidence in Software Supply Chain Security
New Survey Finds a Paradox of Confidence in Software Supply Chain Security. Get results of and analysis on ESG's new…
Securing the Vault: ASPM's Role in Financial Software Protection
Discover the importance of Application Security Posture Management (ASPM) in financial software protection. Learn how…
Dependency Confusion Vulnerability Found in an Archived Apache Project
Dependency Confusion Vulnerability Found in an Archived Apache Project. Get details on the Legit research team's…
How to Reduce the Risk of Using External AI Models in Your SDLC
How to Reduce the Risk of Using External AI Models in Your SDLC. Understand how AI models add risk and how to address…
Securing the Software Supply Chain: Risk Management Tips
Securing the Software Supply Chain: Risk Management Tips. Securing the software supply chain can seem daunting, but…
What You Need to Know About the XZ Utils Backdoor
What the XZ Utils backdoor (CVE-2024-3094) is, which xz/liblzma versions are affected, how to check your systems, and…
How to Get the Most From Your Secrets Scanning
How to Get the Most From Your Secrets Scanning. Secret scanning is essential for unlocking next-level software supply…
Microsoft Under Attack by Russian Cyberattackers
Microsoft Under Attack by Russian Cyberattackers. Understand how these attackers are operating and what their tactics…
Using AI to Reduce False Positives in Secrets Scanners
Using AI to Reduce False Positives in Secrets Scanners. Get an overview of how secrets scanners work, and how Legit is…
Don't Miss These Emerging Trends in Cloud Application Security
Don't Miss These Emerging Trends in Cloud Application Security. Get details on trends and best practices in cloud…
GenAI-Based Application Security 101
Gain insights into GenAI applications and how they represent an innovative category of technology, leveraging Large…
Legit Security Named in the 2024 Gartner® Emerging Tech Impact Radar: Cloud-Native Platforms report
Gain insights into the 2024 Gartner's® report Emerging Tech Impact Radar: Cloud-Native Platforms report and how Legit…
Navigating the Shift: Unveiling the changes in PCI DSS version 4
Gain insights in the latest changes in PCI DSS version 4 with this quick overview, highlighting the primary changes…
Azure DevOps Zero-Click CI/CD Vulnerability
The Legit Security research team has found and reported a zero-click attack that allowed attackers to submit malicious…
Mitigate Enterprise Software Supply Chain Security Risks - Insights Into the Gartner® Report
Gain insights into Gartner's® new report and learn how to mitigate enterprise software supply chain risks
SLSA Provenance Blog Series, Part 4: Implementation Challenges for SLSA Provenance for Enterprises
This blog series covers everything from SLSA levels to real-world adoption issues. It helps enterprises confidently…
GitHub, PyTorch and More Organizations Found Vulnerable to Self-Hosted Runner Attacks
Learn how vulnerable self-hosted runners can lead to severe software supply chain attacks.
