Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Liav Caspi
Secure Fast, Not Slow: What We Learned Building VibeGuard 2.0
Why the answer to secure agentic development isn’t tighter restrictions – it’s better developer tooling. Like almost every software company right now, Legit has gone fully AI-native in development. Our engineers’ default tool is no longer just an IDE – it’s a command line interface with agents like Claude Code or Cursor. We’ve been steadily pushing further into autonomous, agentic operations: testing, code review, automated bug fixing.
Software License Scanning vs. Manual License Review: The True Cost of Compliance
Every organization using open-source software faces the same question: How do we ensure license compliance without slowing development? The traditional answer has required engineering, legal, compliance or other teams to conduct manual license review before dependencies are approved. It’s a tedious, slow process that doesn’t scale and leaves open the possibility of human error.
Legit License Scanning and Policy Enforcement
Automated peace-of-mind you know what you’re shipping Open-source software powers modern development. It’s also a security and compliance minefield. Every dependency you pull into your codebase comes with a license. Some are permissive and safe for commercial use. Others (e.g., GPL, AGPL or SSPL) carry obligations that can conflict with your business model, require source code disclosure or restrict how you deploy your software. The challenge?
When Security Incidents Break: The Questions Every CISO Asks (And How We Securely Built a Solution in Record Time)
When Security Incidents Break: The Questions Every CISO Asks (And How We Securely Built a Solution in Record Time) It was an average Tuesday when React2Shell hit. Then Shai Hulud soon followed. Then came the flood of messages from security leaders asking the same questions: Are we affected? And if so – how?
Building AppSec for the AI Development Era
AI is accelerating software development but creating new security blind spots. Learn how AI reshapes AppSec risks—and how AI can also be the solution. Three-quarters of developers now use AI tools to write code, up from 70% just last year. Companies like Robinhood report that AI generates the majority of their new code, while Microsoft attributes 30% of its codebase to AI assistance.
Forbes JAPAN 公式サイト（フォーブス ジャパン）
Liav CaspiはLegit SecurityのCTO兼共同創業者。サイバーセキュリティに関する豊富な経験を持つテクノロジーリーダー、プロダクト戦略家、起業家である。 ソフトウェア開発はかつてないスピードで進んでいる。開発者の4分の3が現在AIツールを使用してコードを書いており、これは昨年の70%から増加している。Robinhoodのような企業では、本番環境にプッシュされる新しいコードの大部分をAIが生成している。 開発者が記録的なスピードでアプリケーションを構築できる一方で、生産性とセキュリティの間に重大なギャップが生じている。 当社の2025年アプリケーションリスク状況レポートによると、組織の71%がソースコードでAIモデルを使用しており、46%が危険な方法で使用している。例えば、信頼性の低いモデルを使用したり、コードレビュー要件やブランチ保護などの安全対策を怠ったりしている。これはセキュリティチームがAIの使用場所、アクセスするデータ、保護対策の有無を把握していないという可視性の問題に起因している。...
Rethinking Vendor Security In Healthcare
Last year, cyberattackers accessed 192.7 million patient records at Change Healthcare. And the attack vector wasn’t sophisticated; the attackers used exposed credentials on a service that didn’t have multi-factor authentication (MFA) enabled. Similarly, criminals exploited website tracking data from Kaiser Foundation Health Plan to breach patient information. Both breaches had the same root cause: a vendor with weak security.
Balancing The Security Risks And Rewards Of AI-Generated Code
Liav Caspi is CTO and Co-Founder of Legit Security. Tech leader, product strategist and entrepreneur with large cybersecurity experience. Software development is moving at a pace we've never seen before. Three-quarters of developers now use AI tools to write code, up from 70% just last year. At companies like Robinhood, AI generates the majority of new code being pushed to production.
Rethinking vendor security: How to protect your software supply chain
By Liav Caspi Last year, healthcare systems faced more cyberattacks than any other critical infrastructure industry, costing $7.42 million. The combination of rich, high-value data and low technical sophistication makes healthcare systems an easier target. The biggest threat is no longer stealing records from hospitals directly but hacking insecure third-party connections. Third-party involvement in data breaches has doubled to nearly 30% in recent years.
Breaking the Burnout Cycle: How Smart Automation and ASPM Can Restore Developer Joy
Developers are burning out. While their primary role remains coding and innovation, they're now pushed to deliver more, faster, and are expected to take on security responsibilities on top of their development duties — reviewing code for vulnerabilities, fixing security issues, and navigating complex security schemes and protocols they weren't trained for. Add AI-generated code to the mix, and the security burden grows even heavier as traditional controls struggle to keep pace.
