The package you did not review
Every npm install and pip install runs someone else's code on your laptop and in your build. How software supply-chain attacks work, and what a package firewall changes.
Incident response for engineering teams
The first hour of a security incident is decided months earlier. A practical plan for teams that ship software, not a template for a binder.
Your attack surface is larger than your asset list
Attackers do not start from your CMDB. They start from DNS, certificates and the open internet. Exposure management is seeing what they see, before they do.
Secure SDLC without slowing delivery
Security that lives in the pipeline instead of at the end of it. Five controls that catch most of what matters, and the two that teams usually skip.