Application & Platform Security
Top Stories
-
News
20 Jul 2026
Employees' shadow AI use is poorly monitored, survey finds
Employee behavior has always presented one of the biggest enterprise cybersecurity challenges. Add AI into the equation, and education and governance become even more critical. Continue Reading
-
Tip
16 Jul 2026
Why CISOs should automate SBOM management with AI
AI tools can drive continuous, accurate SBOM management that turns compliance documentation into real-time supply chain security. Here's what CISOs should know. Continue Reading
-
Tip
07 Jul 2026
Evaluating secure enterprise browsers vs. security plugins
Malicious actors have long targeted and exploited browser vulnerabilities. The widespread adoption of AI increases the risk, forcing CISOs to reevaluate browser security options. Continue Reading
-
Tip
12 May 2026
How to implement zero trust for AI
As organizations embed AI into business systems, they also expand the attack surface. Applying zero trust to AI can help mitigate the risk. Continue Reading
-
Video
07 May 2026
Claude Mythos changes the AI security threat matrix
The Claude Mythos preview has raised alarms about AI-driven threats. Is this a new era for cybersecurity professionals? Continue Reading
-
Tip
11 Mar 2026
How to start an enterprise bug bounty program: A CISO's guide
Bug bounty programs offer flexible rewards, global expertise and enhanced security, helping organizations address vulnerabilities before exploitation. Continue Reading
-
Feature
12 Dec 2025
Guide to cloud container security risks and best practices
Containers are an integral part of a growing number of production environments. But they can become security risks if not managed correctly. Continue Reading
-
Tip
04 Dec 2025
12 key application security best practices
Developing applications involves many important practices, but one that might matter most is to be sure the team is addressing security at every stage of the SDLC. Continue Reading
-
Tip
19 Nov 2025
When to consider Kubernetes security posture management
Securely using Kubernetes to build, manage and automate application and infrastructure deployments is a growing challenge for security teams. Continue Reading
-
Tip
10 Nov 2025
CNAPP vs. CSPM: Comparing cloud security tools
CNAPP or CSPM? Understand the key differences between these cloud security tools to make an informed choice that aligns with your organization's maturity level. Continue Reading
-
News
07 Nov 2025
News brief: Collaboration apps face security scrutiny -- again
Check out the latest security news from the Informa TechTarget team. Continue Reading
-
Opinion
03 Oct 2025
HashiConf highlights security opportunities to support scale
HashiCorp's latest tools and updates help security teams collaborate with DevOps teams for efficient, scalable cloud security. Continue Reading
-
Tip
26 Sep 2025
7 key types of application security testing
Modern application development moves at unprecedented speed. Is your security testing keeping pace so that apps are secure when they reach production? Continue Reading
-
Tip
24 Sep 2025
7 API discovery best practices for complete visibility
Secure your API landscape with these API discovery best practices spanning the entire SDLC. Find hidden endpoints, audit integrations and monitor continuously. Continue Reading
-
Tip
22 Sep 2025
8 best practices for securing RESTful APIs
The REST architectural style helps applications communicate with each other. Be sure RESTful APIs have the protections necessary to keep attackers at bay. Continue Reading
-
Tip
11 Sep 2025
Positive vs. negative security: Choosing an AppSec model
Understand the benefits and challenges of positive and negative security models to determine how to best protect web apps in your organization. Continue Reading
-
Tip
20 Aug 2025
Use an AI gateway to secure AI models and applications
AI gateways provide critical security controls for enterprise AI applications, preventing data loss while managing access. Continue Reading
-
Tip
25 Jul 2025
How to discover and manage shadow APIs
Connecting applications, especially if external-facing, with unapproved APIs is a recipe for disaster. Detecting and managing shadow APIs is vital to keeping the company secure. Continue Reading
-
Tip
15 Jul 2025
What is cybersecurity mesh? Key applications and benefits
Is it time to consider a different approach to security architecture? Cybersecurity mesh might be an effective way to address complex, distributed environments. Continue Reading
-
Tip
17 Jun 2025
How to create an SBOM: Example and free template
SBOMs provide an inventory of every component in an organization's software supply chain. Use this free downloadable SBOM template to create one for your organization. Continue Reading
-
Tip
07 May 2025
10 leading open source application security testing tools
Security testing enables companies to discover and remediate vulnerabilities and weaknesses in apps before malicious actors find them. Continue Reading
-
Opinion
26 Mar 2025
Making a case for the cybersecurity data fabric
When it comes to data, context is everything. Learn how a cybersecurity data fabric can supercharge a security team's ability to see the big picture. Continue Reading
-
News
20 Mar 2025
Cloudflare unveils tools for safeguarding AI deployment
The cybersecurity vendor's new suite helps businesses, developers and content creators deploy AI technology at scale safely and securely. Continue Reading
-
Definition
17 Mar 2025
What is a buffer overflow? How do these types of attacks work?
