Application Security
Agile development’s cycle of deployments and patches generates ample opportunities for hackers looking for a way in. Application security must be strong, vigilant, and nimble. Read our insights.
Insights
Blog
Agentic Development Security Picks Up Where Traditional Security Tools Leave Off
Let’s address the elephant in the room: Coding agents don’t generate secure code. Securing the AI-generated code is left as a separate activity, and it’s only part of the job. Coding agents also select dependencies, invoke tools, and execute tasks. Application security teams must govern those activities, protect the development and delivery environment, and validate […]
Blog
Your Application Vendors Control The Meter, The Gate, And The Referee
Tech executives keep asking, “Should we slow down AI adoption?” It is the wrong question. Your application vendors have already answered a more consequential one: how much autonomy your agents will get, what that autonomy will cost, and who will control it.
Turn Our Security Predictions Into Action
The next wave of AI risk won’t wait for static controls. Attend Security & Risk Forum November 9–10 to strengthen trust, build resilience, govern AI risk, and put stronger guardrails in place.
Blog
PHP2Shell Had Teeth, But The Real Story Is The Eclectic Mayhem
The week of October 20 was unusually chaotic, even without the PHP news. Not only did teams need to scramble to identify and understand the impact of emergency PHP vulnerabilities, but there were also critical vulnerabilities in Node.js, cryptographically weak keys issues by a certificate authority, exploited vulns in network security equipment, and potentially accidental […]
Blog
Break Out Of The Vulnerability Matrix At Forrester’s Security & Risk Forum 2026
Security teams are hearing two competing stories. In one, AI completely rewrites the rules of vulnerability discovery, exploitation, and remediation. In the other, AI simply adds speed and scale to problems that security programs already understand. The reality lies somewhere in between. Discovery Is Accelerating Faster Than Decision-Making AI analyzes code, generates findings, and proposes […]
Blog
PHP2Shell Leak Sends Security Teams Scrambling
At 14:00 UTC on October 21, PHP released patches to two critical CVEs, both of which can lead to remote code execution. CVE-2026-109618 addresses an RCE through an out-of-memory error, and CVE-2026-109619 addresses an RCE through a stale global-state issue. The flaws were discovered by researchers at Wiz and Calif, the latter as part of […]
Blog
Your Software Supply Chain Risk Doesn’t Stop At Your Suppliers
Software supply chain security is no longer just about knowing which open-source libraries are in your applications. Attackers are compromising developer environments, build systems, trusted distribution channels, and even security tools such as container security and infrastructure-as-code scanning tools. AI now adds another layer of dependencies to evaluate and protect. The result is an interconnected […]
Blog
Embrace Responsible AI To Forge The Trusted Future
As AI systems become more autonomous, security alone isn’t enough to build trust. Learn how responsible AI helps organizations govern AI agents, manage emerging risks, and keep systems aligned with business goals and values.
Blog
Talk To Your Vendors About Quantum Security Readiness
Last month, CISA and the G7 Cyber Security Working Group put out a call to action for post-quantum readiness, listing five priorities to help with migration. It’s particularly welcome to see CISA and the working group highlight “integrating PQC into cybersecurity requirements and procurement processes” as one of the priorities. At the beginning of this […]
Blog
It’s An Agent’s World: Customer Insights From The Forrester Wave™: Bot And Agent Trust Management Software, Q2 2026
One of the best parts about authoring a Forrester Wave™ is getting to speak to customer references. Every vendor in the Wave evaluation connects me with customers who talk about how they use the product, what they like, and what they wish was better. While a lot of that goes into evaluating vendors during the […]
Blog
Intent Is The New Epicenter Of Agentic Security
Cybersecurity spent decades trying to stop things from happening, identifying them, and then investigating what happened. Agentic AI challenges us with a much more difficult question: What was the system trying to do? Agents don’t just execute instructions. They interpret objectives, select tools, access data, cross systems, and change tactics. In most cases, a user […]
Blog
Turn AEGIS Controls Into An Agentic AI Security Stack
Agentic AI creates control, technology, and purchasing problems. Security leaders need to know the controls that they must satisfy, the technologies that can satisfy them, where existing tools already provide coverage, and where a new investment actually fills a gap. Far too often, we see clients conducting that process in reverse order … trying to […]
Blog
The Capital Connection: Exploring Washington, DC During Security & Risk Forum 2026
Security & Risk Forum 2026 brings security, risk, and resilience leaders to Washington, DC, a city where technology, governance, security, and public trust intersect every day. From iconic landmarks and Smithsonian museums to neighborhood cafes and networking-worthy restaurants, explore what to see and do while you’re in the nation’s capital.
Blog
Introducing AEGIS — The Guardrails That CISOs Need For The Agentic Enterprise
AI agents aren’t coming — they’re already here, and they’re not waiting for your security architecture to catch up. Learn how Forrester’s new AEGIS framework can help CISOs secure, govern, and manage AI agents and agentic infrastructure.
Blog
How To Maximize Value — And Minimize Risks — Of AI Assistants In Commerce Software
As commerce vendors embed genAI assistants into their platforms, digital leaders must balance productivity gains against growing governance risks to ensure that AI-generated work remains visible, auditable, explainable, and aligned with organizational policies.
Blog
The Future Of AppSec May Be Autonomous, But The Present Is Surprisingly Practical
AI is no longer a future feature in application security; it is rapidly becoming a core part of how application security (AppSec) tools identify, prioritize, and remediate risk. Yet despite aggressive vendor investment, adoption remains constrained by trust concerns, questions about value, and uncertainty about pricing models. In our new report, The State Of Artificial […]
Blog
Microsoft’s Project Perception Announcement And How To Implement It Right
Today, Microsoft announced Project Perception: a series of red, blue, and green team agents designed to be coordinated together in an agentic architecture to evaluate infrastructure and close gaps as close to autonomously as possible. The red team agents find potential paths to compromise, the blue team agents prioritize and evaluate them, and the green […]
Blog
Secure The Future Of Internet Traffic As Agents Take Over
AI agent traffic is reshaping how users interact with digital experiences. In The Forrester Wave™: Bot And Agent Trust Management Software, Q2 2026, we explore how this shift is transforming a market that has historically focused on detecting and mitigating bot attacks into one that must also enable trusted automated traffic at scale. Here are […]
Blog
Move Over, WAF: The Web Application Protection Platform Takes Over
For years, the web application firewall (WAF) has been a foundational control for protecting customer‑facing digital experiences. It started as a compliance-driven application security tool that filtered malicious traffic, blocked common exploits, and provided a last line of defense in front of web applications. But the way applications are built, deployed, and attacked has fundamentally […]
Blog
OpenAI’s Daybreak Promises To Improve AppSec But Introduces A New Pricing Model: Five Buyer-Side Implications For CISOs
OpenAI recently announced Daybreak, its vision for making agentic application security faster and more capable. While promising, Daybreak will also make security more expensive per unit of work. In this model, customers will pay for tokens and multiagent workflows burn tokens. CISOs and CIOs should budget for application security (AppSec) line-item inflation, not deflation, with […]
Blog
Not A Vendor, Still A Breach: Vercel’s Third-Party Risk Failure
Some security incidents are complex. The Vercel incident is more troubling because it was predictable. The attackers did not exploit a procurement gap. They exploited a definition gap. Here’s what happened. A Vercel employee signed up for Context.ai’s AI Office Suite using a corporate Google account and clicked something effectively equivalent to “Allow All,” granting […]
More posts