Introducing Apiiro Guardian Agent: Preventing Vulnerable and Non-Compliant Code from Ever Being Created

Moti Gindi
January 28 2026

The Era of Prevention Apiiro started by building our foundational pillars for delivering secure, compliant code – Deep Code Analysis (DCA) and the Software and Risk Graphs™. These enabled us to move security processes from reactive to proactive. From intermittent to continuous. With this Apiiro Data Fabric in place, we went AI-native; embedding AI in […]

When Static Rules Met a Dynamic Attack Surface: Why AI Coding Assistants Must Think Like the AI Era – Not Like 80s Firewalls

Idan Plotnik
December 29 2025

In the early days of network security, perimeter defense was simple: Inspect packets. Match them against a list of known bad patterns. Block anything that looked suspicious. That was the era of static firewall rules – a world where threats were relatively predictable, environments were mostly stable, and thick rulebooks somehow worked. Then came the […]

60-Second Read: AI-Assisted Coding, Vibe Coding, and Agentic Coding Explained

Timothy Jung
December 19 2025

Why Read This? Ask ten people what AI-assisted coding, vibe coding, or agentic coding mean – and you’ll likely get ten different answers. These terms are often mixed together, even though they describe very different ways of building software, aimed at very different audiences. The goal of this short read is to remove the confusion. […]

Introducing Apiiro AI-SAST: Static Scanning Reimagined – From Code to Runtime

Matan Giladi, Neta Coral
December 18 2025

Static Application Security Testing (SAST) is a legacy technology, invented decades ago and largely unchanged since. With the rapid adoption of AI coding assistants and agentic coding tools, development velocity and the application attack surface have increased exponentially, pushing traditional SAST beyond its breaking point. What was once an application security engineer and developer problem […]

Apiiro AI-SAST: Static Scanning Reimagined – From Code to Runtime – for the AI Era

Moti Gindi, Neta Coral
December 18 2025

Application security and development teams have relied on SAST scanners that excel at recognizing patterns based on static rules, but struggle to deeply understand the software architecture graph from code to runtime.  Now, the supercharged speed of development – powered by AI-assisted coding – has made the SAST results unsustainable. Traditional scanners lack the ability to give application […]

Apiiro Achieves True Runtime API Endpoint Matching

Karen Cohen, Ella Bor
December 10 2025

AppSec teams face an explosion of API-related risks that are difficult to track, prioritize, and remediate. Many ASPM providers claim they offer true code-to-runtime endpoint matching, but in a best-case scenario, they can only match the runtime host or project to its code application or repository – not to the specific line of code. This […]

A Triple Recognition: After Gartner and IDC, Apiiro Named the Most Innovative ASPM Provider Worldwide in Frost & Sullivan’s 2025 Frost Radar™

Timothy Jung
December 9 2025

Frost & Sullivan has named Apiiro the most innovative Application Security Posture Management (ASPM) provider worldwide, recognizing Apiiro’s unique ability to prioritize the needs of an enterprise customer base while also pushing the envelope on AppSec innovation. This distinction reinforces Apiiro’s position as the most innovative ASPM company — not just for building groundbreaking technology, […]

Critical Vulnerability – RCE in React Server Components & Next.js

Nadav Shakarzy
December 4 2025

On December 3, 2025, coordinated disclosures revealed critical remote code execution (RCE) vulnerabilities in React Server Components (RSC) and Next.js: At the core, the issue is unsafe deserialization in the RSC “Flight” protocol. With a single crafted HTTP request to an exposed RSC / Server Function endpoint, an attacker can reach pre-auth arbitrary code execution […]

Shai-Hulud 2: A New Wave of npm Supply Chain Malware Targeting Developers and CI/CD Systems

Nadav Shakarzy
November 25 2025

A new and significantly more aggressive wave of Shai-Hulud malware is rapidly propagating across the npm ecosystem. Known as Shai-Hulud 2, this campaign is infecting hundreds of open-source packages with a trojanized preinstall script that executes an obfuscated Bun-based payload. Once activated, the malware steals sensitive credentials—including API tokens, SSH keys, cloud access keys, and […]