From the blog
Perspectives on regulation, supply-chain attacks and compliance.
Crypto Agility – Making Your Software Post-Quantum Ready
NIST's post-quantum standards are out — here's why Crypto Agility should already be a top priority in your software development process.
Threat Modeling at Scale: Automating What Used to Take Weeks
Threat modeling stays sporadic because it's complex and manual. See how automation reshapes the economics and why v3 finally makes it accessible.
How Risk-Based Vulnerability Management Changes the Game
Most teams drown in CVEs. This article shows why risk-based prioritization — not patch velocity — is the metric that truly reduces exposure.
Tackling the Challenge of Matching Product and Software Release Cycles
Hardware and software ship on different cadences. How TrustSource's product package keeps SBOMs, CVE mappings and compliance status consistent across both timelines.
Running ts-scan from a Docker Image
A concise technical walkthrough showing how to pull and run the official ts-scan Docker image and pipe results into TrustSource.
Integrated Risk Management: From SBOM to Board Insight
Risk management in software is maturing beyond spreadsheets: structured SBOM and threat-modeling data can produce risk postures teams can act on.
Why Every Software Team Needs an SBOM Strategy in 2026
Regulatory pressure from the CRA and NIS2 keeps rising. A field report on why an SBOM is an operational tool, not just a compliance checkbox.
TrustSource adds EoL data
Unknown EoL components silently threaten security every day. The EU Cyber Resilience Act makes lifecycle management mandatory.
Securing the foundations
SCA in C/C++ world remains a challenge. Learn how bimodal scanning will help you to reduce analysis efforts...
Beyond the Horizon: The Architecture of Quantum Resilience
Post Quantum Readiness requires as a first step to set up an asset inventory cataloging the algorithms used.
ts-scan available as github-action
TrustSource added ts-scan github action to github's marketplace. You may add it directly into your repositories workflows. Read more for details!
Navigating PQC Threat
Understand the threats arising from quantum computing to today's cryptography and learn how to protect your applications.
Update ts-scan to v1.5.2
Based on the learnings from the Shai-Hulud attack, we limited the default configuration of ts-scan to prevent script execution from package.json.
Tackling the nx-Challenge
the latest software supply chain attack on the nx component is a good example on how vulnerable our development environments are.
TSSI-25:0000 - Security Information Feed Test
A test advisory (TSSI-25:0000) confirming the TrustSource Security Information RSS feed is live and working as expected.
Cyber Resilience Act published
The EU Cyber Resilience Act (CRA) has been published recently. This article summarises the major impacts and obligations this will cause.