Introducing the DevArmor Agentic Flywheel

Amir Kavousian & Rami McCarthy

30 May 2026

This article is co-authored with Rami McCarthy, Principal Security Researcher and prolific author of security blogs (ramimac.me). You can also find him on LinkedIn (linkedin.com/in/ramimac/).

Reza Khosravi

23 Apr 2026

Where vulnerability management meets secure design.

Amir Kavousian

11 Apr 2026

AI can now generate working exploits from a CVE in under 15 minutes. Patching can't keep up. The only defense that moves faster than exploitation is the architectural decisions you made before the vulnerability existed.

Petra Vukmirovic

14 Mar 2026

The practitioners who consistently produce good threat models are not the ones with the most sophisticated tooling. They are the ones who are obsessive about what goes in. Get that right, and the all the rest (the methodology, the AI assist, the output format ...) will fall into place.

Amir Kavousian

03 Mar 2026

Early-stage security programs often measure success by the number of vulnerabilities closed. Mature programs measure it by how much risk actually goes down. Instead of treating every finding as equal, they weigh attacker intent, system exposure, and business impact, balancing technical severity (CVSS, EPSS) with architectural and operational context.

Amir Kavousian

14 Jun 2025

The future of AppSec isn't about chasing bugs or triaging alerts. It's about capturing intent, governing design, and enabling every contributor (human or AI) to build securely by default.

Reza Khosravi

27 Apr 2026

The EU just made software defects and security flaws a product liability issue. Here's what changed and what it means for your team.