This article draws on a March 2020 announcement from ZeroNorth, originally published on Security Boulevard, covering the company’s Series A+ funding round and its approach to DevSecOps vulnerability management.
The DevOps Security Problem Is Getting Harder to Ignore
Software teams are shipping faster than ever, but security programs have struggled to keep pace. Two compounding pressures make this particularly acute in the United States: a widening cybersecurity workforce gap and an explosion in the number of scanning tools, pipelines, and environments that security teams must cover simultaneously.
The House Science, Space, and Technology Committee has cited chronic vacancy rates in cybersecurity roles, meaning organisations must defend broader attack surfaces with proportionally fewer specialists. For DevOps teams, the practical consequence is that vulnerability backlogs grow faster than they can be triaged, prioritised, or remediated.
What Is Risk-Based Vulnerability Orchestration?
Traditional application security programs tend to operate in silos. Static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and infrastructure scanning tools each produce their own findings in their own formats. Security engineers are left manually correlating results, deduplicating overlapping findings, and guessing at priority — a process that does not scale as application portfolios grow.
Risk-based vulnerability orchestration addresses this by sitting above the individual scanning tools and providing a unified control plane. The key capabilities typically include:
- Aggregation: Pulling findings from multiple scanning tools — commercial, open-source, and custom — into a single data model.
- Deduplication and correlation: Identifying when different tools have flagged the same underlying vulnerability, reducing noise in the findings backlog.
- Contextualised risk scoring: Enriching raw vulnerability data with business context (asset criticality, exposure, exploitability) so that teams fix what matters most, not just what scored highest in a CVE database.
- Workflow integration: Pushing prioritised findings into the tools developers already use — ticketing systems, CI/CD pipelines, and IDE plugins — so remediation happens as close to the code as possible.
- Continuous measurement: Tracking risk posture over time so security leaders can demonstrate progress and identify systemic weaknesses in the SDLC.
Why Orchestration Matters for DevSecOps
The promise of DevSecOps is that security becomes a shared responsibility woven into every phase of the software development lifecycle, rather than a gate at the end of it. In practice, achieving this requires more than telling developers to “shift left.” It requires giving them accurate, actionable, and prioritised information at the right point in their workflow.
Orchestration platforms attempt to close this gap by:
- Reducing the volume of findings developers receive to only those that represent genuine, prioritised risk — limiting alert fatigue.
- Automating the manual triage work that would otherwise fall to already-stretched security teams.
- Providing a shared view of risk that dev, ops, and security teams can all work from, improving cross-team alignment.
- Enabling security teams to enforce policy consistently across many different scanning tools and pipeline configurations without requiring custom integrations for each combination.
ZeroNorth’s Approach and Funding Context (March 2020)
ZeroNorth was one of the vendors working in this orchestration space. In March 2020, the company announced a $10 million Series A+ funding round led by Crosslink Capital, with participation from existing investors ClearSky, Rally Ventures, and Petrillo Capital. The funding was intended to accelerate growth across engineering, customer support, and sales functions.
At the time of the announcement, ZeroNorth reported more than 300% growth in annual recurring revenue and a doubling of its customer base. Customers cited in the announcement included Raytheon, Bidpath, and Zerto. The company was also recognised by CRN as one of the “Hot Cybersecurity Startups You Need to Know About” at that year’s RSA Conference.
Matt Bigge, a partner at Crosslink Capital with prior investments in companies including CloudShield, Narus, and ArcSight, joined the ZeroNorth board of directors as part of the round.
Key Takeaways for DevOps and Security Engineers
Whether or not any specific vendor’s platform is right for a given organisation, the problem space ZeroNorth was addressing reflects genuine and persistent challenges in modern DevSecOps programs. Engineers evaluating their own security toolchain should consider:
- Tool sprawl is a risk in itself. Running multiple scanners without a unified view of results can create false confidence and make it harder — not easier — to understand your actual exposure.
- Prioritisation is not optional at scale. When hundreds or thousands of findings are generated per sprint, some mechanism for contextualised risk scoring is essential to avoid overwhelming development teams.
- Metrics drive improvement. Security programs that cannot measure risk posture over time cannot demonstrate progress or build the organisational credibility needed to sustain investment.
- Integration with developer workflows determines adoption. Security findings that reach developers through the tools they already use — Jira, GitHub, Jenkins, and similar — are far more likely to be acted on than findings buried in a separate security portal.
Further Reading
For more background on the DevSecOps landscape and vulnerability management approaches, the original announcement was published on Security Boulevard. NIST’s National Vulnerability Database and OWASP’s published guidance on application security verification remain useful reference points for teams building or evaluating security programs.