# iac-security Published articles for iac-security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up? DevFeed: [JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up?]() Original publisher: [Read original article]() Author: John Carione Published: 2026-04-23T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Resilience](), [Security](), [snyk-iac](), [supply-chain-security](), [vulnerability](), [Infrastructure as code](), [Open Source](), [AI Development](), [releases](), [pull-requests](), [Code]() Tags: [ai](), [ai-development](), [awareness](), [blog](), [cloud-security](), [code](), [contentlab](), [developer](), [devops](), [executive](), [iac-security](), [interest](), [open-source](), [open-source-security](), [pull-requests](), [releases](), [resilience](), [sbom](), [secrets](), [security](), [snyk-cloud](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain-security](), [vulnerability]() ### AI overview JPMorganChase's 10-point cyber resilience checklist addresses enterprise security priorities spanning software versions, open-source dependencies, SBOMs, build pipelines, secrets, infrastructure as code, and AI development. The article explains how Snyk covers eight of the ten actions through developer workflows and its security platform. ### Source excerpt JPMorganChase published a 10-point cyber resilience checklist. See how Snyk covers 8 of the 10 actions and where it fits in your security stack. ## How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science DevFeed: [How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science]() Original publisher: [Read original article]() Author: Phoebe Nerdahl Published: 2025-12-09T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security](), [CI/CD]() Tags: [ai](), [awareness](), [blog](), [ci-cd](), [cloud](), [container-security](), [containers](), [cybersecurity](), [data](), [datasets](), [developers](), [executive](), [government](), [iac-security](), [infrastructure-as-code](), [open-source](), [open-source-security](), [research](), [science](), [security](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [software](), [supply-chain]() ### AI overview Snyk explains how federal agencies can secure AI-driven scientific software, data pipelines, cloud resources, and software supply chains for the Genesis Mission. ### Source excerpt Snyk helps Federal Agencies secure software for the White House's Genesis Mission, accelerating AI-driven science. Implement Secure by Design for the supply chain, cloud, and pipelines. ## DevSecOps Automation Framework DevFeed: [DevSecOps Automation Framework]() Original publisher: [Read original article]() Author: Ben Desjardins Published: 2025-03-11T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [DevSecOps](), [Automation](), [Framework](), [Application Security](), [Testing](), [CI/CD](), [iac-security](), [Vulnerabilities]() Tags: [application-security](), [automation](), [awareness](), [blog](), [ci-cd](), [devops](), [devsecops](), [executive](), [framework](), [iac-security](), [infrastructure-as-code-iac](), [megawatt](), [security](), [snyk-platform](), [vulnerabilities]() ### AI overview This article explains how DevSecOps automation integrates security throughout the software development lifecycle. It discusses automation frameworks, automated security testing in CI/CD pipelines, early vulnerability detection, consistent security policies, compliance, SAST, and Infrastructure as Code security. ### Source excerpt Learn about the principles of DevSecOps automation, how to implement a DevSecOps automation strategy, & the best DevSecOps tools. ## Ensuring comprehensive security testing in DevOps pipelines DevFeed: [Ensuring comprehensive security testing in DevOps pipelines]() Original publisher: [Read original article]() Author: Jim Armstrong Published: 2024-10-17T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [DevOps](), [DevSecOps](), [Security](), [Monitoring](), [sdlc]() Tags: [application-security](), [awareness](), [blog](), [cloud-security](), [code-security](), [container-security](), [devops](), [devsecops](), [executive](), [iac-security](), [megawatt](), [monitoring](), [open-source-security](), [pmm](), [sdlc](), [secrets](), [security](), [snyk-platform](), [testing]() ### AI overview This article explains why traditional security processes often create friction when inserted into DevOps pipelines and presents DevSecOps as a model that integrates security into software delivery. It focuses on comprehensive security testing and monitoring, risk-profile-based policies, threat modeling, security requirements gathering, and the use of SAST and SCA tools with IDEs for real-time feedback. ### Source