A New Approach To Prioritization
In the race to produce code, security can sometimes seem like a bit of a speedbump. Engineering teams face tight deadlines and security teams want to ensure the code doesn’t ship with vulnerabilities that could lead to the next big breach. At Qwiet AI, we’ve found that even highly accurate scans and reachability details can still leave organizations wondering which fixes to prioritize that will maximize risk reduction and minimize tech debt. That is why we’ve introduced Blacklight to the preZero platform.
A Threat Feed for Application Security
Threat feeds are valuable parts of any security organization’s arsenal, pulling information from various sources such as telemetry from network security tools, honeypots, scanning and crawling forums and open source repositories, human intelligence and others to provide timely information on the latest security threats. Qwiet AI’s preZero platform is the first in the industry to fully integrate a security threat feed into real time security analysis of code. Organizations can now see what exploits are out in the wild taking advantage of vulnerabilities preZero has found in their code, allowing for easier prioritization of fixes.
Utilizing EPSS to Determine Exploitability
Ranging from 0 to 1 (representing 0% to 100%) the Exploit Prediction Scoring System (EPSS) is an open model that utilizes machine learning to predict how likely a CVE is to be exploited in the wild. This data is pulled from various public and private sources, including real world information from SIEM tools. This helps Qwiet AI customers understand the severity of a vulnerability in a way that a simple enumeration of CVSS and CVEs alone does not.
Blacklight Qwiets the Noise Around Fixes
One of the biggest issues organizations face is one of prioritization. Now with Blacklight, Qwiet AI customers will have another tool at their disposal to help prioritize the issues found during a scan. When playing the balancing act between time to market and security, knowing which vulnerabilities pose a real and existing threat can help focus engineering efforts on the fixes that will have the biggest impact and provide the largest reduction in risk.
Blacklight is just another way Qwiet AI is helping our customers reduce the noise generated by false positives and focus on what’s important: releasing secure code without increasing tech debt.
