A New Approach To Prioritization

In the race to produce code, security can sometimes seem like a bit of a speedbump. Engineering teams face tight deadlines and security teams want to ensure the code doesn’t ship with vulnerabilities that could lead to the next big breach.  At Qwiet AI, we’ve found that even highly accurate scans and reachability details can still leave organizations wondering which fixes to prioritize that will maximize risk reduction and minimize tech debt. That is why we’ve introduced Blacklight to the preZero platform.

A Threat Feed for Application Security

Threat feeds are valuable parts of any security organization’s arsenal, pulling information from various sources such as telemetry from network security tools, honeypots, scanning and crawling forums and open source repositories, human intelligence and others to provide timely information on the latest security threats. Qwiet AI’s preZero platform is the first in the industry to fully integrate a security threat feed into real time security analysis of code. Organizations can now see what exploits are out in the wild taking advantage of vulnerabilities preZero has found in their code, allowing for easier prioritization of fixes.

Utilizing EPSS to Determine Exploitability

Ranging from 0 to 1 (representing 0% to 100%) the Exploit Prediction Scoring System (EPSS) is an open model that utilizes machine learning to predict how likely a CVE is to be exploited in the wild. This data is pulled from various public and private sources, including real world information from SIEM tools. This helps Qwiet AI customers understand the severity of a vulnerability in a way that a simple enumeration of CVSS and CVEs alone does not.

Blacklight Qwiets the Noise Around Fixes

One of the biggest issues organizations face is one of prioritization. Now with Blacklight, Qwiet AI customers will have another tool at their disposal to help prioritize the issues found during a scan. When playing the balancing act between time to market and security, knowing which vulnerabilities pose a real and existing threat can help focus engineering efforts on the fixes that will have the biggest impact and provide the largest reduction in risk.

Blacklight is just another way Qwiet AI is helping our customers reduce the noise generated by false positives and focus on what’s important: releasing secure code without increasing tech debt.

About ShiftLeft

ShiftLeft empowers developers and AppSec teams to dramatically reduce risk by quickly finding and fixing the vulnerabilities most likely to reach their applications and ignoring reported vulnerabilities that pose little risk. Industry-leading accuracy allows developers to focus on security fixes that matter and improve code velocity while enabling AppSec engineers to shift security left.

A unified code security platform, ShiftLeft CORE scans for attack context across custom code, APIs, OSS, containers, internal microservices, and first-party business logic by combining results of the company’s and Intelligent Software Composition Analysis (SCA). Using its unique graph database that combines code attributes and analyzes actual attack paths based on real application architecture, ShiftLeft then provides detailed guidance on risk remediation within existing development workflows and tooling. Teams that use ShiftLeft ship more secure code, faster. Backed by SYN Ventures, Bain Capital Ventures, Blackstone, Mayfield, Thomvest Ventures, and SineWave Ventures, ShiftLeft is based in Santa Clara, California. For information, visit: www.shiftleft.io.


See for yourself – run a scan on your code right now