Remediating at the speed of AI #AppSec #DevSecOps #ASPM #AppSecPipeline
Joined August 2016
- Tweets143
- Following20
- Followers714
- Likes12
eMudhra and PHP2Shell: two major vulnerabilities in one day. One of them presented exposure for us. Today we're announcing Early Light, free and open source, so you can find them too 🧵
ALT Incident log receipt with a PATCHED SAME NIGHT stamp. eMudhra on Oct 20: response starts 6:06 PM, first fix merged 6:35 PM, 27 repos fixed and tested 8:16 PM, 3.4.201 released 10:30 PM. PHP2Shell on Oct 21: PHP emergency release 8:00 AM, Early Light v0.2.0 at 1:07 PM, 3.4.202 released 6:56 PM. Headline: eMudhra. PHP2Shell. Meet Early Light.
Detectors for eMudhra and PHP2Shell are both live. Scan images, hosts, servers and the images your repo deploys. SARIF goes straight into DefectDojo. BSD 3-Clause.
Our goal: the fastest detection in security every time a new vulnerability drops. For DefectDojo Pro, Sensei finds and fixes both as of 3.4.202. Next goal: a fix within 2 hours of a new vuln dropping. Fight AI with AI.
github.com/DefectDojo/earlyl…
Backlog = 0 is the goal. Every new scan pushes the number the other way.
Sensei pushes it back: it writes the fix and opens the pull request for your team to review.
1,000 free Sensei fixes through Nov 30.
Read the post: bit.ly/4yubPS9
🚀 DefectDojo v3.4.200 is out.
New StackHawk and Qualys TotalAppSec connectors. In-app walkthroughs come to every Pro UI page. A new Triage Engine trigger handles dedupe matches in other Assets.
Full changelog: bit.ly/4ywA7Lw
Your developers got an AI pair programmer. Your security team got a longer findings queue.
Sensei opens the fix pull requests. You review and merge. 1,000 free fixes through Nov 13.
Fight AI with AI.
Read the post: bit.ly/4em3gBH
A finding tells you something is wrong. Context tells you what to do about it.
What's affected, whether it's exploitable, how much the Asset matters, who owns the fix. DefectDojo Pro puts that context on every Finding.
Read the post: bit.ly/4ybMDzS
Security hasn't gotten easier. More AI-written code, more zero-days, smaller budgets, pricier tools.
This Cybersecurity Awareness Month, everyone gets 1,000 free Sensei fixes through Nov 13.
Less lip service, more fixes.
Read the post: bit.ly/4em3gBH
ALT 1,000 free Sensei fixes for Cybersecurity Awareness Month, through November 13.
🚀 DefectDojo v3.4.100 is out.
Global Search (Cmd/Ctrl+K) now finds records and jumps to any page. Wiz and Security Hub findings map to compliance requirements. Findings show the date a CVE was added to CISA KEV.
Full changelog: bit.ly/4yIp1nt
You're being misled about Mythos.
@AnthropicAI has given DefectDojo access to Claude Mythos, and our CEO spent a week with it. His take on what everyone gets wrong about it: 🧵
ALT Blog cover with the title You're Being Misled About Mythos, in cream text on a teal card tilted over a dark teal graph-paper grid, with the label AI.
"For most of my career the asymmetry ran one way. Mythos-class capability in vetted defenders' hands flips that. Bugs get found and fixed before anyone gets to sell them or use them."
Fight AI with AI.
Full post: defectdojo.com/blog/youre-be…
"For most of my career the asymmetry ran one way. Mythos-class capability in vetted defenders' hands flips that. Bugs get found before they're sold. The hole gets closed before anyone gets to use it."
Get the backlog to zero before an AI gets a chance to exploit it. Full post: defectdojo.com/blog/the-myth…