JFrog announced a new machine learning (ML) lifecycle integration between JFrog Artifactory and MLflow, an open source software platform originally developed by Databricks.
Veracode announced its Continuous Software Security Platform, which seamlessly embeds application security into the software development lifecycle (SDLC).
The platform streamlines workflows by bringing together development and security teams to provide a broad understanding of risk, remediation guidance, and progress at every stage of the development process.
According to Veracode’s latest research, there has been a 20x increase in average scan cadence over the past decade, with most applications tested three times per week, as opposed to three times per year a decade ago. The research also showed a 31 percent increase in organizations using multiple scan types over the last three years alone.
Today, leading organizations recognize the need to leverage multiple methods to assess their software and do so across all stages of the development lifecycle. Gartner® predicts that “by 2025, 70% of organizations will consolidate the number of vendors securing the lifecycle of cloud-native applications to a maximum of three vendors.” ¹ This suggests companies are already looking for a comprehensive platform that provides flexible policy management, a holistic assessment of software risk, and integrated remediation guidance, while simplifying the complexity of managing multiple solutions.
With increased pressure to build and deploy software at breakneck speed, development teams require security checks to be seamlessly integrated into the tools where they work so they can find and fix vulnerabilities quickly. Meanwhile, security teams must meet increasingly stringent compliance standards defined by their boards and regulatory bodies. Veracode’s Continuous Software Security Platform is pervasive but not invasive because it provides a frictionless experience for developers by embedding vulnerability analysis with remediation guidance directly into the integrated development environment.
Brian Roche, Chief Product Officer at Veracode, said, “Other vendors in our space have incomplete or disjointed solutions that lack consistent reporting and analysis, leaving customers playing a game of ‘whack a mole’ across different tools. We have continued to evolve our platform to create a seamless and integrated experience for developers, as well as provide security teams with a holistic view of their software security posture from design, through development and deployment. We see this as a win for both development and security teams that will result in the delivery of software that is more secure.”
Veracode Continuous Software Security Platform
The Veracode Continuous Software Security Platform enables users to define and manage security policy, gain a comprehensive view of software security across their application portfolio, and leverage rich analytics to make informed plans, communicate metrics, comply with policy, and meet regulatory requirements. Powered by almost two decades of data, the platform enables organizations to detect, predict, manage, and, ultimately, mitigate their security risk. These intelligent capabilities empower companies to deliver secure code at the speed and scale expected in today’s world.
The new Veracode Continuous Software Security Platform release features several new capabilities including:
- Single-Pane-of-Glass Reporting: Security teams can now access unified reporting directly in the portal for Static Analysis, Dynamic Analysis, Software Composition Analysis, and Manual Penetration Testing. Administrators and developers now have a consolidated view into security risks, as well as flexible policy controls through stronger license management reports to address issues quickly.
- Self-Service Peer Benchmarking: With comprehensive data and anonymized insights across all platform users, customers now have direct access to reports on the portal, which enable them to easily benchmark their DevSecOps program results against others in their industry. Tapping into many years of data and learning, customers can see how their program metrics stack up and establish plans to address their risk.
- Software Bill of Materials (SBOM): Security teams can now generate and export SBOMs on demand with an integrated representational state transfer (REST) API. This returns data for a specific application in CycloneDX SBOM format—a standard designed for use in application security contexts and supply chain component analysis. Additionally, data from the API can be mined and transformed outside of the Veracode Platform.
- Intelligent Remediation: The Continuous Software Security Platform will leverage technology acquired from Jaroona to detect and remediate software vulnerabilities through machine learning. Jaroona, which was recognized by Gartner Research as a “Cool Vendor” in 2021, outperforms traditional approaches by 7x to 10x in terms of accuracy, false negatives, and false positive rates, and reduces the burden on technical resources.
Industry News
Copado announced the general availability of Test Copilot, the AI-powered test creation assistant.
SmartBear has added no-code test automation powered by GenAI to its Zephyr Scale, the solution that delivers scalable, performant test management inside Jira.
Opsera announced that two new patents have been issued for its Unified DevOps Platform, now totaling nine patents issued for the cloud-native DevOps Platform.
mabl announced the addition of mobile application testing to its platform.
Spectro Cloud announced the achievement of a new Amazon Web Services (AWS) Competency designation.
GitLab announced the general availability of GitLab Duo Chat.
SmartBear announced a new version of its API design and documentation tool, SwaggerHub, integrating Stoplight’s API open source tools.
Red Hat announced updates to Red Hat Trusted Software Supply Chain.
Tricentis announced the latest update to the company’s AI offerings with the launch of Tricentis Copilot, a suite of solutions leveraging generative AI to enhance productivity throughout the entire testing lifecycle.
CIQ launched fully supported, upstream stable kernels for Rocky Linux via the CIQ Enterprise Linux Platform, providing enhanced performance, hardware compatibility and security.
Redgate launched an enterprise version of its database monitoring tool, providing a range of new features to address the challenges of scale and complexity faced by larger organizations.
Snyk announced the expansion of its current partnership with Google Cloud to advance secure code generated by Google Cloud’s generative-AI-powered collaborator service, Gemini Code Assist.
Kong announced the commercial availability of Kong Konnect Dedicated Cloud Gateways on Amazon Web Services (AWS).
Pegasystems announced the general availability of Pega Infinity ’24.1™.