Stay ahead of what’s next in Agentic AppSec.
Explore research, guides, webinars, analyst insights, and technical resources on securing AI-generated code and modern, AI-first software development.
Legit
Stop Drowning in the 30%
A product security engineer described their AppSec pipeline as roughly 70% automated and 30% still manual. That manual slice is where teams get stuck, and where context-aware prioritization belongs.
Agentic Remediation Just Got Bigger: Now Fixing Vulnerabilities in Your Dependencies, Not Just Your Code
Legit Security's Agentic Remediation now tackles vulnerabilities in dependencies, ensuring faster, verified fixes and enhancing AppSec in an AI-driven landscape.
Claude Mythos 5 Can Find the Vulnerabilities. But Which Ones Actually Matter?
Discover how Claude Mythos 5 enhances vulnerability detection in AppSec and learn to prioritize findings effectively.
Your AI Agent Has New Skills. Can You Trust Them?
Discover how VibeGuard 2.0 enhances security for AI agents, ensuring visibility and control to prevent dangerous…
Secure Fast, Not Slow: What We Learned Building VibeGuard 2.0
Secure Fast, Not Slow. Read more from Legit's CTO and Co-Founder, Liav Caspi, on what we learned building VibeGuard 2.0.
GitHub Locks Down npm: What the New Install Defaults Mean for Your Supply Chain
In July 2026, GitHub is going to change how npm install works for the first time in npm's history - and it's going to…
The Government Just Made Our Case: Stop Fixing Everything, Fix What Matters.
On June 10, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a new directive on how federal…
Agentic AppSec: closing the remediation gap and automating application security
Application security has spent a decade getting brilliant at half of its job. This is about automating the other half…
Fable 5 Is Here. The AppSec Problem Hasn’t Changed.
Anthropic’s release of Fable 5 has reignited discussion about what AI means for cybersecurity. When the company…
The Missing Security Layer in AI-First Development
AI coding agents have changed how developers work. Alongside the productivity gains comes a new challenge: how do…
Scaling Our Vision: Welcoming Tamar Nulman and Omri Arnon to the Legit Team
Welcoming two world-class leaders to the Legit Security family: Tamar Nulman, our new VP of HR, and Omri Arnon, our…
Mythos: Just One Piece of the Cybersecurity Puzzle
Anthropic’s new AI model, Mythos, is being framed as a “cybersecurity reckoning.” Read more here.
Axios Hijacked: npm Account Takeover Deploys Cross-Platform RAT to Millions
Malicious Axios versions 1.14.1 and 0.30.4 were pushed to npm from a hijacked maintainer account. See what happened…
When AI Writes the Code, What Changes for Security?
Takeaways from our RSAC 2026 CISO panel: why AI-written code moves the AppSec control point, how disposable software…
When Your Scanner Becomes the Weapon: From Trivy to LiteLLM
A security breach linked to a compromised Trivy binary exposed LiteLLM. Learn how to protect your infrastructure now.
The Trivy Supply Chain Compromise: What Happened and Playbooks to Respond
Aqua Security's Trivy vulnerability scanner was compromised, exposing sensitive data. Learn how to respond and secure…
Legit Security Named 2026 AI Code Innovator in AppSec, Leader in AppSec Management
Legit Security recognized as a leader in AppSec for innovating AI code security. Discover the award-winning VibeGuard…
Legit License Scanning and Policy Enforcement
Legit’s SCA license scanning detects and classifies open-source licenses and enforces license policies in pull…
Software License Scanning vs. Manual License Review: The True Cost of Compliance
Compare manual license review with automated license scanning: coverage, speed, consistency, and cost, and when each…
Upgraded Custom ASPM Dashboards: Build Security Views That Match How Your Teams Work
Legit Security Custom Dashboards let teams build security views for executives, AppSec, DevOps and compliance, using…
Executive Brief: Questions AI is Creating that Security Can't Answer Today
AI-assisted development is outpacing AppSec governance. See the audit questions security teams can't answer today and…
Technical Architecture Guide: Fixing Code Issues Early to Protect Developer Flow
How AI-assisted coding changes SDLC architecture, why late security feedback breaks developer flow, and how pre-commit…
The AI Security Maturity Model for AI-First Development Teams
A five-stage maturity model for securing AI-assisted development, from shadow AI and reactive cleanup to proactive…
When Security Incidents Break: The Questions Every CISO Asks (And How We Securely Built a Solution in Record Time)
How Legit built its Threat Feed with AI-assisted development, secured the AI-generated code with VibeGuard, and…
Enterprise POV: Why AI Policy Without Enforcement Fails at Scale
AI usage policies don't scale without enforcement. Learn why enterprise AppSec needs guardrails at the moment…
What Breaks First When AI-Generated Code Goes Ungoverned?
