Introducing Ergo: explainable policies on OPA
Why allow: true isn’t enough when an auditor asks for evidence When an auditor tests a control, they ask two questions about each change: was the control met, and what evidence shows how that result was reached? Most automated controls can answer the first. A Rego policy returns allow: true or allow: false, but says nothing about what it checked. Engineers can hand-write violation messages to explain a failure, but a passing check leaves no record at all.
LATEST ARTICLES
Snyk vulnerability compliance with kosli evaluate trail
Kosli recently released kosli evaluate trail, a command that evaluates selected attestations in a Kosli trail against a Rego policy file. We used it to build a complete and useful solution for …
Announcing Kosli’s brand new docs
Good docs are how developers work with a product, from first look to daily use. That’s been true for a long time, and it’s becoming more true as developers increasingly hand that work to …
Diff-erent Perspectives: How Specialized LLM Personas Catch More Bugs
We’ve built a multi-LLM PR reviewer that runs on every pull request in a couple of our own repos. Two independent models look at each change in parallel, each wearing a set of “persona …
Introducing Code Repositories in Kosli
Kosli gives your organization a complete picture of software delivery - every build, scan, deployment, and compliance event tracked. Until now that picture was most useful to the people managing …
Kosli and Adaptavist Partner to Automate Governance for AI driven Software Delivery
Today, Kosli and Adaptavist announce a strategic partnership to help regulated enterprises automate governance for AI driven software delivery - making it automated, continuous, and evidence-driven …
Introducing kosli evaluate: Rego Policy Evaluation for Your Compliance Data
If you’re evaluating compliance controls against your Kosli trail data today, there’s a good chance you’ve written some glue code to make it work. A script that pulls trail data from …
FEATURES
Here’s what Mythos is really exposing inside banking and financial services
In April, Anthropic disclosed that its new AI model, Claude Mythos, had found a vulnerability in OpenBSD that survived 27 years of human review. Mozilla used the same model to find 271 security flaws …
Building a Control Framework for the AI SDLC
Since November, Kosli’s own engineering team has been running a live experiment: what happens to code review when the thing generating the code - and increasingly, the thing reviewing it - is an …
How Norsk Tipping uses feature flags to govern their deployments
Norsk Tipping is Norway’s state-owned gaming operator, running 2,500 to 3,000 production releases a year across iOS, Android, web and backend systems. Like every regulated organisation at scale, …
NEWS
Kosli joins the Plexal & Barclays Eagle Labs Scaleup Programme
Kosli has been selected for the fourth edition of the Scaleup Programme run by Plexal and Barclays Eagle Labs. Following a competitive application process, we’re one of 25 high-growth UK technology …
Deutsche Bank leads the way on secure adoption of AI enabled software delivery
As AI accelerates software development and expands its scale, Deutsche Bank is taking a leading role in ensuring the technology can be adopted safely, securely, and responsibly across regulated …
Kosli and Adaptavist Partner to Automate Governance for AI driven Software Delivery
Today, Kosli and Adaptavist announce a strategic partnership to help regulated enterprises automate governance for AI driven software delivery - making it automated, continuous, and evidence-driven …
TECHNOLOGY
Introducing Ergo: explainable policies on OPA
Why allow: true isn’t enough when an auditor asks for evidence When an auditor tests a control, they ask two questions about each change: was the control met, and what evidence shows how that …
How Norsk Tipping uses feature flags to govern their deployments
Norsk Tipping is Norway’s state-owned gaming operator, running 2,500 to 3,000 production releases a year across iOS, Android, web and backend systems. Like every regulated organisation at scale, …
Diff-erent Perspectives: How Specialized LLM Personas Catch More Bugs
We’ve built a multi-LLM PR reviewer that runs on every pull request in a couple of our own repos. Two independent models look at each change in parallel, each wearing a set of “persona …
