Operations | Monitoring | ITSM | DevOps | Cloud

Dog-walk thoughts on vulnerabilities at scale More CVEs are being found, disclosed and weaponised faster than ever. For a small team with one product, that's manageable: a CVE lands, you fix it. But if you're running thousands of applications across tens of thousands of repos, "the teams will handle it" stops working. It becomes a governance problem.

AI coding tools are in use across regulated industries, producing workable code faster than humans can review. It’s a shift that’s raising difficult questions that haven’t been fully answered yet. What does governance look like when AI agents are writing the code, reviewing each other’s work, and fixing their own findings? How do you prove what code is running and whether it passed your checks? Who’s accountable for change approvals, audits, incidents?

Defining a control in a policy document is easy. Proving that every build was evaluated against it - and that nothing non-compliant ever reached production - is the hard part. Kosli's new Controls feature closes that gap. Every control is defined in Kosli, every build is evaluated against it, and deployments are gated automatically when the evidence isn't there. That means: Every control decision is recorded as evidence, build by build Coverage shows exactly where a control is enforced across your environments.