For CVS Health CISO Alan Rosa, a boring day is a beautiful one.

“The last thing you want as a cybersecurity leader—or technical operations leader, for that matter—is a phone call that says, ‘Something is wrong,’” Rosa told IT Brew. “A good day for me is when the phone doesn’t ring…That’s a boring day. That’s a beautiful day.”

A walk down memory lane. Though Rosa prefers a dull workday, his career in the industry has been anything but. In an RSAC interview, he told IT Brew his first gig of many in the industry wasn’t your traditional SOC analyst or help desk role.

“I was a watch guard in the Navy. So, that’s just my first time I was tasked with protecting something,” Rosa, who is also an SVP of infrastructure and operations at CVS Health, said. “And then after college, I was in Boeing [Defense, Space & Security] and so I was more of a general technologist.”

How Rosa tries to keep days nice and boring.—BM

Open-source components can streamline software building, making them a developer’s best friend—or worst enemy, if a supply-chain attacker decides to poison a package.

Software supply-chain management company Sonatype identified 394,877 new open-source malware packages in Q4 2025, representing a whopping “476% increase compared to the previous three quarters combined.” (The company said the increase was due largely to a self-replicating malware campaign.)

This attack often begins with a threat actor compromising a developer’s account, then publishing a malicious package to a trusted repository. Other developers pull from that source to create their own apps and services, spreading the malware.

Oh, great. More Dune. The latest attack—a “mini Shai-Hulud” (named after a cinematic sandworm)—compromised legitimate software packages and installed malicious credential-stealing updates that spread along connected dependencies.

Locking it down.—BH

There’s been a new development in how Apple manages its products—and it’s an AI disruption.

Apple debuted new AI capabilities at this year’s Worldwide Developers Conference. The company has always had a “consumer-oriented” approach to its products, said Matt Vlasach, Jamf SVP of enterprise product and solutions engineering, who spoke to IT Brew from the conference on June 9.

Now, they’re expanding their software offerings with an open approach to AI, focused on developer tool suite Xcode.

“They’re working with developers quite a bit to encourage them to develop stuff they were doing with Xcode,” Vlasach said. “They’re doing AI-assisted agentic development with Xcode using Anthropic, OpenAI, or Gemini—your subscription of choice.”

How this change could impact macOS and iOS devs.—EH

CollabWORK connects you to the hidden job market through IT Brew and other trusted channels. Browse roles curated specifically for this community by clicking through to the job board.