A buffer overflow occurs when a program or process attempts to write more data to a fixed-length block of memory, or buffer, than the buffer is allocated to hold. Continue Reading
-
Tip
13 Mar 2025
How to build an application security program
A well-defined application security program that includes multilayer software testing, SBOMs, and documentation and standards is vital to protect apps from threat actors. Continue Reading
-
Tip
26 Feb 2025
How to improve third-party API integration security
External API integrations are critical, but so is managing third-party API risks to maintain customer trust, remain compliant and ensure long-term operational resilience. Continue Reading
-
Tip
25 Feb 2025
WAF vs. RASP for web app security: What's the difference?
Web application firewalls use a negative security model, while runtime application self-protection tools use a positive security model. Which is better at keeping apps secure? Continue Reading
-
Definition
21 Feb 2025
What is application allowlisting?
Application allowlisting, previously known as 'application whitelisting,' is the practice of specifying an index of approved software applications or executable files that are permitted to be present and active on a computer system. Continue Reading
-
Tip
11 Feb 2025
How to build an API security strategy
Lax API protections make it easier for threat actors to steal data, inject malware and perform account takeovers. An API security strategy helps combat this. Continue Reading
-
Tip
04 Feb 2025
Cloud PAM benefits, challenges and adoption best practices
Cloud PAM helps organizations manage access to privileged accounts to keep cloud data and applications secured. Is it right for your organization? Continue Reading
-
Definition
04 Feb 2025
What is Internet Key Exchange (IKE)?
Internet Key Exchange (IKE) is a standard protocol used to set up a secure and authenticated communication channel between two parties via a virtual private network (VPN). Continue Reading
-
News
04 Feb 2025
WatchTowr warns abandoned S3 buckets pose supply chain risk
WatchTowr researchers found that they could reregister abandoned Amazon S3 buckets and detail alarming ways that threat actors could exploit the attack surface. Continue Reading
-
Definition
31 Jan 2025
What is DOS (Disk Operating System)?
A DOS, or disk operating system, is an operating system (OS) that runs from a disk drive. The term can also refer to a particular family of disk operating systems, most commonly MS-DOS (Microsoft DOS). Continue Reading
-
Opinion
03 Jan 2025
2025 cloud-native cybersecurity predictions
Join Informa TechTarget's Enterprise Strategy Group analyst Melinda Marks as she looks at what 2025 has in store for cloud-native security. Continue Reading
-
Definition
27 Nov 2024
What is obfuscation and how does it work?
Obfuscation means to make something difficult to understand. Programming code is often obfuscated to protect intellectual property or trade secrets, and to prevent an attacker from reverse engineering a proprietary software program. Continue Reading
-
Tip
04 Nov 2024
10 API security testing tools to mitigate risk
Securing APIs properly requires testing throughout their design lifecycle. Explore 10 leading API security testing tools for automated, continuous security testing. Continue Reading
-
Tip
01 Nov 2024
API security testing checklist: 7 key steps
APIs are a common attack vector for malicious actors. Use our API security testing checklist and best practices to protect your organization and its data. Continue Reading
-
Opinion
29 Oct 2024
Study shows securing SaaS applications growing in importance
Securing all types of SaaS applications ranks high among security pros, but the broad mandate can mean the need for better SaaS security platforms and tools. Continue Reading
-
News
24 Oct 2024
AWS CDK security issue could lead to account takeovers
Aqua Security researchers discovered AWS Cloud Development Kit is susceptible to an attack vector the vendor refers to as 'shadows resources,' which can put accounts at risk. Continue Reading
-
News
21 Oct 2024
Study outlines 'severe' security issues in cloud providers
Possible security issues involving cloud systems should be taken seriously, as the paper noted the five vendors outlined are responsible for more than 22 million users. Continue Reading
-
Feature
02 Oct 2024
API security maturity model to assess API security posture
As API use proliferates, attackers are targeting them to exploit networks and data. This six-domain API security maturity model can assess weaknesses and vulnerabilities. Continue Reading
-
Definition
02 Oct 2024
What is Android System WebView and should you uninstall it?
