Dynatrace has added a security module to its observability platform that leverages its Davis artificial intelligence (AI) engine to automatically identify the software libraries and open source packages that represent the greatest security risk.

Ajay Gandhi, vice president of product marketing for Dynatrace, said the Davis Security Advisor, made available as part of the Dynatrace Application Security Module, makes it easier for IT teams understand which vulnerabilities need to be remediated first.

Davis Security Advisor aggregates vulnerability data in real-time and prioritizes remediation based on number of vulnerabilities, severity, impact to sensitive data, public exposure, how widely known the vulnerability is, and whether the code impacted is facing the Internet. That approach enables Davis Security Advisor to monitor all software libraries used in preproduction and production environments in a way that sharply reduces the number of false positives that would otherwise be generated, noted Gandhi.

As application environments become more complex—in part due to increased adoption of microservices that have lots of dependencies—it’s become impossible for IT teams to implement DevSecOps best practices in workflows without some form of AI augmentation, added Gandhi.

In fact, a recent Dynatrace survey found 89% of chief information security officer (CISOs) noted cloud-native architectures and container runtime environments, used primarily to construct microservices, have made it more difficult to detect and manage software vulnerabilities.

In theory, application developers are taking more responsibility for remediating security vulnerabilities within their applications. The challenge is they often inadvertently use an older version of a library that has known vulnerabilities. Hopefully, that issue gets addressed before an application gets deployed. There are, however, plenty of cases where, for one reason or another, a library with known vulnerabilities gets deployed anyway.

Making matter more challenging, many vulnerabilities are discovered after an application has been deployed. Developers don’t always have access to a software bill of materials that would make it easier to determine what libraries have been employed in what application or, for that matter, which libraries are dependent upon one another.

Gandhi said the Davis Security Advisor resolves that issue by employing machine learning algorithms, trained by Dynatrace, to identify those potential security issues. Once identified, the updates that need to be made can then be slipstreamed into a DevOps workflow.

Analyzing code for vulnerabilities is, of course, not a new idea. Training an AI model to perform that task on behalf of DevOps teams does promise to greatly accelerate the process at a time when organizations are under more pressure than ever to secure their software supply chains in the wake of a series of high-profile breaches.

It’s just not clear yet who inside organizations might drive adoption for AI platforms capable of identifying vulnerabilities in a way that helps prioritize remediation efforts. In some cases, cybersecurity teams have a vested interest in reducing the number of potential security incidents.

The one thing that is apparent is shipping insecure code faster only leads to more negative outcomes. There may not be such a thing as a ‘great’ application that happens to be insecure. Instead, the assumption will be that any application with known vulnerabilities, no matter how great, are too flawed to be deployed given all the security risks most businesses currently face.

Software intelligence company Dynatrace announced the findings of an independent global survey of 700 CISOs, which reveals the rising adoption of cloud-native architectures, DevOps, and agile methodologies has broken traditional approaches to application security. As organizations shift more responsibility “left” to developers to accelerate innovation, increasingly complex IT ecosystems and outdated security tooling can slow releases by leaving blind spots and forcing teams to manually triage countless alerts, many of which are false positives reflecting vulnerabilities in libraries that are not used in production. Organizations are calling for a new approach that is optimized for multicloud environments, Kubernetes, and DevSecOps

This research reveals:

89% of CISOs say microservices, containers, and Kubernetes have created application security blind spots.
97% of organizations do not have real-time visibility into runtime vulnerabilities in containerized production environments.
Nearly two-thirds (63%) of CISOs say DevOps and Agile development have made it more difficult to detect and manage software vulnerabilities.
74% of CISOs say traditional security controls such as vulnerability scanners no longer fit today’s cloud-native world.
71% of CISOs admit they are not fully confident code is free of vulnerabilities before going live in production.
“The increased use of cloud-native architectures has fundamentally broken traditional approaches to application security,” said Bernd Greifeneder, Founder and Chief Technology Officer at Dynatrace. “This research confirms what we’ve long anticipated: manual vulnerability scans and impact assessments are no longer able to keep up with the pace of change in today’s dynamic cloud environments and rapid innovation cycles. Risk assessment has become nearly impossible due to the growing number of internal and external service dependencies, runtime dynamics, continuous delivery, and polyglot software development which uses an ever-growing number of third-party technologies. Already stretched teams are forced to choose between speed and security, exposing their organizations to unnecessary risk.”

Additional findings include:

On average, organizations need to react to 2,169 new alerts of potential application security vulnerabilities each month.
77% of CISOs say most security alerts and vulnerabilities are false positives that do not require actioning as they are not actual exposures.
68% of CISOs say the volume of alerts makes it very difficult to prioritize vulnerabilities based on risk and impact.
64% of CISOs say developers do not always have time to resolve vulnerabilities before code moves into production.
77% of CISOs say the only way for security to keep up with modern cloud-native application environments is to replace manual deployment, configuration, and management with automated approaches.
28% of CISOs say application teams sometimes bypass vulnerability scans to speed up software delivery.
“As organizations embrace DevSecOps, they also need to give their teams solutions that offer automatic, continuous, and real-time risk and impact analysis for every vulnerability, across both pre-production and production environments, and not based on point-in-time ‘snapshots’,” continued Greifeneder.

The report is based on a global survey of 700 CISOs in large enterprises with over 1,000 employees, conducted by Coleman Parkes and commissioned by Dynatrace in 2021. The sample included 200 respondents in the U.S., 100 in the UK, France, Germany, and Spain, and 50 in Brazil and Mexico, respectively.

Most vulnerabilities are from mistakes, not malicious attacks
Security vulnerabilities can often go undetected for over four years before they are disclosed, according to the latest 2020 Security report by GitHub.

As per the report, vulnerabilities can often not be detected for more than for years. Once they are disclosed, developers may take over four weeks to fix these vulnerabilities.

Once they are identified, the package maintainer and security community typically create and release a fix in just over four weeks. This highlights the opportunities to improve vulnerability detection in the security community,” the report said.

However, the majority of vulnerabilities arise from mistakes and not malicious attacks.

“Most vulnerabilities are from mistakes, not malicious attacks: While malicious attacks are more likely to get attention in security circles, 83 per cent of the CVEs that GitHub sends alerts for are due to mistakes rather than malicious intent,” as per the report.

Active repositories with a supported package ecosystem have a 59 per cent higher chance of getting a security alert in the next 12 months.

Software packages based on Ruby (81 per cent) and JavaScript (73 per cent) are most likely to receive an alert in the last 12 months.

Apart from this, the report also states that 94 per cent of projects rely on open source components. These have approximately 700 dependencies. This makes the projects more vulnerable in terms of security.

“Most projects on GitHub rely on open-source software. We see the most frequent use of open source dependencies in JavaScript (94 per cent), Ruby (90 per cent), and .NET (90 per cent). A repository can have hundreds of dependencies, so when there’s a problem with security in the supply chain, you see a massive ripple effect,” the report added.

Automation can help improve security and provide a security patch for vulnerabilities faster, as per the report.