excerpt Learn how to integrate comprehensive security testing into DevOps pipelines to protect your entire software development lifecycle. ## Detect Hardcoded Secrets Early to Reduce Data Breach Risk DevFeed: [Detect Hardcoded Secrets Early to Reduce Data Breach Risk]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-09-16T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Development](), [sensitive data](), [Security](), [API keys](), [snyk](), [Authentication](), [passwords](), [JSON Web Tokens](), [ide](), [JavaScript]() Tags: [access-control](), [api-keys](), [application-security](), [authentication](), [awareness](), [blog](), [breach](), [code-security](), [developer](), [devops](), [devrel](), [devsecops](), [iac-security](), [javascript](), [jwt](), [passwords](), [secrets](), [security](), [sensitive-data](), [snyk-code](), [snyk-security-intel](), [supply-chain-security](), [vulnerability-insights]() ### AI overview This developer article explains that hardcoded secrets, including API keys, database credentials, passwords, encryption keys, and tokens, can expose applications to unauthorized access and data breaches. It describes using secrets detection during development to identify exposed credentials early, including through the Snyk IntelliJ IDE extension. ### Source excerpt Concerned about data breaches? Exposed secrets like API keys and passwords are a major culprit. Secure your software development lifecycle, identify and remove hardcoded secrets in code, and leverage Snyk's secrets detection tools to identify secrets early in development in order to prevent breaches and safeguard your applications. ## 5 reasons why developers at FinServ institutions are outpacing their security teammates DevFeed: [5 reasons why developers at FinServ institutions are outpacing their security teammates]() Original publisher: [Read original article]() Author: Katie DeMatteis Published: 2024-09-09T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [iac-security](), [Vulnerabilities]() Tags: [ai](), [application-security](), [awareness](), [blog](), [ci-cd](), [cloud](), [devops](), [enablement](), [executive](), [finserv](), [iac-security](), [infrastructure-as-code](), [megawatt](), [vulnerabilities]() ### AI overview Financial-services development teams are adopting new technologies and cloud-based infrastructure-as-code quickly, while security teams struggle to adapt older application-security tools and processes to these environments. ### Source excerpt Learn why the development practices at financial services companies are outpacing older security technologies and techniques. ## Snyk highlights AWS re:Invent 2023 DevFeed: [Snyk highlights AWS re:Invent 2023]() Original publisher: [Read original article]() Author: David Lugo Published: 2023-12-14T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Generative AI](), [Securing AI](), [Amazon Web Services](), [ai security](), [code security](), [Application Security](), [Application Development](), [Language models](), [cloud security](), [Infrastructure as code](), [Containers](), [sdlc]() Tags: [acquisition](), [ai](), [ai-code-security](), [ai-coding](), [ai-security](), [ai-tools](), [amazon](), [application-development](), [aspm](), [awareness](), [aws](), [blog](), [cloud](), [cloud-computing](), [code](), [code-security](), [coding](), [container-security](), [containers](), [devops](), [executive](), [generative-ai](), [iac-security](), [interest](), [megawatt](), [related-content](), [sdlc](), [security](), [security-solutions](), [snyk](), [snyk-apprisk](), [snyk-container](), [snyk-iac](), [tool]() ### AI overview This recap covers Snyk's AWS re:Invent 2023 highlights, including AWS partnership achievements, new AWS integrations, generative AI developments, and the use of AI coding assistants. It emphasizes the need for AI security solutions because AI-generated code can increase vulnerabilities. ### Source excerpt In this blog, we recap the most exciting developments from AWS re:Invent 2023, including Snyk's industry-leading progress with generative AI, ASPM, and the importance of AI security. ## Rego 103: Types of values and rules DevFeed: [Rego 103: Types of values and rules]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt; Becki Lee Published: 2023-11-16T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Open Policy Agent](), [Infrastructure as code](), [Programming]() Tags: [beginner](), [blog](), [blog-post](), [cloud-security](), [code](), [developer](), [devrel](), [enablement](), [iac-security](), [infrastructure-as-code](), [learn](), [opa](), [policy](), [programming](), [rego](), [snyk-cloud](), [snyk-iac](), [types]() ### AI overview This