False Positive or Noise? Smart security teams still get this wrong

Before you report a security finding as a "false positive", make sure you distinguish between FPs and noise. The difference matters, and more people get it wrong than you'd expect

The MITRE Thing was a wake-up call

MITRE almost lost funding for a big part of the CWE and CVE programs in 2025. That matters, and we need to act even though it worked out this time.

What if you're doing security wrong?

Maybe information security is about more than just protecting information