Blog
All Blog Posts
When “Secure by Default” Only Works in One Tool, You Don’t Have a Governance Model
AI coding assistants are making dependency decisions faster than your team can review them. A tool-level integration only governs the developers who use that tool. ...
Read More
The Quiet Foundation of AI-Native Development
AI agents are resolving open source dependencies at machine speed, with no human in the loop. ActiveState gives your environment the provenance, remediation, and reproducibility ...
Read More
Your Open Source Governance Program Is Already Behind. Here’s How Far.
Most open source software security failures aren't caused by a lack of tooling — they're caused by governance programs that haven't kept pace with how ...
Read More
JFrog Curation and ActiveState Curated Catalog Are Not the Same Thing
Stop the confusion between JFrog Curation and ActiveState Curated Catalog. Learn how these two distinct security layers—policy at the distribution point and source-level verification—work together ...
Read More
Operationalizing SBOMs: From SPDX and CycloneDX to OpenVEX and Provenance
Learn how to operationalize SBOMs using SPDX, CycloneDX, OpenVEX, and provenance to improve your organization’s vulnerability posture.
Read More
Project Glasswing: Is Your Remediation Infrastructure Ready?
96% of applications contain open source components. Most of the vulnerabilities in those components are about to be found. That’s not hyperbole. It’s the rational ...
Read More
Navigating the Labyrinth: Mastering Java Dependency Management with ActiveState
Master Java dependency management with ActiveState. Move beyond Maven and Gradle to achieve environment hermeticity, proactive conflict resolution, and end-to-end security.
Read More
Container Security Tools: How to Choose the Right Solution at Each Stage of the Container Lifecycle
Container hardening reduces risk at build time, but not after deployment. Learn how to secure the full software lifecycle.
Read More
If You Use axios, Stop What You’re Doing
Axios NPM Breach: Learn how to detect the infection, rotate keys, and secure your supply chain now.
Read More
What the RSAC™ 2026 Conference Told ActiveState About the State of Security — And Where We Go From Here
Every year, RSAC brings the security industry together — and every year, the conversations on the floor reveal where the real pressure points are. In ...
Read More
Container Hardening Is Only Step One: How to Secure the Full Software Lifecycle
Container hardening reduces risk at build time, but not after deployment. Learn how to secure the full software lifecycle.
Read More
Open Source Is Under Attack. Here’s How to Manage the Risk Without Abandoning the Benefit
In March 2026, a threat actor known as TeamPCP executed one of the most consequential open source supply chain attacks on record. Starting with a ...
Read More