Android System WebView is a system component for the Android operating system (OS) that enables Android apps to display web content directly inside an application. Continue Reading
-
Opinion
01 Oct 2024
Research reveals strategies to improve cloud-native security
As organizations focus on the cloud to deliver and scale applications, security teams struggle to keep up. Recent research points to how teams can effectively manage cloud security risk. Continue Reading
-
Tip
06 Sep 2024
Top API risks and how to mitigate them
While APIs play an essential role in most modern business strategies, they can also introduce serious security threats. Learn some of the top API risks and how to mitigate them. Continue Reading
-
News
07 Aug 2024
Nvidia AI security architect discusses top threats to LLMs
Richard Harang, Nvidia's principal AI and ML security architect, said two of the biggest pain points for LLMs right now are insecure plugins and indirect prompt injections. Continue Reading
-
Opinion
06 Aug 2024
Highlights from CloudNativeSecurityCon 2024
This year's Cloud Native Computing Foundation CloudNativeSecurityCon highlighted cloud-native security issues to its many attendees who don't hold security-focused roles. Continue Reading
-
Tip
06 Aug 2024
How to protect against cloud DDoS attacks
Cloud DDoS protection enables companies to detect and mitigate DDoS attacks before they cause significant downtime, infrastructure issues and potential business losses. Continue Reading
-
Tip
08 Jul 2024
How API attacks work, plus 5 common types
A growing number of API attacks put enterprises at risk of serious data breaches. Learn how these attacks work, and explore some API security best practices. Continue Reading
-
Opinion
21 Jun 2024
AWS makes strong case for its security advantages at re:Inforce
At re:Inforce 2024, AWS shared details of its secure-by-design measures to protect customer data. Continue Reading
-
Tip
11 Jun 2024
SASE vs. SSE: Explaining the differences
Most security professionals are familiar with secure access service edge, but now, there's a new tool for administrators to consider: security service edge. Continue Reading
-
Tip
10 Jun 2024
8 SaaS security best practices for 2024
SaaS has become ubiquitous. To secure it, take steps to inventory SaaS usage, securely authenticate usage, encrypt data, adopt single sign-on and more. Continue Reading
-
Tip
07 Jun 2024
How to conduct an API risk assessment and improve security
APIs are essential, but hackers find them attractive targets. A comprehensive API risk assessment strategy helps you identify potential vulnerabilities. Continue Reading
-
News
03 Jun 2024
Snowflake: No evidence of platform breach
Snowflake on Saturday issued a joint statement with third-party investigators Mandiant and CrowdStrike denying reports that its platform had been breached. Continue Reading
-
Opinion
16 May 2024
3 reasons Synopsys is selling its app security business
Synopsys is selling its application security business to a private equity firm. Analyst David Vance explains why, as well as what it means for the industry. Continue Reading
-
News
16 May 2024
IBM sells QRadar SaaS assets to Palo Alto Networks
The deal with Palo Alto Networks comes one year after IBM announced QRadar Suite, an AI-enhanced security platform that combined existing SIEM and XDR products. Continue Reading
-
News
15 May 2024
AI-driven attacks seen as chief cloud security threat
Tried and true cloud security threats are on the rise. But according to a new report from Palo Alto Networks, the specter of generative AI threats has organizations concerned. Continue Reading
-
Definition
14 May 2024
cloud-native application protection platform (CNAPP)
Cloud-native application protection platform, or CNAPP, is a software product that bundles multiple cloud security tools into one package, thereby delivering a holistic approach for securing an organization's cloud infrastructure, its cloud-native applications and its cloud workloads. Continue Reading
-
Tip
08 May 2024
VM security in cloud computing explained
Cloud computing allows an organization to reduce its risks by having to secure fewer resources. The tradeoff is that cloud creates more attack vectors. Don't let VMs trip you up. Continue Reading
-
Tip
07 May 2024
What is a cloud security engineer, and how do I become one?
