top of page


A personal blog addressing software quality across all aspects of software development, testing, design, and people.
Search


Managing Open Source and Dependency Risk
Modern software development rarely starts from a blank page. Instead, applications are assembled from a vast ecosystem of frameworks, libraries, and open-source components that accelerate development and enable teams to build complex systems quickly. In many cases, the majority of an application’s functionality comes not from code written internally, but from external dependencies - and lately, AI. This shift has dramatically improved developer productivity, but it has also i
Craig Risi
May 224 min read


DevSecOps: Embedding Security into the Delivery Pipeline
Modern software delivery has transformed how quickly organizations can build and release software. Continuous integration and continuous delivery pipelines enable teams to deploy updates frequently, respond rapidly to customer needs, and iterate faster than ever before. However, this speed can expose a major weakness in traditional security models. Historically, security checks were performed as a final gate before release. Security specialists would review code, run vulnerab
Craig Risi
May 84 min read


Continuous Compliance: Turning Audits Into Automation
When it comes to application security , compliance can often feel like a roadblock: a slow, manual process that lags behind the pace of...
Craig Risi
Aug 8, 20253 min read


Secure Software Development: Building Security Into the Code from Day One
We can secure our access and secure our data ; however, with software the engine driving innovation, it is also a prime target for cyber...
Craig Risi
Jul 11, 20253 min read


Data-Centric Security: Protecting What Matters Most
In my previous post, we looked at the importance of focusing on access control and perimeter security. However, protecting the perimeter...
Craig Risi
Jun 27, 20253 min read


Identity-Centric Security
In my previous post, I started to look at modernizing security, starting with software architecture. However, when looking at secure...
Craig Risi
Jun 21, 20254 min read


Modernizing Enterprise Security through Architectural Design
In the modern digital era, security can no longer be viewed as an afterthought or a final step in the software development lifecycle. In...
Craig Risi
Jun 6, 20254 min read


Modernizing Security
Over the past few months, I’ve shared a range of thoughts on modernization, primarily focused on the functional design of software....
Craig Risi
May 17, 20256 min read


Designing Secure Applications
Modern applications are exposed to constant security threats. Malicious actors will try to uncover and exploit any vulnerabilities to...
Craig Risi
Apr 7, 20226 min read
bottom of page