7 utility safety startups at RSAC 2024

The innovation hub of RSAC 2024, the RSAC Early Stage Expo was particularly designed to showcase rising gamers within the info safety trade. Among the many 50 exhibitors crammed into the second ground sales space area, seven VC-backed up-and-comers in utility safety and devsecops caught our eye.

AppSentinels

AppSentinels touts itself as a complete API safety platform, masking the complete utility life cycle. The product conducts thorough analyses of the appliance’s actions and examines its workflows intimately. As soon as the AppSentinals product understands the workflows, it may well check the workflows in opposition to a wide range of potential flaws, and use this info to additionally shield in opposition to advanced enterprise logic assaults in manufacturing environments.

AppSentinels stated its group has developed intricate fashions able to understanding the performance of every of your organization’s purposes, in addition to the interior workflows and processes, to bolster their safety. Armed with this understanding of profitable course of workflows, AppSentinels can thwart potential assaults. The product makes use of a number of AI fashions together with graph logic fashions, unsupervised clustering fashions, and state area fashions to fortify each the workflow and the purposes themselves.

Endor Labs

Endor Labs operates as a software program provide chain safety firm, with a main deal with enhancing developer productiveness. The corporate goals to streamline the developer’s workflow, saving each money and time by prioritizing alerts and vulnerabilities successfully. Not like different instruments that inundate builders with false positives, resulting in fatigue, Endor Labs strives to supply clear steering on what points to handle first and facilitate swift decision.

Endor Labs employs reachability evaluation to know the features known as by packages and their dependencies, tracing the complete name path to establish particular dependencies utilized by completely different variations of a package deal. Moreover, Endor Labs assesses if a bit of code with a vulnerability is actively used within the utility, providing correct insights past what’s merely declared within the manifest file.

Whereas some safety instruments deal with vulnerabilities listed within the manifest file, Endor Labs takes a unique strategy by conducting program evaluation to determine name graphs and establish statically developed code because the supply of fact. By prioritizing the dependencies actively utilized by the appliance, Endor Labs goals to supply a extra correct evaluation of vulnerabilities current within the developed code.

Along with treating all parts as dependencies, Endor Labs extends this strategy to CI/CD processes, providing visibility into instruments utilized within the pipeline. This helps builders establish sanctioned and unsanctioned instruments, making certain higher safety compliance. Furthermore, Endor Labs evaluates the posture of repositories throughout the CI/CD pipeline and helps the signing of artifacts for compliance attestations, additional enhancing safety measures.

Lineaje

Lineaje goals to supply complete software program provide chain safety administration, pushed by founders with experience in endpoint and runtime software program growth. Stemming from considerations over incidents such because the SolarWinds hack and the XZ Utils backdoor, Lineaje was conceived to handle vulnerabilities inside software program chains and construct pipelines, areas usually inaccessible to runtime software program. 

Lineaje’s unified platform can dissect any object—be it supply code, package deal, or container—to unveil its part construction or dependency tree and topic it to evaluation utilizing a wide range of scanners, together with each open supply and Lineaje’s proprietary ones. It then aggregates this knowledge and employs an AI module to scrutinize it. Lineaje operates not solely throughout the inside CI/CD pipeline but additionally extends to the consumption of open-source parts sourced from exterior CI/CD pipelines. 

One alarming discovery by Lineaje is that roughly 56% of vulnerabilities within the open-source ecosystem stay unaddressed. Usually, builders unwittingly introduce outdated or deserted open-source parts into their pipelines, leading to a cascade of vulnerabilities. Lineaje’s depth in discovering dependencies past the package deal stage—uncovering implicit dependencies—is essential. This functionality allows Lineaje to conduct thorough scanning and evaluation of open supply parts. 

For every part recognized, Lineaje employs fingerprint-based verification to hint its origin and validate its authenticity, making certain that the part originates from a good supply repository to a selected commit ID. Lineaje critiques the complete lineage to detect potential upstream tampering, then makes use of fingerprint-based attestation to map software program integrity ranges, gauging tamperability dangers. 

This meticulous course of generates a complete SBOM (software program invoice of supplies) and knowledge repository simply accessible through Lineaje’s querying capabilities. Queries may be remodeled into insurance policies, prioritizing actions, aided by Lineaje’s AI module, which assists in planning the corporate’s subsequent launch, whereas concurrently decreasing vulnerabilities.

Myrror Safety

Myrror Safety focuses on detecting software program provide chain assaults. It conducts a radical comparability between binary code and its corresponding supply code, aiming to establish any discrepancies, as ideally there ought to be none within the binary model prepared for manufacturing deployment. This strategy might have prevented incidents such because the SolarWinds and XZ Utils assaults, Myrror representatives stated.

Myrror analyzes the supply code and compares it with the binary model, utilizing a software program invoice of supplies generated from the supply. This course of helps establish vulnerabilities throughout the SBOM, enabling the evaluation of assault reachability and potential threats to the code base. Whereas Myrror acknowledges the significance of software program composition evaluation (SCA) and SBOM, its main focus stays on detecting and stopping malicious code and assaults.

Scribe Safety

Scribe Safety gives a software program provide chain safety platform, leveraging attestation-based expertise (SBOM at each stage of the event course of) to detect and forestall tampering whereas offering signed proof for compliance assurance. Deployed throughout the complete software program growth life cycle (SDLC), Scribe captures complete proof of all code-related actions. This info is then synthesized right into a data graph, providing insights into product, pipeline, and course of dynamics. Clients can successfully handle danger and belief utilizing Scribe’s analytics, which allow automated danger mitigation throughout the SDLC framework.

Seal Safety

Seal Safety focuses on open-source vulnerability patching. Nonetheless, as an alternative of getting builders chase software program updates to remediate the vulnerabilities, Seal takes the newest safety patches and makes them backwards appropriate with all beforehand affected variations of the library, making these stand-alone patches available to builders to devour as a part of the construct course of. This streamlines the patching course of for builders and utility safety groups, as engineers can now mechanically deal with vulnerabilities in the course of the construct course of. Consequently, the time usually spent coordinating between these groups is considerably decreased.

Tromzo

Tromzo focuses on accelerating remediation, integrating with safety scanners, vulnerability scanners, cloud platforms, and code repositories to put out a single supply of fact for all of the vulnerabilities you might have in your enterprise. As a result of Tromzo aggregates and correlates all that knowledge, they know all of the completely different belongings that you’ve got—repos, software program dependencies, SBOMs, containers, microservices, and so forth.—and who owns them. Thus, when Tromzo appears on the vulnerabilities, it may well assist deduce which of them have extra danger (together with buyer enter to the danger, based mostly on whether or not it’s a business-critical utility, or probably has delicate or personally identifiable info), which supplies Tromzo a danger view of the complete software program provide chain. From there Tromzo automates the triage to repair the riskiest vulnerabilities first.