Sonatype Acquires Vor Security
July 11, 2017

Sonatype has acquired Vor Security.

Ken Duck, founder and CEO of Vor will join the product and engineering team at Sonatype to continuously expand and refine the open source component intelligence service that underpins the Nexus platform.

As founder and CEO of Vor, Duck created the OSS Index, an innovative and free online index of known open source software vulnerabilities. Today, the index contains more than 2.1 million packages and detailed information on more than 120,000 vulnerabilities across an array of open source ecosystems.

Sonatype also introduced Nexus Lifecycle XC, a new data service delivered via the Nexus IQ server that will provide organizations with component intelligence covering a wide swath of open source ecosystems and formats including Ruby, PHP, Swift, CocoaPods, Golang, C, and C++.

Compared to the precisely accurate open source intelligence offered by Nexus Lifecycle for Java, JavaScript, NuGet, and PyPI -- traditional vendors of Software Composition Analysis (SCA) tools have long provided commodity open source intelligence across a broad spectrum of ecosystems.

Over time, organizations have come to value the unique accuracy of Nexus Lifecycle data for Java, JavaScript, NuGet, and PyPI; but they still require open source intelligence for a wide variety of other ecosystems. Beginning today, Sonatype is delivering a win-win intelligence engine that combines the depth of Lifecycle data for machine automated open source controls with the breadth of Lifecycle XC data for foundational open source governance.

“Empowering software development teams with broad and precise visibility into the open source supply chain is critical to practicing proper application security hygiene. Sonatype’s world-class team has led the way in bringing remarkably accurate component intelligence to the forefront of the DevOps movement, and I am excited to join forces with their amazing team and continue the journey,” said Ken Duck, CEO of Vor Security.

“Since its introduction in 2012, Nexus Lifecycle has seen tremendous acceptance in the market because it provides remarkably precise and accurate intelligence with respect to open source components across Java, JavaScript, NuGet, and PyPI. While enterprise customers, especially those practicing DevOps, place a premium value on the accuracy and precision of our Nexus Lifecycle data, they also need intelligence for a wide variety of other formats and ecosystems. The combination of Lifecycle and Lifecycle XC gives customers the best of both worlds -- a premium intelligence service that fully automates enforcement of open source policies inside of a DevOps pipeline, plus a stock data intelligence service to inform basic hygiene for all other ecosystems,” said Wayne Jackson, CEO of Sonatype.

The Latest

November 21, 2017

One overlooked opportunity for improving DEV and OPS collaboration is inviting database administrators (DBAs) to the DevOps conversation. DBAs function in a unique role where bridging the gap between development and operations occurs daily ...

November 20, 2017

DevOps must also be seen as a bottom-up process. In other words, if we consider DevOps, we must also take very serious look at "OpsDev" ...

November 16, 2017

DEVOPSdigest asked experts from across the industry for their opinions on the best way to foster collaboration between Dev and Ops. Part 7, the final installment, covers IT Operations tools ...

November 15, 2017

DEVOPSdigest asked experts from across the industry for their opinions on the best way to foster collaboration between Dev and Ops. Part 6 covers DevOps and development tools ...

November 14, 2017

DEVOPSdigest asked experts from across the industry for their opinions on the best way to foster collaboration between Dev and Ops. Part 4 covers communication ...

November 13, 2017

DEVOPSdigest asked experts from across the industry for their opinions on the best way to foster collaboration between Dev and Ops. Part 4 covers more about combining Dev and Ops in teams ...

November 09, 2017

DEVOPSdigest asked experts from across the industry for their opinions on the best way to foster collaboration between Dev and Ops. Part 3 covers how to set up teams ...

November 08, 2017

Mainframes may be legacy, but they still run a lot of business. With so much in play, businesses run a great risk when practices for maintaining and developing on mainframe remain largely the same despite the rest of the organization undergoing significant change to keep pace with the latest DevOps trends ...

November 07, 2017

DEVOPSdigest asked experts from across the industry for their opinions on the best way to foster collaboration between Dev and Ops. Part 2 covers the personal interaction between Development and Operations ...

November 06, 2017

When you say "DevOps" one of the first words that comes to mind is "collaboration." But exactly how do we make this collaboration happen? This epic DEVOPSdigest list – to be posted in 7 parts over the next few weeks – intends to find the answer. DEVOPSdigest asked experts from across the industry – including consultants, analysts, organizations, users and the leading vendors – for their opinions on the best way to foster collaboration between Dev and Ops. Part 1 offers recommendations on how to get started with collaboration ...

Share this