Blog

The one item on your SOC 2 checklist that no integration can close has meant four to eight weeks and five figures. As of today you can handle it end-to-end in a few hours.

A lot of what’s sold as AI penetration testing is automated vulnerability scanning with a new label. What separates a genuine AI pen test from a scanner, and the common myths worth a closer look.

Free SAST, SCA, secrets, artifact, and GitHub configuration scanning for public repositories. We're partnering with SecretSpec because finding a leaked key is not the same as keeping it out of git.

Not all pen testing tools work the same way. Nine options compared across proof of exploit, remediation, pricing, and compliance output for software teams.

Your attack surface is every asset an attacker can reach: exposed subdomains, forgotten staging servers, cloud misconfigurations, vulnerable dependencies, leaked secrets, and the application code shipping to production every day. As teams adopt more cloud, more SaaS, and more AI infrastructure, that surface grows faster than most security teams can track it.

Cursor shipped Origin, its own git hosting. Fencer now scans Origin pull requests with SAST, AI review, AI triage, and autofix PRs. Available to all customers today.

Your AI coding agent has a permission system, but has anyone tested whether it stops anything? We built an open-source scanner that plants secrets and honeypots, then watched what leaks. Under default configs, Claude Code, Codex, and opencode all leaked credentials.

Pyrl found this Python bug class by scanning 671K packages with CodeQL. We rebuilt the check as an Opengrep rule you can paste into the scanner you already run, trading some accuracy for zero adoption cost.

We ran Claude Code's /security-review over 50 real pull requests to see what it catches. It is a useful first pass, and it does not replace a security program. Here is where it helps and where it falls short.

Detection is the easy part of SAST. We run three layers, classical scanners, AI triage, and investigative agents, so a finding arrives confirmed and ranked instead of as one more alert in a queue.

License detection usually means shelling out to a Go binary. We built an SPDX license classifier in pure Python that keeps pace on speed and accuracy, and made the dependency and packaging story much simpler.

Every SAST vendor claims AI, and few explain what it does to your findings. We compared 10 tools, ourselves included, on what happens after detection: triage, investigation, and the review workflow that turns a finding into audit-ready evidence.

One detection engine, hundreds of customer environments, three clouds that share zero native primitives. Here's how AWS, GCP, and Azure security-log ingestion actually compare, what's shared, and where each one bites.

Static analysis buries real vulnerabilities under false positives. We benchmarked 15 LLMs on 142 findings our engineers had already reviewed to see which could triage the noise, and where the top scorer quietly went wrong.

You wire up Diagnostic Settings to pipe a customer's Entra ID logs across subscriptions, and the destination just stays empty: no errors, no retries. Here's why cross-subscription delivery fails silently, and the customer-storage, read-across architecture we shipped instead.

SOC 2 gets you in the door with enterprise buyers, but the questions procurement asks next go deeper than the badge. Here's why one startup CTO pushed for SOC 2 before any customer required it, and what the work underneath the report has to cover now.

A clean SOC 2 report gets you into the enterprise sales cycle, but it rarely answers the security questionnaire that follows. Here's what buyers ask for beyond the badge, and how to find your gaps before procurement does.

A clean SOC 2 gets you into enterprise deals, then the security questionnaire stalls them. The Procurement Readiness Check is a free tool that reads your SOC 2 report the way your buyers will and shows you the gaps before procurement does.

Secrets management is easy to get right at the start and genuinely hard to fix once you have a live system. A startup CTO on what a retrofit actually requires: the configuration tangles, the production risk, and why the cost compounds with every quarter you wait.

Three early security gaps show up at nearly every startup: secrets in the wrong place, no infrastructure observability, and no code scanning. Each is straightforward to fix at five engineers and a real retrofit project at fifty.

Most startups manage security reactively: findings accumulate, nothing gets triaged, and the CTO runs a sprint before every audit. A 45-minute monthly security review meeting breaks that cycle, and you don't need a security team to run one.

The MDM fear most startup CTOs carry is based on the enterprise version. Here's what endpoint protection actually costs you when you skip it, and why 2026 MDM looks nothing like what you remember.

Two engineering personalities shape security outcomes on lean teams: the perfectionist who spirals and the cynic who disengages. Tim Olshansky on how to work with both.

A quarter to half of the security tools startups need require a vendor conversation before you can buy. Here's what the buying process actually looks like, and how to plan for it.

Every startup security stack I've seen has some amount of duct tape in it. A code scanner here, a CSPM there, a GRC tool that needs feeding by hand, and countless spreadsheets.

A CTO's framework for budgeting security as part of engineering capacity instead of running it as a parallel program from product work.

A new field guide for startup CTOs running security, from Fencer co-founder Tim Olshansky. Drawn from his experience at Zenput before co-founding Fencer.

When a CVE hits a dependency, the CVSS score alone won't tell you what to do. Here's a practical framework for deciding when to patch immediately, when to schedule it, and when it's reasonable to accept the risk.

Security culture is the set of shared habits and ambient awareness that shapes how a company handles security day to day. Here's how to build it.

SOC 2 gets you in the room with enterprise buyers. It doesn't close the deal. Here's how to build the documentation and processes that turn a 40-hour fire drill into a one-day retrieval task.

A plain-spoken guide to the difference between SOC 1, SOC 2, SOC 3, and Type I vs Type II, and which one a startup actually needs to send a prospect.

At 50 employees, the security controls that worked at 10 start to break down. Here's what to add, what to formalize, and how to keep security from becoming a second job.

A SOC 2 report tells a prospect your controls exist. It doesn't tell them your security program works. Here's what separates the letter from the posture.

When your startup is at 10 people, you don't need a comprehensive security program. You need a short list of high-leverage controls and the right habits to match. Here's what to do now, what to skip, and when to revisit.

When you're selling software to other businesses, your security gaps don't just affect you. They affect your customers. A breach at your company becomes a breach at theirs. Their data, their reputation, their trust in you.

Your SOC 2 badge proves you documented controls. It doesn't prove you're secure. Learn why compliance alone fails and what real security looks like alongside it.

Startups invest in security tooling for good reasons: to scan for vulnerabilities, to protect customer data, to meet the requirements that come with growth. The tools themselves aren't the problem. But the way they end up working together (or not) can quietly create hours of overhead that has little to do with improving your security posture.

You passed. The auditor signed off. The badge is on your website.

It's Monday morning. You open Slack to find 47 new alerts, all labeled "Critical." GitHub Dependabot has flagged twelve dependency vulnerabilities. AWS Inspector surfaced two thousand container vulnerabilities from your latest container build and Guard Duty is alerting you to eight different infrastructure findings. You pour your coffee and stare at the screen. The question that's become a permanent resident in your head: Which of these security vulnerabilities actually matter?This article walks through a practical approach to vulnerability prioritization for lean teams: how to cut through the noise, focus on what matters, and build a process that doesn't consume your week.

Vibe coded apps have serious security risks that most non-technical founders don't know about. AI coding tools generate functional code, but they don't validate input on the server, they don't enforce Row Level Security on your database, and they routinely hardcode API keys in client-side JavaScript.

MCP is one of the more exciting things to happen to developer tooling in a while. And like most things that get adopted quickly, the security thinking tends to lag behind the enthusiasm. Here are the five attack patterns worth understanding, with real CVEs, proof-of-concept examples, and mitigations for each.

The moment you have your first customer or your first piece of customer data, security matters. It doesn't require a dedicated security team or a big budget, but it does require intentional setup across six domains.