top of page


A personal blog addressing software quality across all aspects of software development, testing, design, and people.
Search


DevSecOps: Embedding Security into the Delivery Pipeline
Modern software delivery has transformed how quickly organizations can build and release software. Continuous integration and continuous delivery pipelines enable teams to deploy updates frequently, respond rapidly to customer needs, and iterate faster than ever before. However, this speed can expose a major weakness in traditional security models. Historically, security checks were performed as a final gate before release. Security specialists would review code, run vulnerab
Craig Risi
May 84 min read


Secure Coding Starts with the Engineer
With the rapid rise of AI agents and the emergence of increasingly powerful models, some of which may introduce new security risks, it feels timely to revisit the topic of software security. More importantly, it raises the question of how we can write code, often with the assistance of AI, that remains robust and secure in the face of these evolving threats. Code is written, features are delivered, and only near the end of the development cycle does a security team step in to
Craig Risi
Apr 244 min read


Continuous Compliance: Turning Audits Into Automation
When it comes to application security , compliance can often feel like a roadblock: a slow, manual process that lags behind the pace of...
Craig Risi
Aug 8, 20253 min read


Secure Software Development: Building Security Into the Code from Day One
We can secure our access and secure our data ; however, with software the engine driving innovation, it is also a prime target for cyber...
Craig Risi
Jul 11, 20253 min read


Data-Centric Security: Protecting What Matters Most
In my previous post, we looked at the importance of focusing on access control and perimeter security. However, protecting the perimeter...
Craig Risi
Jun 27, 20253 min read


Identity-Centric Security
In my previous post, I started to look at modernizing security, starting with software architecture. However, when looking at secure...
Craig Risi
Jun 21, 20254 min read


Securing Data in your code
In my last post , I looked at some tips on how to write more secure code. However, it’s not just code alone that developers need to...
Craig Risi
Oct 4, 20246 min read
bottom of page