The first five things that break when AI-generated code goes ungoverned, from visibility and technical debt to…
Vibe Coding Is Moving Faster Than Security - Market Research Agrees
Vibe coding is reshaping the SDLC, but security is falling behind. Explore new Gartner research on AI code risks and…
From Chatbot to Code Threat: OWASP’s Agentic AI Top 10 and the Specialized Risks of Coding Agents
Explore the OWASP Agentic AI Top 10 and how autonomous coding agents introduce unique risks to the SDLC. Secure your…
4 New AppSec Requirements in the Age of AI
Get details on 4 new AppSec requirements in the AI-led software development era.
Introducing VibeGuard: AI Security & Governance for the Age of Intelligent Coding
Find out how Legit is giving organizations the visibility, control, and protection needed to safely adopt AI coding…
Securing AI-Generated Code: What Does It Look Like in Practice?
Get details on our recent survey on the security of AI-generated code.
Introducing Legit AppSec Remediation Campaigns
New capability delivers faster fixes, measurable compliance reporting, and reduced friction across enterprise AppSec…
“Shai-Hulud” npm Attack: Supply Chain Attack Details
Get details on the Shai-Hulud npm, a major worm. Discover the number of compromised npm packages, the dangers, and how…
A Fresh Look & an AI AppSec Teammate
Smarter navigation, faster insights, and better visibility from Legit
Upwind and Legit Security Partner to Deliver True Code-to-Cloud Application Security
Get details on the benefits of the Legit + Upwind combination.
Meet Legit MCP: AI-Powered Security That Works Where Your Team Works
Get details on the newly released Legit MCP Server.
Remote Prompt Injection in GitLab Duo Leads to Source Code Theft
The Legit research team unearthed vulnerabilities in GitLab Duo.
The 2025 State of Application Risk Report: Understanding AI Risk in Software Development
Get details on the AI risks Legit unearthed in enterprises' software factories.
Announcing New Legit ASPM AI Capabilities
Get details on Legit's new AI capabilities.
Strengthening Software Security Under the EU Cyber Resilience Act: A High-Level Guide for Security Leaders and CISOs
Get guidance on key tenets of the EU CRA and how Legit can help address them.
What to Look for in Application Security Posture Management (ASPM)
Get details on the key capabilities for an ASPM platform.
How Legit Is Using Classic Economic Tools to Prevent Application Vulnerabilities
Prevent vulnerabilities and learn how Legit uses data-driven methods like the Lorenz Curve and the Gini Index to…
Legit Scans for Secrets in SharePoint
Get details on Legit's new ability to scan for secrets in SharePoint.
The Power of Identifying Continuously Vulnerable Repositories (CVRs)
Legit Security is redefining application security by analyzing CVRs, helping enterprises prevent vulnerabilities from…
Legit and Traceable: Better Together
Get details on Legit's new partnership with Traceable.
Next.js Vulnerability: What You Need to Know
Get details on this recent vulnerability, how to respond, and how Legit can help.
Legit Announces New Vulnerability Prevention Capabilities
Get details on Legit's new capabilities that allow AppSec teams to prevent introducing vulnerabilities.
GitHub Actions tj-actions/changed-files Attack
Get details on this recent supply chain attack and how to avoid similar attacks.
Legit SLA Management & Governance – Built for Enterprise-Scale AppSec
Get details on Legit's powerful SLA management capabilities.
The 2025 State of Application Risk Report: Understanding Toxic Combinations in Application Security
Get details on the most common toxic combinations Legit unearthed in enterprises' software factories.
The Ultralytics Supply Chain Attack: How It Happened, How to Prevent
Get details on this recent supply chain attack and how to avoid falling victim to similar attacks.
Announcing Legit Context: The Missing Link to True Business-Driven ASPM
Get details on Legit's new capabilities that allow AppSec teams to focus on the issues posing real risk.
Announcing Legit Root Cause Remediation
Get details on Legit's new capabilities that allow teams to quickly fix what matters most.
