Industry Insights

Industry Insights

Perspectives on running a product security program as AI changes how code is written and attacked.

Latest posts

AI Agent Security: Risks, Examples and Best Practices for Engineering Teams

Industry Insights

October 26, 2026

AI agent security protects agents and everything they can reach. Learn the 7 main risks, example attack paths and a checklist for building agents safely.

How to Set Up AI Code Review for Security on Pull Requests

Industry Insights

October 26, 2026

AI code review for security checks every pull request, but diff-only tools miss key flaws. Learn what it catches, what it misses and how to set it up.

AI Code Security: What It Is, How It Works and Where It Falls Short

Industry Insights

October 26, 2026

AI code security uses AI to find, validate and fix flaws in source code, and to secure code AI writes. Learn how it works, its limits and what to look for.

A figure in a hat stands in a teal tunnel of layered arches, facing steps that lead up to a bright light

Stop Building Internal Security Infrastructure

Industry Insights

Shantanu Kulkarni

October 7, 2026

Your security team's job is securing the product, not building AI agent frameworks. Here is how internal tooling drains security hours, and how to stop.

A figure in a hat stands at the entrance of a maze of stone walls and spires, facing a distant bright star at sunset

Build vs. Buy in the Age of AI Security

Industry Insights

Shantanu Kulkarni

October 7, 2026

Building your own AI security harness means starting from zero on token routing, context management and guardrails. Here is how to make the call.

A lone figure climbs a long stone staircase toward a glowing four-point star between crystalline cliffs

The True Cost of an AI Security Harness

Industry Insights

Shantanu Kulkarni

October 7, 2026

A DIY AI security harness looks like a weekend project. The real cost is maintaining agents, wrappers and evals after the demo. Here is where it goes.

A lone figure in a bowler hat stands before a glowing four-point star in a faceted indigo canyon, the Nullify illustration style

Why Developers Ignore Security Alerts (And How to Fix It)

Industry Insights

Shantanu Kulkarni

September 30, 2026

Why do developers ignore security alerts? Because they are pricing them. Six ways security teams can cut alert fatigue and get fixes merged, not muted.

A lone figure in a bowler hat stands at the edge of a vast teal labyrinth whose paths all converge on a glowing four-point star

How to Solve AppSec Tool Sprawl in 2026

Industry Insights

Shantanu Kulkarni

September 30, 2026

AppSec tool sprawl turns security engineers into the glue between SAST, SCA, secrets and DAST scanners. Here is the hidden cost, and how to remove it.

Triage Speed Is the Wrong Scoreboard

Triage Speed Is the Wrong Scoreboard

Industry Insights

Discovery is effectively infinite now. Cheap, capable open-weight models have collapsed the cost of generating findings: a self-hostable model like GLM-5.2 can now surface plausible vulnerability…

Decoupling Security Outcomes from Headcount: The Case for a Native Ops Layer

Decoupling Security Outcomes from Headcount: The Case for a Native Ops Layer

Industry Insights

The goal every security leader is actually chasing is simple to state and brutal to reach: get security work done end to end — assigned, tracked, verified, closed — efficiently, with automation you…

You Shouldn't Need to Hire Someone to Keep Your Scanner in Sync With Your Tools of Record

You Shouldn't Need to Hire Someone to Keep Your Scanner in Sync With Your Tools of Record

Industry Insights

Nullify's thesis is that security work — finding, triaging, program-managing, and fixing exposure — should run end to end on AI that stays controlled and measurable, so a program's output stops…

The Vulnerability-Count Arms Race Is a Vanity Metric

The Vulnerability-Count Arms Race Is a Vanity Metric

Industry Insights

Every security leader is being asked the same question this year: prove the program is working. The headcount to answer it is flat, the attack surface is not, and the number most teams reach for —…

See Nullify fix your code, live

Bring a repository and a question. We'll show you what Nullify validates, what it dismisses and the fix it writes.

Book a live demo See pricing →