Announcing New Legit ASPM AI Capabilities
Get details on Legit’s new AI capabilities. Developers are increasingly leveraging AI to build faster and smarter. Its use has become so widespread that those not leveraging it will be left behind. In fact: • None use AI in at least one customer-facing function Legit Security recently conducted its own comprehensive survey of over 400 security professionals and software developers from a wide range of industries to understand GenAI use and security.
Why Legit Security Immediately Joined the New Coalition for Secure Artificial Intelligence (CoSAI)
Get details on CoSAI and why Legit chose to be a part of this forum. Surging adoption of generative artificial intelligence (GenAI) and large language models (LLMs) is both revolutionizing software development and exposing organizations to risk at an unprecedented pace.
Don't Protect Your Software Supply Chain, Defend the Entire Software Factory
Find out why a too-narrow definition of "supply chain" may be hindering software security efforts. The SolarWinds attack in December 2020 was a stark wake-up call for the cybersecurity community, emphasizing the urgent need for software supply chain security. The breach demonstrated how trusted relationships and mechanisms can be exploited by bad actors, and that it is hard to trust third-party software, even if coming from a reputable enterprise vendor.
Liav Caspi
By Liav Caspi Safeguarding software integrity is crucial, especially in vital industries such as finance. According to a report by Carbon Black, the financial sector experiences an average of 10,000 security alerts per day, outstripping most other industries. As the technology landscape evolves and expands, it's imperative that your defenses strengthen alongside it. So, ... Read More
ASPM's Role in Financial Software Protection
Safeguarding software integrity is crucial, especially in vital industries such as finance. According to a report by Carbon Black, the financial sector experiences an average of 10,000 security alerts per day, outstripping most other industries. As the technology landscape evolves and expands, it's imperative that your defenses strengthen alongside it. So, how do leading financial institutions shore up their cyber defenses and protect their software assets?
Council Post: Why ASPM Is The Future Of Secure Software Delivery
CTO and Co-Founder of Legit Security. Tech leader, product strategist and enterpreneur with large cybersecurtiy experience. Software is dominating (“eating”) the world, and nearly every sector relies on it, including banking, retail, healthcare and more. Software engineers are the “builders of the new world”; however, their applications are hacked on a daily, sometimes hourly basis.
Hard to handle: Securing AI-generated code and the AI agents that write it
Organizations are charging heedlessly into AI-driven code generation without understanding the risks. They don't know which models their developers are using, where MCP servers are being used, or even which pieces of their own code are AI-generated -- or imported from elsewhere. Development teams may not realize that AI coding agents must be protected from prompt injection, data poisoning or other external influences.
Application Security 2.0: AI changes everything
Attendees will learn: Actionable strategies for leveraging AI to enhance application security Techniques to identify and rectify common security flaws in applications Steps to implement best practices that improve your security posture As cyberattacks grow more sophisticated, traditional application security approaches are no longer enough.
What is Application Security Posture Management
On May 5th, Gartner published an Innovation Insights Report that outlines the latest evolution in AppSec- Application Security Posture Management (or ASPM for short). ASPM is something that we at Legit Security have been pioneering for over a year - a revolution in the way modern application security can be done more efficiently and effectively.
5 Best Practices for Successful Application Risk Assessments
Rapid innovation is the lifeblood of many companies in the digital age. If your organization employs a CI/CD workflow, you need an effective application risk management strategy to secure your SLDC pipeline and DevOps processes. And one of the most critical aspects of that strategy is a well-defined risk assessment strategy. But what does that actually mean?
What is a Secure SDLC?
SDLC (Software Development Life Cycle) is a breakdown of all the stages involved in software creation. There are distinct SDLC stages and many different software development models in use. Security should be integral to each step along the way to ensure that the resulting product is secure. We’ll cover the fundamentals of a secure SDLC and explain why “shifting security left” can also save time and expense and prevent the accumulation of errors and vulnerabilities from previous stages.
2023 Predictions for Modern Application Security
Software dominates the world andremains abig and accessible attack surface.In 2022, an estimated $6Bwas invested in Application Security, with that number expected to reach $7.5B in 2023. Within AppSec, software supply chain security entered the spotlight two years ago and represents AppSec’s fastest growing attack category with major headlines of breaches and exploits happening on a regular basis.
2023 Predictions for Modern Application Security
Software dominates the world and remains a big and accessible attack surface. In 2022, an estimated was invested in Application Security, with that number expected to reach $7.5B in 2023. Within AppSec, software supply chain security entered the spotlight two years ago and represents AppSec's fastest growing attack category with major headlines of breaches and exploits happening on a regular basis .
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Liav
Contact Liav, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack