ShiftLeft Introduces Testing to Evaluate Accuracy of Vulnerability Detection Tools
June 14, 2021

ShiftLeft has released a tool enabling businesses to independently benchmark and validate the accuracy of ShiftLeft CORE using the Open Web Application Security Project (OWASP) Benchmark Project, a Java test suite designed to evaluate the accuracy of vulnerability detection tools.

The OWASP Benchmark test suite is a sample application made up of thousands of actual instances and false positives of vulnerabilities spanning 11 categories. Evaluating a tool against the OWASP Benchmark provides a window into that tool’s ability to find vulnerabilities while reducing false-positives.

With a true-positive rate of 100% and a false-positive rate of 25%, ShiftLeft CORE is the best-in-class static application security testing (SAST) tool when it comes to OWASP Benchmark score. To help businesses easily verify these findings, ShiftLeft has built in the OWASP Benchmark as a demo app on its platform, enabling cybersecurity decision-makers to run it in just a few clicks.

“Organizations are overwhelmed with options when evaluating new cybersecurity tools. Even once you’re past initial feature comparisons, it’s time-consuming to build a proper test environment and can be difficult to replicate scores claimed by vendors,” said Alok Shukla, VP of Product Management, ShiftLeft. “We truly believe in ShiftLeft CORE’s ability to outperform the competition. That’s why we’re presenting organizations with a way to easily benchmark ShiftLeft independently.”

The ShiftLeft CORE platform is built around ShiftLeft’s NextGen Static Analysis (NG SAST), a modern code analysis solution designed to support developer workflows. Powered by ShiftLeft’s Code Property Graph (CPG) engine, ShiftLeft CORE combines many representations of source code into a single, queryable graph database to understand the full flow of information across an application or service. This adds valuable context that accurately reduces false positives while prioritizing vulnerabilities based on reachability.

Share this

Industry News

July 29, 2021

Couchbase announced the general availability of Couchbase Server 7.

July 29, 2021

Cycloid has unveiled Infra Import, a tool that automatically reverse engineers Terraform Infra-as-Code (IaC) from manually deployed infrastructure.

July 29, 2021

Launchable closed a $9.5 million Series A investment.

July 29, 2021

Rafay Systems announced automation and monitoring enhancements to its flagship Kubernetes Management Cloud (KMC).

July 28, 2021

Progress announced the R2 2021 release of Progress Telerik Test Studio, the enterprise UI test automation platform.

July 28, 2021

Synopsys announced the availability of new Rapid Scan capabilities within the company's Coverity static application security testing (SAST) and Black Duck software composition analysis (SCA) solutions.

July 28, 2021

Bitdefender announced GravityZone Security for Containers, expanding its cloud workload security (CWS) offering with run-time support for containers and Linux kernel independence.

July 28, 2021

Armory announced Armory Enterprise on AWS Quick Starts, automated reference deployments built by Amazon Web Services (AWS) solutions architects and AWS Partners.

July 27, 2021

Katalon introduced Katalon TestOps, an open and comprehensive test orchestration platform designed to help enterprises scale test automation and streamline DevOps pipelines.

July 27, 2021

Digital.ai achieved Federal Risk and Authorization Management Program (FedRAMP) “In Process” status for an Enterprise Agile Planning (EAP) tool.

July 27, 2021

Aqua Security rolls out the availability of its new Aqua Platform, with a unified console to ease the journey from scanning and visibility to workload protection in cloud native environments.

July 26, 2021

Parallel Agile announced a new version of CodeBot, a low-code MERN stack application generator.

July 26, 2021

Appian unveiled its new Appian Japan regional office.

July 26, 2021

CloudTruth raised $5.25 million in seed funding led by Glasswing Ventures and Gutbrain Ventures, with additional funding from Stage 1 Ventures and York IE.

July 22, 2021

Postman successfully obtained the System and Organization Controls (SOC) 2 Type 2 and SOC 3 Type 2 reports for the Postman API platform, meeting critical industry standards relative to the Trust Services Criteria for security, availability, and confidentiality.