A cloud security engineer has specific responsibilities for helping to secure cloud infrastructure, applications and IT assets. Continue Reading
-
News
18 Apr 2024
CrowdStrike extends cloud security to Mission Cloud customers
CrowdStrike Falcon Cloud Security and Falcon Complete Cloud Detection and Response (CDR) will be made available through the Mission Cloud One AWS MSP platform. Continue Reading
-
Tip
15 Apr 2024
4 types of cloud security tools organizations need in 2024
From CIEM to SSE, these four types of cloud security tools help boost security efforts as organizations continue to expand their cloud environments. Continue Reading
-
Tip
15 Apr 2024
Key software patch testing best practices
Every company has to update and patch its software, but without careful testing, serious problems can occur. Here's how to make sure you're following the right steps. Continue Reading
-
Tip
25 Mar 2024
Cloud account hijacking: How it works and how to prevent it
The ability to identify the various methods of cloud account hijacking is key to prevention. Explore three ways to limit potential consequences of cloud credential compromise. Continue Reading
-
Tip
11 Mar 2024
5 PaaS security best practices to safeguard the app layer
Underlying APIs, language choice and cybersecurity features can vary widely across PaaS providers. These five security best practices can help in almost any PaaS scenario. Continue Reading
-
News
23 Feb 2024
GitHub Copilot replicating vulnerabilities, insecure code
Research from Snyk shows that AI assistants such as GitHub Copilot, which offer code completion suggestions, often amplify existing bugs and security issues in a user's codebase. Continue Reading
-
Tip
12 Feb 2024
Top metaverse cybersecurity challenges: How to address them
As the metaverse takes shape, companies must consider a slew of new cybersecurity challenges and how to deal with them. Continue Reading
-
Opinion
12 Dec 2023
Application security consolidation remains nuanced
As web application and API protection converge into cloud-based WAAP, Enterprise Strategy Group research shows enterprise interest, but security concerns remain. Continue Reading
-
Tip
07 Dec 2023
Assess security posture with the Cloud Security Maturity Model
The Cloud Security Maturity Model enables organizations to assess their cloud security posture and optimize it as they continue their cloud journey. Continue Reading
-
Definition
30 Oct 2023
supercookie
A supercookie is a type of tracking cookie inserted into an HTTP header to collect data about a user's internet browsing history and habits. Continue Reading
-
Opinion
27 Oct 2023
Cloud-native app security? Ignore acronyms, solve problems
When building a cloud-native application security strategy, avoid new acronym and product category confusion. Look for products that effectively address top challenges instead. Continue Reading
-
Tip
26 Oct 2023
Top 7 cloud misconfigurations and best practices to avoid them
Cloud security means keeping a close eye on the configuration of cloud resources and assets. These best practices can keep you safe from attackers and other malicious activities. Continue Reading
-
Definition
17 Oct 2023
Secure Sockets Layer certificate (SSL certificate)
A Secure Sockets Layer certificate (SSL certificate) is a small data file installed on a web server that allows for a secure, encrypted connection between the server and a web browser. Continue Reading
-
News
09 Aug 2023
Wiz warns of exposed multi-tenant apps in Azure AD
During a Black Hat USA 2023 session, a Wiz researcher explained how a common misconfiguration in Azure Active Directory led to the exposure of nearly 1,300 applications. Continue Reading
-
Definition
08 Aug 2023
Google Play Protect
Google Play Protect is a malware protection and detection service built into Android devices that use Google Mobile Services. Continue Reading
-
Tip
20 Jul 2023
API keys: Weaknesses and security best practices
API keys are not a replacement for API security. They only offer a first step in authentication -- and they require additional security measures to keep them protected. Continue Reading
-
Opinion
19 Jul 2023
Using defense in depth to secure cloud-stored data
To better secure cloud-resident data, organizations are deploying cloud-native tools from CSPs and third-party tools from MSPs to achieve a defense-in-depth strategy. Continue Reading
-
Opinion
29 Jun 2023
AI helps humans speed app modernization, improve security
Enterprises are looking at AI-driven approaches to help human teams modernize and accelerate application development to refactor or build new apps and beef up cybersecurity. Continue Reading
-
Tip
26 Jun 2023
How API gateways improve API security
API gateways keep APIs secure by providing rate limiting, DDoS protection and more. Learn more about these benefits, along with API gateway security best practices. Continue Reading
-
Tip
20 Jun 2023
Implement zero trust to improve API security
Not all organizations have an API security strategy in place. Using zero trust in API security is one way to protect APIs and reduce their changes of being attacked. Continue Reading
-
Opinion
19 Jun 2023
App development trends and their security implications
Enterprise Strategy Group analysts look at how organizations are modernizing software development processes and how security teams can support the growth and scale. Continue Reading
-
Opinion
19 Jun 2023
New AWS security tools, updates help IT protect cloud apps
