<iframe src="//www.googletagmanager.com/ns.html?id=GTM-KXSCJR" height="0" width="0" style="display:none;visibility:hidden">

How to mitigate vulnerabilities in production that can't be fixed immediately, featuring WhiteHat Security

Audrey Sunu | Sep 19, 2016

In a new webcast, Shift your Application Security Program into Overdrive, Michael Goldgolf of WhiteHat Security and Arpit Joshipura of Prevoty discuss the strains of time-to-remediation on vulnerability management and how to address gaps. The novel solution might surprise you.

Continue reading

Topics: Partnerships & Integrations, SAST, DAST, Runtime Application Self-Protection, Vulnerability remediation, Dynamic Application Security Testing, Static Application Security Testing, WhiteHat Security

Is the Gap Between IT and Security Professionals the Real Root Cause of Breaches?

Audrey Sunu | Jul 11, 2016

We recently released a report, The Real Root Cause of Breaches, which revealed that there is a damaging divide between general IT professionals and specialized security professionals when it comes to perception and implementation of application security in enterprises. Check out the infographic below: 

Continue reading

Topics: Application Security, Vulnerability remediation, Information Technology, Security Research

The Future of Application Security Depends On Our Infrastructure

Julien Bellanger | Jun 13, 2016

To say that the future of application security depends on our infrastructure may sound controversial -- especially coming from a runtime application security startup founder.

Don’t get me wrong. Our vision is still the same: application security has to be done at the application layer, and more so than ever, that security must be embedded in the application.

Continue reading

Topics: Application Security, RASP, Language Security, LANGSEC, AppSec, Runtime Application Self-Protection, Vulnerability remediation, Runtime Application Security, Infrastructure

The Focus Has Shifted: Application Security is in the Limelight

Arpit Joshipura | May 24, 2016

I am pleased to report that after a period of calm, the media is now buzzing with great stories on application security. These stories give great insights, statistics and actionable guidance for CISO and Security executives.

Applications have taken on an important business role, acting as the heart of companies and generating millions of dollars in revenue. But, until recently application security was not a focus. But now, we are excited to see an influx in media coverage around this extremely important topic. Here are a few of our favorites:

Continue reading

Topics: Application Security, DevOps, Vulnerability remediation, DevSecOps, SQLi, SQL Injections

Prevoty Turns Three Years Old and Gets a Web Lift

Julien Bellanger | May 9, 2016

Over the last three years, we went from brainstorming crazy ideas at a kitchen table to creating a new category for securing enterprises applications at runtime. We've captured our top 3 learnings in this blog post and have made some exciting new additions to our website. 

Continue reading

Topics: Company News, RASP, Prevoty Technology, DevOps, Language Security, LANGSEC, Runtime Application Self-Protection, Vulnerability remediation, DevSecOps, Runtime Application Security

Why Security & DevOps Can’t Be Friends (Or Can They?)

Kunal Anand | Mar 16, 2016

football.jpegLegacy applications are a brush fire waiting to happen. But retrofitting custom code built in the early 2000's is just a small part of the application security problem.

Security hasn’t changed much in the last 10 years. Companies still use pattern matching and pattern-based defenses which aren’t enough to protect websites and company data from the bad guys. Hackers continuously find unique ways to create fuzzing techniques or to perform fuzzing to create new exploits, and a lot of companies can’t run regular expressions, and most can’t use pattern matching to defeat that. 

In order to protect against cross-site scripting (XSS) or SQL injection (SQLi), why not look at application security through the lens of a web browser or a database engine? What if there was a unique way to solve these problems instead of just solving it at the perimeter? Why don't companies protect from within the application where they have access to contacts and important contextual information? Most say it's lag time, or performance issues that inhibit this kind of solution. But I’m not so sure.

Continue reading

Topics: Application Security, Legacy Apps, DevOps, Language Security, xss, LANGSEC, Pattern matching, Cross-site Scripting, Runtime Application Self-Protection, Vulnerability remediation, Agile Security, fuzzing, DevSecOps, CVE Vulnerabilities, Runtime Application Security, SQL Injections, CSRF

Why LANGSEC for Runtime Application Security? Because Patterns Can't Keep Up

Arpit Joshipura | Mar 10, 2016

Age-old security is broken because it uses antique techniques 

Throughout the past ten years, security methods have remained relatively unchanged. These methods rely solely on signatures, heuristics and dataflow analysis and are focused on defending the networks. The problem is that hackers have learned how to work around predefined network controls. 

The majority of today's firewalls still have to run thousands of patterns to match for known attacks, and false positives and false negatives run high -- making it difficult to determine what is normal. These traditional methods rely on code that is constantly changing. The thing you’re trying to detect is changing because the application itself is always changing, causing solutions to be out of date as soon as they are created.

Continue reading

Topics: WAFs, Startups, Application Security, RASP, Prevoty Technology, Application Security Monitoring, Signatures, Language Security, Innovation, LANGSEC, Heuristics, AppSec, Pattern matching, Cross-site Scripting, Command Injection, Runtime Application Self-Protection, Data Flow Analysis, Vulnerability remediation, SQL Injections, CSRF