This article is based on a press announcement originally published February 19, 2020, sourced from finance.yahoo.com, covering ZeroNorth’s participation at RSA Conference 2020 (February 24–28, San Francisco, CA).
Background: The DevSecOps Gap ZeroNorth Aimed to Close
As DevOps practices matured throughout the late 2010s, one persistent challenge remained: security teams and development teams were operating in separate silos, using different tools, speaking different languages, and working at different velocities. ZeroNorth positioned itself as a solution to this gap by offering what it described as risk-based vulnerability orchestration — a platform designed to aggregate, correlate, and prioritize security findings across an organization’s entire application and infrastructure portfolio.
At RSA Conference 2020, one of the security industry’s flagship annual events, ZeroNorth used booth #5360 in Expo Hall North to demonstrate its platform capabilities to DevOps engineers, security practitioners, and technology leaders.
“Since software has become such an integral part of our daily lives, the importance of strong software security cannot be overstated. Software powers cars and airplanes, is responsible for personal financial and healthcare information, plays a number of different roles in the political process and elections, and much more — so it better be secure. As DevOps culture continues to take hold, it has never been more important to make sure security and development teams work closely. And as shifting realities push them apart, ZeroNorth is bringing them back together.”
— John Worrall, CEO, ZeroNorth
Core Platform Capabilities Demonstrated at RSA 2020
ZeroNorth highlighted four key areas of platform functionality during the conference. Each addresses a distinct pain point in enterprise application security programs.
1. Rapid AppSec and Open Source Tooling
One common barrier to launching an application security (AppSec) program is the time and cost involved in procuring, configuring, and integrating scanning tools. ZeroNorth addressed this by embedding open source scanning tools directly within its platform. This approach allows organizations to start running security scans against their applications and infrastructure quickly, without the overhead of standing up and maintaining individual tools independently.
For DevOps teams, this matters because it lowers the activation energy required to introduce security into a CI/CD pipeline — a foundational step in any shift-left strategy.
2. Vulnerability Ingestion, Correlation, and Compression
A significant operational problem in enterprise security programs is alert fatigue and duplicated effort. Multiple scanning tools — SAST, DAST, SCA, and infrastructure scanners — often flag the same underlying vulnerability in different ways, generating thousands of redundant findings that overwhelm development backlogs.
ZeroNorth’s platform ingested findings from disparate tools and correlated them to eliminate duplication. Related issues were compressed into a single “unit of work” — a developer-facing ticket or task representing one underlying problem, regardless of how many tools reported it. This directly reduces remediation burden and makes it practical for developers to act on security findings without context-switching across multiple systems.
3. Target Discovery and Application Asset Mapping
Before an organization can govern its security posture, it needs to know what it has. Shadow IT, sprawling microservices architectures, and rapidly changing cloud infrastructure make maintaining an accurate asset inventory genuinely difficult.
ZeroNorth’s target discovery capability was designed to identify the scope of an organization’s technology assets — including applications, services, and infrastructure components — and map them into a coherent view. From there, assets could be grouped and aligned to business risk factors, enabling security and engineering leadership to apply appropriate governance based on the actual risk profile of each system rather than treating everything uniformly.
4. Software-Defined Security Governance
Governance in AppSec programs has traditionally relied on manual review processes, periodic audits, and spreadsheet-based reporting — none of which scale alongside modern software delivery pipelines. ZeroNorth’s platform allowed organizations to define toolsets, security gates, and policies programmatically, embedding governance decisions into the delivery pipeline itself.
Key outcomes of this approach included:
- Frictionless communication between security and development teams, with shared visibility into risk status
- Automated policy enforcement via security gates that can block or flag builds based on defined thresholds
- Consistent reporting that provides leadership with a coherent, auditable picture of organizational risk over time
The TCO Calculator: Quantifying the Cost of Vulnerability Programs
In addition to platform demos, ZeroNorth introduced a Total Cost of Ownership (TCO) calculator at RSA 2020. The tool was designed to help security and engineering leaders estimate the true operational cost of their existing vulnerability discovery programs — factoring in not just tool licensing, but the hidden costs of manual triage, duplicate effort, and developer time spent on remediation workflows.
This kind of cost-visibility tooling is increasingly relevant to DevOps teams making the business case for security investment. Framing security as an operational efficiency problem — rather than purely a compliance or risk concern — tends to resonate more effectively with engineering and finance stakeholders.
Why This Matters for DevOps Practitioners
The themes ZeroNorth emphasized at RSA 2020 reflect broader industry trends that remain relevant today:
- Tool sprawl is a real problem. Most organizations run multiple security scanning tools that produce overlapping, inconsistent results. Orchestration and correlation layers reduce noise and make findings actionable.
- Developers need context, not just alerts. Compressing findings into unified units of work and routing them through familiar developer tooling (issue trackers, CI pipelines) increases fix rates.
- Security governance must be automated to scale. Manually reviewing security findings at the cadence of modern CI/CD pipelines is not feasible. Policy-as-code and automated gates are prerequisites for mature DevSecOps.
- Asset visibility precedes risk management. You cannot prioritize what you cannot see. Discovery and mapping capabilities are foundational to any serious AppSec program.
About ZeroNorth
At the time of this announcement, ZeroNorth described itself as the first provider of risk-based vulnerability orchestration for applications and infrastructure. The company focused on helping enterprises unify their security tooling, reduce remediation overhead, and integrate security governance into DevOps workflows. ZeroNorth was later acquired by Devo Technology in 2021.
Note: This article is based on a February 2020 press release. Product capabilities, company structure, and market positioning may have changed significantly since publication.