AWS released a slew of updates to improve security as IT pros develop and deploy more enterprise applications via public cloud services. Continue Reading
-
Feature
05 Jun 2023
Attack surface reduction rules for Microsoft productivity apps
Attack surface reduction rules in Microsoft Defender for Endpoint help prevent apps from launching executable files and scripts, running suspicious scripts and more. Continue Reading
-
Opinion
09 May 2023
Addressing the confusion around shift-left cloud security
To clarify how shift-left security should work in terms of cloud-based application development, Enterprise Strategy Group analyst Melinda Marks dives deep into the process. Continue Reading
-
Definition
09 May 2023
application blacklisting (application blocklisting)
Application blacklisting --increasingly called application blocklisting -- is a network or computer administration practice used to prevent the execution of undesirable software programs. Continue Reading
-
Definition
19 Apr 2023
cloud workload protection
Cloud workload protection is the safeguarding of workloads spread out across multiple cloud environments. Businesses that use public and private clouds can use cloud workload protection platforms to help defend themselves against cyber attacks. Continue Reading
-
Definition
11 Apr 2023
AWS CloudTrail
AWS CloudTrail is an application program interface (API) call-recording and log-monitoring service offered by Amazon Web Services (AWS). Continue Reading
-
Tip
28 Mar 2023
How to mitigate low-code/no-code security challenges
Don't adopt low-code/no-code application development approaches without considering these best practices to mitigate and prevent their inherent security risks. Continue Reading
-
Tip
21 Mar 2023
4 ChatGPT cybersecurity benefits for the enterprise
As OpenAI technology matures, ChatGPT could help close cybersecurity's talent gap and alleviate its rampant burnout problem. Learn about these and other potential benefits. Continue Reading
-
Tip
20 Mar 2023
4 cloud API security best practices
APIs make up the majority of web traffic now, but they aren't always kept as secure as needed. Consider implementing these four cloud API security best practices. Continue Reading
-
Opinion
14 Feb 2023
Top takeaways from first CloudNativeSecurityCon
TechTarget's Enterprise Strategy Group offers the main takeaways from the first vendor-neutral, practitioner-driven conference for security. Continue Reading
-
Definition
08 Feb 2023
Windows Defender Exploit Guard
Microsoft Windows Defender Exploit Guard is antimalware software that provides intrusion protection for Windows 10 OS users. Continue Reading
-
News
17 Jan 2023
Microsoft fixes SSRF vulnerabilities found in Azure services
Orca Security, which discovered the Azure flaws, warned enterprises to be aware of SSRF attacks, which can result in a threat actor accessing or modifying sensitive data. Continue Reading
-
Feature
29 Nov 2022
How to prevent SQL injection with prepared statements
One of the top defenses against SQL injection is prepared statements. In this book excerpt, learn what prepared statements are and how to extend their defense. Continue Reading
-
Opinion
09 Nov 2022
Multichannel communications need more than email security
To remain protected against social engineering attacks in all communication channels, enterprises need new security strategies that extend beyond email to new collaboration tools. Continue Reading
-
News
05 Oct 2022
APTs compromised defense contractor with Impacket tools
A CISA alert warned that APT actors compromised a defense contractor's Microsoft Exchange server and used Impacket, an open source Python toolkit, to move laterally in the network. Continue Reading
-
News
04 Aug 2022
Amazon CSO Steve Schmidt talks prescriptive security for AWS
In part two of this Q&A, Amazon CSO Steve Schmidt discusses why AWS has taken a more prescriptive approach to customer security and how it influences areas like incident response. Continue Reading
-
Tip
24 Jun 2022
Top 4 best practices to secure the SDLC
NIST's Secure Software Development Framework is a set of practices for mitigating software vulnerabilities. Learn about the top SDLC best practices included in this framework. Continue Reading
-
News
09 Jun 2022
CrowdStrike demonstrates dangers of container escape attacks
CrowdStrike gave a live demonstration at RSA Conference 2022 of how an attacker can use a recently discovered Kubernetes flaw to obtain full control over a container's host system. Continue Reading
-
Tip
12 May 2022
3 ways to apply security by design in the cloud
Applying security-by-design principles to the cloud may not seem straightforward, but there are several ways to do so. These three areas are a good place to start. Continue Reading
-
Tip
09 May 2022
The top secure software development frameworks
Keeping security top of mind when developing software is paramount. Learn how to incorporate security into the SDLC with the top secure software development frameworks. Continue Reading
-
News
20 Apr 2022
AWS Log4Shell hot patch vulnerable to privilege escalation
Amazon's initial Log4Shell fix had 'severe security issues,' a Palo Alto Networks security researcher said. Amazon released new patches to fix those issues Tuesday. Continue Reading
-
Tip
07 Apr 2022
Should companies ask for a SaaS software bill of materials?
Though it isn't commonplace to ask for a SaaS software bill of materials, one can be beneficial for both SaaS providers and their customers. Learn why. Continue Reading