Featured Governance & Compliance
Cyber Resilience Act: what changes for software companies?
A practical review of the Cyber Resilience Act milestones in 2026 and 2027 and the technical evidence software manufacturers need to organize.
Xmart Blog
Security decisions explained from the real problem outward.
Technical insights on AppSec, DevSecOps, and software supply chain security for teams turning risk, architecture, and evidence into action.
Xmart Library
Recent articles
Versioned, referenced technical content connected to architecture decisions.
Software Supply Chain
MCP Is Now Part of the Software Supply Chain. Is Your Organization Governing It?
AI agents can now access code, terminals, tools, and services. See why MCP, skills, and permissions expand the surface that AppSec needs to govern.
Malware
The Package Was Legitimate Yesterday. Today It Ships Malware. Would Your Pipeline Notice?
Recent attacks show that historical reputation does not guarantee a safe version. See how compromised legitimate packages move through the Software Supply Chain.
Software Supply Chain
You Received a Supplier SBOM. What Do You Do With It Now?
Receiving an SBOM is just the beginning. Learn how to validate identity, composition, vulnerabilities, VEX, EOL, policies, and continuous monitoring.
DevSecOps
When your artifact repository becomes critical infrastructure
A repository stops being mere storage when it controls the availability, integrity, and promotion of components used by CI/CD.
Governance & Compliance
Cyber Resilience Act: what changes for software companies?
A practical review of the Cyber Resilience Act milestones in 2026 and 2027 and the technical evidence software manufacturers need to organize.
Software Supply Chain
OWASP Top 10 2025: why did Software Supply Chain Failures reach the Top 3?
A03:2025 expanded the focus from vulnerable components to dependencies, builds, repositories, distribution, and software supply chain governance.
Malware
SCA finds vulnerabilities. But what about malware?
CVEs, vulnerability intelligence, and malicious package detection solve different problems and must operate as complementary controls.
From insight to environment
Need to turn a technical recommendation into architecture and operations?
Xmart supports the assessment, implementation, and operation of AppSec and DevSecOps controls.
