Operations | Monitoring | ITSM | DevOps | Cloud

Sometimes there's a vulnerability in a package you can't remove. Legacy dependencies don't always come with an easy fix. The one thing you don't do is bury it in the backlog with no dates and no reasoning attached. This video covers what a defensible response actually looks like: Your ability to show your work on unfixed vulnerabilities is more important than simply identifying them.

If an AI model can find a vulnerability for an attacker, the same model should help a defender fix it. In practice, the math doesn't favor the defender. This quick video digs into the real asymmetry AI-powered vulnerability discovery creates: The goal is models acting as tools for defenders, not weapons for attackers. Getting there means rethinking how much ground your team can realistically cover on its own.

npm and Python get all the security attention, but attackers don't limit themselves to your highest-volume formats. A Docker image, a Helm chart, or a Rust crate can all be an entry point. If your security policy is built around the formats you use most, the formats you've deprioritized become the blind spot. This video breaks down why artifact management needs to be centralized across every package format, not just the popular ones.

Giving developers AI tools is only the first step.

AI can answer the question. But can it replace the mentor? Rob, Hanabel, and Webster discuss what junior developers need in the age of AI.

A deployment fails validation and the sync stops. Argo CD hands the report to AURA, which finds the wrong version, fixes it, and re-runs the sync. Normally, a failed sync means a person opens the application, reads the hook logs, and works out which value is wrong. Here, the sync fail hook sends AURA a short failure report and an incident ID over the agent-to-agent protocol, then exits. It does not say how to investigate or what to change.

Last year was the year of AI code generation. This year is everything that comes after: validation, quality, and making sure what gets built actually ships. Nobody's better positioned to talk about that than CircleCI, and in this episode of Peer Review, CFO Blake Buisson and CMO Chitra Balasubramanian dig into what that moment means for the company and the people building it.

Seven years of institutional knowledge meets a fresh outside perspective in this episode of Peer Review. June Ko is CircleCI's Chief Legal Officer. Judson Griffin is the Chief Revenue Officer. They cover what tenure without complacency actually looks like, why boomerang hires keep happening across every region and role, and what it means to be in the middle of a market moment most people won't recognize until it's already passed. Judson's advice: get in front of the rocket and hold on. June's take: being uncomfortable is the new normal, so you might as well get good at it.

Jim Rose and Rob Zuber have been working together since 2011. By now they can plan a quarter with hand signals. But this episode of Peer Review isn't about how well they know each other. It's about what they're still figuring out. CircleCI's CEO and CTO sit down to talk about what they've always believed about software delivery (it's about outcomes, not craft), how the pace of change has forced them back into the trenches of actually building, and what it means to lead a technical organization when the state of the art is shifting faster than any pitch deck can keep up with.

There's a risk window after a malicious package is published when nobody knows it's there. Scanners alone can't close that window.

Everyone keeps saying we don't need junior engineers anymore. This episode makes the case that's exactly wrong. Rob sits down with two CircleCI colleagues at opposite ends of the experience spectrum: Hanabel Mengistu, a new grad less than a year into her first engineering role, and Michael Webster, who has been writing software professionally since 2012. Together they explore what it actually feels like to enter the industry right now, when AI has reshuffled the deck for everyone.

Every dependency security program needs a way to handle packages that have a valid business reason to stay in use despite a CVE or license issue. Ideal exception processes give developers full context upfront, including safer alternatives, then route real requests to a security team that weighs the risk profile and logs who requested it, who approved it, and for how long. Get the friction wrong in either direction and the process fails: too much and developers route around it, too little and it becomes the default path.

We intentionally introduced a bug into our app to see what would happen. The agent used the CircleCI MCP Server to detect the failed pipeline, diagnose the issue from the build logs, implement a fix, and keep iterating until CI was green.

Open source is the backbone of most software. But should developers trust OSS? npm, PyPI, and Maven don't vet packages before publication, so "publicly available" doesn't automatically mean "safe to pull right now." A secure OSS posture is to trust the ecosystem but verify at ingestion: route packages and dependencies through a controlled layer that runs scanning, age checks, and malware detection before anything reaches a build.

Eighty percent of new developers on GitHub start using Copilot within their first week. How many really know what it's pulling in?

Code generation gets all the attention, but one of AI's biggest strengths might be helping non-engineers prototype ideas, explore solutions, and get work done that otherwise never would have happened.