beginner-focused article is the third part of a Rego introduction series. It explains scalar and composite value types, including strings, numbers, booleans, null, arrays, objects, and sets, and introduces set rules, object rules, functions, and iteration for writing policies evaluated by OPA. ### Source excerpt Learn about the different types of Values and Rules you can use to build policies in OPA & Rego. ## Rego 102: Combining queries with AND/OR and custom messages DevFeed: [Rego 102: Combining queries with AND/OR and custom messages]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt; Becki Lee Published: 2023-11-09T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Programming](), [Cloud](), [Infrastructure as code](), [JSON](), [YAML]() Tags: [beginner](), [blog](), [blog-post](), [cloud-security](), [code](), [developer](), [devrel](), [enablement](), [guide](), [how-to](), [iac-security](), [opa](), [policy](), [programming](), [rego](), [snyk-cloud](), [snyk-iac]() ### AI overview A beginner-focused guide to intermediate Rego syntax, explaining how to combine queries with AND and OR and introduce custom messages. It describes how OPA evaluates Rego policies against JSON or YAML input documents. ### Source excerpt Learn how to use AND and OR rules and custom messages using OPA and Rego in the second part of our beginner's guide to Rego. ## Rego 101: Introduction to Rego DevFeed: [Rego 101: Introduction to Rego]() Original publisher: [Read original article]() Author: Becki Lee Published: 2023-11-02T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Open Policy Agent](), [Infrastructure as code](), [Security](), [Programming]() Tags: [blog](), [blog-post](), [cloud-security](), [developer](), [devrel](), [enablement](), [how-to](), [iac-security](), [infrastructure-as-code](), [infrastructure-as-code-iac](), [learn](), [opa](), [policy](), [rego](), [security](), [snyk-cloud](), [snyk-iac](), [tutorial]() ### AI overview A beginner-focused introduction to Rego, the declarative policy language used with Open Policy Agent (OPA). It explains policy as code, how OPA evaluates Rego policies, and how these policies can be applied to cloud and infrastructure-as-code resources. ### Source excerpt Learn how to write your first policy as code rules in Rego. This Rego tutorial for beginners covers the basics of Rego syntax and using OPA. ## Snyk Partner Speak video series with HashiCorp DevFeed: [Snyk Partner Speak video series with HashiCorp]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2023-10-04T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security]() Tags: [application-security](), [automation](), [awareness](), [blog](), [cloud](), [cloud-infrastructure](), [deployment](), [developer](), [devops](), [executive](), [iac-security](), [infrastructure-as-code](), [partnership](), [related-content](), [security](), [series](), [snyk-iac](), [terraform](), [video](), [vulnerability](), [workflows]() ### AI overview Snyk and HashiCorp present a video about integrating security into development and deployment workflows. The partnership applies Snyk scanning and remediation to Terraform Cloud workflows to identify and fix infrastructure-as-code misconfigurations before production. ### Source excerpt The latest Snyk Partner Speak Series video showcases how Snyk and HashiCorp enable development teams to easily build and deploy applications with integrated security at every stage. ## Announcing IaC+ early access: Secure your infrastructure configurations across the SDLC DevFeed: [Announcing IaC+ early access: Secure your infrastructure configurations across the SDLC]() Original publisher: [Read original article]() Author: Lauren Place Published: 2023-10-03T13:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security](), [snyk-iac](), [Infrastructure as code](), [snyk](), [sdlc](), [Terraform](), [ide](), [ci](), [Command-line interface](), [Monitoring]() Tags: [acquisition](), [blog](), [ci](), [ci-cd](), [cli](), [cloud-security](), [compliance](), [convert-paid](), [devops](), [enablement](), [executive](), [iac](), [iac-security](), [ide](), [monitoring](), [pmm](), [preview](), [sdlc](), [security](), [snyk](), [snyk-iac](), [terraform]() ### AI overview Snyk announces IaC+, an early-access version of Snyk IaC available through Snyk Preview from October 3, 2023. It is designed to help developers find and fix infrastructure misconfigurations across the SDLC, from code to cloud, with improved pre-deployment analysis, broader security and compliance rules, and support for multi-file Terraform analysis. ### Source excerpt We're excited to announce that IaC+ is available in early access via Snyk Preview starting October 3rd, 2023.