Software supply chain security has matured fast. Most enterprises can now answer what is inside their software, where it came from, and how it was built far better than they could five years ago. SBOMs, code signing, and build provenance made that possible, and Executive Order 14028 pushed agencies, contractors, and enterprises to invest in […]
When Code Installs Itself, Trust Decisions Have to Move Upstream CodeHunter CEO Ken Ammon has a new piece in the Forbes Technology Council, “Supply Chain Attacks Are Forcing Threat Detection To Focus On What Code Can Do.” His argument: the way most enterprises decide whether software should run was built for a slower world, and […]
The Claim Governance frameworks that scan for malicious behavior only at install time create systemic risk when registries are used as free hosting for artifacts that never touch a build pipeline. Zero Trust for Code addresses this by requiring a pre-execution trust decision on what an artifact does when it runs, regardless of whether it […]
CodeHunter has named Stephen McCarney as Chief Strategy Officer, adding a go-to-market leader with a track record of scaling category-defining security companies to help expand Zero Trust for Code across enterprise and government markets. McCarney will lead corporate strategy, market expansion, strategic partnerships, and go-to-market execution as CodeHunter builds out its footprint across software supply […]
The Claim Governance frameworks that treat marketplace listing or basic scanning as sufficient validation create systemic risk when agentic systems execute functionality without independent behavioral verification. Zero Trust for Code addresses this by enforcing behavioral controls at execution, ensuring that what an AI skill or agent-based artifacts does is verified rather than assumed from where […]
The Claim Governance frameworks that treat software supply chains as trusted by default create systemic risk when trust can be transferred, inherited, or re-established without independent validation. Zero Trust for Code addresses this by enforcing behavioral controls at execution, ensuring that trust is continuously verified rather than carried forward from prior assumptions. The Incident North […]
The Claim When credential theft, lateral movement, persistence, and ransomware deployment are governed as isolated risks, organizations lose sight into how those activities play into business-impacting outcomes. Zero Trust for Code addresses this by enforcing behavioral policy across execution sequences, ensuring that software actions remain constrained regardless of where they occur within the attack chain. […]
Zero Trust has reshaped how organizations think about access. No user is trusted by default and no device gets a free pass. Every request is verified before access is granted. It is a sound principle, and it stops short of software artifacts. What Zero Trust currently misses Zero Trust governs identity, network, and device posture. […]
The Claim Governance models that treat official marketplaces as trusted control boundaries assume that validation at admission ensures safety over time. When software is permitted to execute based on initial approval rather than continuous verification, trust becomes static while behavior evolves. Zero Trust for Code addresses this by enforcing control at execution, ensuring that approved […]
The Claim Security governance frameworks often focus on preventing initial compromise but lack enforceable controls over what occurs after access is established. This creates a structural gap where persistence, lateral movement, and preparation for ransomware deployment operate without constraint. Zero Trust for Code addresses this by enforcing behavioral limits on execution, ensuring that access cannot […]
The Claim Governance frameworks that rely on external trust signals create a control gap when those signals can be intentionally manipulated. When trust is inferred from consensus rather than verified through enforceable policy, organizations lose control over what software is permitted to execute. Zero Trust for Code addresses this by shifting from perception-based trust to […]
Signatures Don’t Stop What They’ve Never Seen When every payload is unique, what does your audit trail actually prove? AI-assisted tooling now generates malware variants on demand. Different code, different hash, same objective. Payloads are built for a single target and never reappear. There is no hash to check, no prior observation to match against, […]
