Governance frameworks that treat workspace-trust prompts and sandboxing as sufficient protection create systemic risk when an agent’s own routine background operations bypass both entirely. Zero Trust for Code addresses this by requiring a pre-execution trust decision on every command a repository can trigger, not only the ones a user’s approval prompt was designed to catch. […]
Governance frameworks that treat an extension’s installation history and prior clean behavior as ongoing proof of safety create systemic risk when that same history can be inherited by a new owner or preserved deliberately before a compromise. Zero Trust for Code addresses this by requiring a pre-execution trust decision on what an extension does at […]
Black Hat USA 2026 has a number attached to it this year that is hard to ignore: 35 of the 121 Briefings on the schedule, close to 29 percent, are directly about AI security, AI red teaming, or AI-assisted offensive research (Straiker, “AI Agents Take Center Stage at Black Hat USA 2026”). That is not […]
The Claim Governance frameworks that rely on manual code review to catch malicious packages create systemic risk when an artifact is deliberately built to survive that review. Zero Trust for Code addresses this by requiring a pre-execution trust decision on what a package does when invoked, rather than solely depending on a reviewer’s judgment of what […]
An EDR flags an unfamiliar binary on an endpoint. Nothing about it matches a known signature. It is not obviously malicious, and it is not obviously safe either. Somebody on your team now has to answer one question before anyone can move on: is this safe to run? That question sounds small. In most SOCs, […]
The Claim Governance frameworks that treat package adoption as a routine maintenance mechanism create systemic risk when that same mechanism can transfer control of a trusted package name to an attacker. Zero Trust for Code addresses this by requiring a pre-execution trust decision on what a package does after any change in control, rather than extending […]
The Claim Governance frameworks that treat install-script restrictions as sufficient protection create systemic risk when malicious code is embedded to execute at import rather than install. Zero Trust for Code addresses this by requiring a pre-execution trust decision on what a package does when it runs, regardless of which lifecycle stage triggers that behavior. The […]
The Claim Governance frameworks that treat a legitimate, signed application as inherently safe create systemic risk when that application can be paired with malicious components it will execute automatically. Zero Trust for Code addresses this by requiring a pre-execution trust decision on what an application actually loads and runs, rather than extending trust to everything […]
Software supply chain security has matured fast. Most enterprises can now answer what is inside their software, where it came from, and how it was built far better than they could five years ago. SBOMs, code signing, and build provenance made that possible, and Executive Order 14028 pushed agencies, contractors, and enterprises to invest in […]
When Code Installs Itself, Trust Decisions Have to Move Upstream CodeHunter CEO Ken Ammon has a new piece in the Forbes Technology Council, “Supply Chain Attacks Are Forcing Threat Detection To Focus On What Code Can Do.” His argument: the way most enterprises decide whether software should run was built for a slower world, and […]
The Claim Governance frameworks that scan for malicious behavior only at install time create systemic risk when registries are used as free hosting for artifacts that never touch a build pipeline. Zero Trust for Code addresses this by requiring a pre-execution trust decision on what an artifact does when it runs, regardless of whether it […]
CodeHunter has named Stephen McCarney as Chief Strategy Officer, adding a go-to-market leader with a track record of scaling category-defining security companies to help expand Zero Trust for Code across enterprise and government markets. McCarney will lead corporate strategy, market expansion, strategic partnerships, and go-to-market execution as CodeHunter builds out its footprint across software supply […]