Announcing the 2025 State of Application Risk Report
Use the data and analysis in this report to prioritize your 2025 AppSec efforts.
White House Executive Order: Strengthening and Promoting Innovation in the Nation’s Cybersecurity
Get details on this new cybersecurity Executive Order and its implications.
How to Prevent Risk From Unknown Build Assets
Find out why unknown build assets are a growing problem and how Legit can help.
Legit Scans for Secrets in ServiceNow ITSM Tickets
Get details on Legit's ability to scan for secrets in ServiceNow tickets.
Announcing Legit Secrets Detection & Prevention 2.0
Get details on Legit's new secrets capabilities.
Securing the Vault: ASPM's Role in Financial Software Protection
Discover the importance of Application Security Posture Management (ASPM) in financial software protection. Learn how…
Securing the Software Supply Chain: Risk Management Tips
Securing the Software Supply Chain: Risk Management Tips. Securing the software supply chain can seem daunting, but…
What You Need to Know About the XZ Utils Backdoor
What the XZ Utils backdoor (CVE-2024-3094) is, which xz/liblzma versions are affected, how to check your systems, and…
How to Get the Most From Your Secrets Scanning
How to Get the Most From Your Secrets Scanning. Secret scanning is essential for unlocking next-level software supply…
Microsoft Under Attack by Russian Cyberattackers
Microsoft Under Attack by Russian Cyberattackers. Understand how these attackers are operating and what their tactics…
Using AI to Reduce False Positives in Secrets Scanners
Using AI to Reduce False Positives in Secrets Scanners. Get an overview of how secrets scanners work, and how Legit is…
Azure DevOps Zero-Click CI/CD Vulnerability
The Legit Security research team has found and reported a zero-click attack that allowed attackers to submit malicious…
Looking Back on a Legit 2023
Reflections on a Legit 2023 and why we're excited as we look ahead to the new year.
Legit Discovers "AI Jacking" Vulnerability in Popular Hugging Face AI Platform
Uncovering 'AIJacking': How Attackers Exploit Hugging Face for AI Supply Chain Attacks - A Deep Dive into…
OpenSSF SCM Best Practices Guide Released With Contributions From Legitify
Explore the collaborative effort by OpenSSF and leading security vendors in the release of SCM Best Practices Guide.
Legit Security and CrowdStrike: Securing Applications from Code Creation to Cloud Deployment
Legit Security partnered with CrowdStrike to simplify cloud runtime protection. Reduce noise, streamline remediation…
Legit Security ASPM Platform Update: Accelerating AppSec Efficiency and Effectiveness
Legit Security’s ASPM platform unifies application security from code to cloud, allowing teams to reduce risk…
How We Found Another GitHub Actions Environment Injection Vulnerability in a Google Project
This blog shows another case of GitHub Actions environment injection vulnerability in a Google repository.
Securing AI-Generated Code
Explore Legit Security's revolutionary AI application security, risks, and solutions in our blog.
Exposing Secrets Via SDLC Tools: The Artifactory Case
Our team investigated how sensitive information can get exposed via SDLC tools that may be used as part of your…
2023 Predictions for Modern Application Security
This blog analyzes trends in application security and predicts the future direction of enterprise application security…
Legitify Adds Support for GitLab and GitHub Enterprise Server
Legitify is an open-source GitHub and GitLab configuration scanner from Legit Security that helps manage & enforce SCM…
How to Continuously Detect Vulnerable Jenkins Plugins to Avoid a Software Supply Chain Attack
See how attackers used compromised Jenkins plugins to attack the software supply chain and how to continuously detect…
The MarkDownTime Vulnerability: How to Avoid DoS Attack on Business
Explore our findings on a common markdown syntax vulnerability and its potential to cause Denial-of-Service (DoS)…
Introducing Legitify: A Better Way To Secure GitHub
Legitify is an open-source GitHub configuration scanner from Legit Security that helps manage & enforce GitHub…
Google & Apache Found Vulnerable to GitHub Environment Injection
Learn how Legit Security discovered a vulnerable GitHub actions workflow that affected Google, Apache and potentially…
The Open Source Community And Its Critical Role in Software Supply Chain Security
A review of our contributions to the open source community and why the open source community is important to the…
Vulnerable GitHub Actions Workflows Part 2: Actions That Open the Door to CI/CD Pipeline Attacks
We examine a bug we’ve found in a popular third-party GitHub action and how it could lead to your SDLC pipeline being…
