Notifications
Clear all
Topic starter
06/09/2026 5:18 pm
TL;DR: The long-running productivity case for interpreted languages has weakened as dependency sprawl, runtime complexity, and supply chain exposure now erode much of the speed advantage, according to Arxan Technologies. The security implication is that architecture choices are becoming governance choices, because attack surface, dependency trust, and native-code sprawl now shape risk more than language preference alone.
NHIMG editorial — based on content published by Arxan Technologies: The Return to Bare Metal: Why We’re Done Pretending
Questions worth separating out
Q: How should security teams evaluate application stacks that mix runtime layers and native code?
A: Security teams should evaluate mixed stacks by counting trust boundaries, dependency sources, and privileged bridge components, not by language popularity.
Q: Why do hybrid application frameworks often create more security risk than teams expect?
A: Hybrid frameworks often add risk because they combine multiple runtimes, third-party packages, and bridge layers that must all be trusted to behave correctly.
Q: What are the signs that an interpreted stack is becoming too complex to govern safely?
A: Common signs include repeated native module workarounds, growing dependency chains, inconsistent build behaviour across environments, and increased exceptions in secrets or access handling.
Practitioner guidance
- Assess the full runtime trust chain Map package managers, runtime engines, plugins, transpilers, and native modules as one security boundary, not as separate developer conveniences.
- Review where native extensions are being added Track performance-driven native code introductions in Python, JavaScript, mobile, and data pipelines.
- Bring secrets governance into stack selection Require service account, token, and build credential ownership to be defined before platform approval.
What's in the full article
Arxan Technologies' full blog post covers the operational detail this post intentionally leaves for the source:
- The article's language-by-language comparison of productivity claims versus modern deployment reality
- The vendor's specific arguments about dependency chains, mobile bridge risk, and performance-driven native extensions
- The full discussion of when hybrid frameworks push teams back toward native code in production
- The article's detailed challenge to long-standing assumptions about simplicity, maintenance, and security posture
👉 Read Arxan Technologies' analysis of bare metal, runtime complexity, and appsec trade-offs →
Compiled languages and appsec: are the old productivity trade-offs still valid?
Explore further
06/09/2026 5:19 pm
The application stack is now a governance decision, not just an engineering preference. Once a platform choice determines how many dependencies, bridges, and runtime components must be trusted, it directly shapes security exposure. That means appsec, IAM, and supply chain governance need shared criteria for stack approval instead of treating language choice as a developer-only concern. Practitioner conclusion: evaluate stack selection through control surface, not ideology.
A question worth separating out:
A: Not automatically, but compiled languages can be easier to govern when they materially reduce dependency sprawl, runtime uncertainty, and the need for bridge-layer code. The practical test is whether the chosen stack lowers the number of components that must be trusted, patched, and credentialed across the delivery lifecycle.
👉 Read our full editorial: Bare metal and compiled languages are reshaping appsec trade-offs
