When I started software engineering, Waterfall was the typical process. A team would spend months building a large feature set, then deploy it. There were lots of reasons for it. Hardware acquisition looked nothing like it does today. Deployments took hours, not minutes. There were far fewer frameworks and almost no standardized automation. It was costly to do individual releases and thus batching was preferred. The batching had a time cost, though. User feedback was slower, patches took longer, and project management was more complex. ...

Caption: The modern software supply chain - a complex web of dependencies requiring constant vigilance On December 3, 2025, React—one of the world’s most trusted JavaScript frameworks—disclosed CVE-2025-55182, a vulnerability with a perfect CVSS 10.0 score. Within hours, threat groups were actively exploiting it. The attack vector? A flaw in React Server Components that allowed unauthenticated remote code execution with a single HTTP request. Security researchers discovered that 39% of cloud environments were vulnerable. ...

Barnes and Nobles and Borders were considered safe. Toys ‘R Us was untouchable. Large numbers of people believed that brick and mortar would remain. Others argued it wouldn’t. The end result, massive change. Many of those stores shuttered. Some still remain. Today, some argue that Artificial Intelligence isn’t intelligent. It is simply a token generation. It hallucinates. We’ll disregard the notion that LLMs are only one type of AI, for now. This semantic argument misses the point entirely and leaves us unprepared for what’s already happening. ...

Posted on July 28, 2025 Introduction Retail giants like Barnes and Noble, Borders, and Toys ‘R’ Us were once considered untouchable, yet massive disruption transformed their industries. Similarly, many dismiss artificial intelligence as merely token generation rather than genuine intelligence. However, this semantic debate distracts from practical reality: AI already writes code, diagnoses medical conditions, creates marketing campaigns, and processes legal documents. The Five Arguments Against AI Intelligence The Chinese Room Argument: AI processes symbols without true understanding, following rules mechanically without grasping actual meaning. ...

Software development teams invest millions in features that provide minimal user value while security vulnerabilities proliferate. According to the author, “at least 80% of development effort creates features that drive little user value,” drawing on Pareto’s Principle. Despite rapid CI/CD pipelines, organizations essentially run assembly lines producing unwanted inventory. The Lean Manufacturing Lie References to The Phoenix Project and The Unicorn Project by Gene Kim demonstrate how Lean Manufacturing principles were adapted to software. However, the author contends these applications misunderstand fundamental differences: ...

Posted on June 8, 2025 I’ve been exploring AI code generation while building a Domain Driven Design framework focused on security. Implementing a HashPassword value object revealed significant challenges with how AI handles sensitive data patterns. Why Value Objects Matter (The Good News First) Value objects strengthen secure software development in several ways: Strong Typing That Actually Types Instead of passing generic String parameters, value objects create distinct types. IDEs and compilers catch type mismatches before runtime, preventing developers from accidentally swapping usernames for password hashes. ...

Posted on January 17, 2025 Understanding Software Complexity Software is inherently complex—composed of many interconnected parts that weave together like “spaghetti code.” To manage this complexity, engineers have developed organizational strategies and higher-level programming languages that abstract machine code, making systems more readable and maintainable. However, this capability has enabled increasingly complex software, which in turn has driven reliance on additional organizational techniques and third-party libraries. The Evolution of Encryption Encryption technology has undergone significant transformation. Previously, encryption was computationally expensive and impacted user experience, so organizations limited its use to high-threat scenarios. This preference for disk-level encryption over data-level encryption meant internal network traffic was often considered trusted. ...

Time for a New Year’s Resolution: Your Software Security KPI—A Perfectly Secure Product In The One Thing by Gary Keller and Jay Papasan, the authors explore how long-term goals function as behavior-change mechanisms. They advocate for SMART goals with very low odds of achievement—almost impossible targets. What Would That Goal Look Like for Software Security? Goal: Any security vulnerability finding in any environment by any scan or vendor will be remediated in 60 days. ...

Security tools have become commoditized, with numerous vendors offering overlapping features. However, each tool maintains a competitive advantage through unique combinations of support, capabilities, and integrations that create significant switching costs. Language and Framework Support Most tools cover popular programming languages, but differences emerge in specialized framework support and architectures. For instance, when Single Page Applications became prevalent, some DAST tools struggled with crawling capabilities. Authentication mechanisms and other technical nuances also vary between vendors. ...

Overview The article argues that traditional Application Security Key Performance Indicators (KPIs) often undermine program success and product delivery. As noted, “You can’t manage what you can’t measure,” yet choosing the wrong metrics can sabotage security initiatives. The “Whack-a-Mole” Metrics These counterproductive indicators focus solely on vulnerability identification and remediation: Vulnerability Counts - Total vulnerabilities discovered, treating finding more issues as program success Remediation Rate - Speed of fixing vulnerabilities, emphasizing rapid clearing of findings Vulnerability Types Tested - Variety of detectable vulnerability classes, attempting to expand testing scope gradually Number of Products Onboarded - Quantity of applications monitored by the program The Problem: These metrics reinforce misconceptions that application security delays product development rather than enabling it. ...