ActiveState @ActiveState

ActiveState enables DevOps, InfoSec, and Development teams to improve their security posture while simultaneously increasing productivity and innovation. activestate.com Vancouver, BC Joined November 2008

Tweets

15K
Followers

4K
Following

2K
Likes

3K

ActiveState @ActiveState

12 minutes ago

@ComputerWeekly Read the full conversation on where open source security is headed, and what actually closes the gap: buff.ly/tHcXeex

0 0 0 2 0

View Details

ActiveState @ActiveState

12 minutes ago

@ComputerWeekly Open source is in 98% of the software running today. Her read on why that finally matters: 'I'm hoping people are standing up and paying attention now, with just the pure number of attacks on the software supply chain that we've seen.'

1 0 0 4 0

View Details

ActiveState @ActiveState

12 minutes ago

Why did open source security stay an afterthought for so long? Our CEO Abby Kearns has an answer: 'It's a shortcut we were all happy to live with.' Via Alex Scroxton at @ComputerWeekly

1 0 0 6 0

View Details

ActiveState @ActiveState

37 minutes ago

Full breakdown from Rebecca Banks: buff.ly/QSCXHRU

0 0 0 2 0

View Details

ActiveState @ActiveState

37 minutes ago

The fix: govern what comes in before it becomes next quarter's maintenance backlog, not slow AI down trying to catch up after the fact. Full breakdown in the reply below. Where does this show up first on your team: the roadmap, the backlog, or a Slack thread nobody's resolved yet?

1 0 0 3 0

View Details

ActiveState @ActiveState

37 minutes ago

AI-assisted engineering teams: 63% say their scope grew in the past year. 45% are working longer hours. Both numbers point to time spent maintaining code that's already shipped, not time spent writing it.

1 0 0 9 0

View Details

ActiveState @ActiveState

a week ago

Today, the EU Cyber Resilience Act's Article 14 obligations become enforceable. If you sell products with digital elements into the EU, you now have 24 hours to report an actively exploited vulnerability from the moment you know, even in products that shipped years ago. A scanner report sitting in a dashboard isn't a compliance answer. A defined, auditable process is. Non-compliance sits in the CRA's highest penalty tier: up to €15 million or 2.5% of global annual turnover, whichever is greater. December 2027 is the deadline everyone's watching. Today is the one that just quietly became real. Start closing the visibility gap now. Read the release: buff.ly/LV9lylc

0 0 2 59 0

View Details

ActiveState @ActiveState

3 weeks ago

Today is International Women in Cyber Day 🎉 At ActiveState, these 17 women are building, innovating, and driving our team forward every single day. To our team, partners, and community: Drop a comment below to tag and celebrate the ActiveState women who’ve made an impact on your work. 💙 #InternationalWomeninCyberDay

0 0 0 80 0

View Details

ActiveState @ActiveState

3 weeks ago

"Open source is really having a bit of an existential crisis," says Abby Kearns, ActiveState CEO, in a new @computerweekly interview. AI agents pulling packages, developers choosing convenience over scrutiny, governance treated as a compliance checkbox. The conversation has to change, from scan-and-alert to actually managing risk. Read the full piece: buff.ly/h04y022

0 0 0 74 0

View Details

ActiveState @ActiveState

4 weeks ago

Scoping your migration? We wrote up what changes on October 22, the options, and the question most teams skip: buff.ly/vNuWkuA

0 0 0 14 0

View Details

ActiveState @ActiveState

4 weeks ago

We surveyed 250 DevSecOps leaders: 83% named outdated base images as the root cause of their most recent vulnerabilities. 90% are still running lightly modified public images with little to no hardening. We wrote about this gap in June 2025.

1 0 0 16 0

View Details

ActiveState @ActiveState

4 weeks ago

Minimus is shutting down. The founders built Twistlock before this, and John Morello wrote NIST SP 800-190. A 60-day maintenance window and refunds for enterprise customers is a more graceful exit than most vendors manage. An open letter to their customers (a thread):

1 0 0 132 0

View Details

ActiveState @ActiveState

4 weeks ago

Your mean time to remediate is 55 days. The EU CRA gives you 24 hours to report a vulnerability you're already being exploited through. If your compliance plan is just a quicker patching process, you built the wrong plan. #EUCRA #OpenSourceSecurity #SoftwareSupplyChain #DevSecOps #SBOM buff.ly/u1VwYyg

0 0 0 131 0

View Details

ActiveState @ActiveState

4 weeks ago

FedRAMP's RFC-0024 has two dates, not one. September 30, 2026 is when new authorization packages must ship in OSCAL. September 30, 2027 is when penalties, including loss of certification, start. Build the pipeline before date one, not after date two. Read more at: buff.ly/iCDNvZO

0 0 0 117 0

View Details

ActiveState @ActiveState

a month ago

FedRAMP's OSCAL mandate isn't just a file format change. It requires machine-readable mapping of every open source component, its SBOM, and its vulnerability status, generated continuously, not assembled once a year for the audit.