BRADENTON, Fla., May 29, 2024 -- NightVision, an application security (AppSec) innovator, today launched a new software testing and security solution that enables developers to identify, locate, and remediate exploitable vulnerabilities throughout the software development lifecycle (SDLC). Software developers can set up and run scans within minutes for the first time and receive intelligence on critical vulnerabilities and where they reside.
NightVision's modern gray-box security testing approach is an industry breakthrough designed to remediate software vulnerabilities long before production to reduce development costs, bolster security and resiliency, and ease the burdens on developer and security teams.
"For years, we have failed to provide software developers with testing tools to perform quickly and accurately. The shortcomings of the AppSec market have put us in the software insecurity predicament we find ourselves in today," said George Prince, CEO of NightVision. "The Secure By Design movement has popularized the concept of making the default route during the SDLC secure by providing safe building blocks for developers. The foundation of these secure defaults should be dynamic testing, prioritizing the risks that are actually exploitable in an application. Our focus is simple: Provide quick and easy guardrails for developers to identify and remediate critical vulnerabilities so they can continue to ship new products and features."
The two leading legacy testing technologies – Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST) have frustrated users for various reasons. They generate an unmanageable number of false positives, require time-intensive custom coding to launch, and take hours to scan. Moreover, legacy DAST tools fail to test more than 70% of endpoints in application programming interfaces (API), often making their tests pointless.
"We won an award at our company's internal hackathon for demonstrating the ability for developer teams to execute a DAST scan on a web app in eight minutes from start to finish during build time, with tickets for findings opened automatically with Engineering," said Steve McKinnon, senior application security engineer at BeyondTrust. "This was a great testament to NightVision's speed and effectiveness."
"When I heard a prominent tech company used NightVision to migrate from a manual two-plus hour application testing process to one that was automatically completed in eight minutes, I had to give it a try," said Michael Salvidio, senior software engineer at Ineo, LLC. "After about 30 minutes of onboarding, we were scanning our public-facing APIs and our local host dev environment. We set up an Azure DevOps CI/CD branch, which initiated a scan against our project and got the results back in under 10 minutes. All in all, a very good experience."
The NightVision AppSec solution simulates attacks to see what is actually exploitable and traces findings back to code. Key product capabilities include:
- API Identification: In real environments of fast-moving development teams, comprehensive API documentation is often absent. NightVision automatically generates detailed documentation of existing APIs to scan undocumented or under-documented APIs, making testing more accurate and comprehensive than previously possible.
- Shadow API discovery: When analyzing code before simulating attacks, shadow APIs can be uncovered via source code analysis that was not meant to be introduced to production. NightVision can discover and test these Shadow APIs that are often ungoverned, perform higher privileged functions, and previously have not been tested for security issues.
- Pinpoints Vulnerable Code: NightVision identifies issues at the exact area(s) of code in the dev environment so developers don't have to spend time chasing down or validating vulnerability reports, saving money and precious engineering resources.
- The Attacker POV: Developers can locate vulnerabilities at the origin with the exact area of code highlighted to get a perspective on applications the way attackers would.
- Comprehensive Scans: Thoroughly scan apps on public and private networks for full coverage and run comprehensive scans within 3-10 minutes to share insightful results throughout the organization. Google Firing Range tests show a 200% higher coverage than the closest competitor.
- Seamless Integration: Integrate directly into the Continuous Integration/Continuous Delivery (CI/CD) pipeline to scan each pull request in minutes. Create a frictionless cycle between development and security teams through easy workflows.
- Plug-and-Play Testing: Developers need little to no custom coding during scan set-up, and then comprehensive scans are completed within minutes through cloud-enabled simultaneous parallel scanning.
"To say that AI has exponentially increased the speed of software development and the spread of bad and vulnerable code is an understatement," said Kinnaird McQuade, NightVision CTO and co-founder. "The software-based attacks we have seen over recent years are child's play compared to what we could see if AppSec testing solutions don't perform quicker and more comprehensively."
The shortcomings of the application software testing market have handcuffed developers and cybersecurity teams. Developers want to be quickly and easily alerted of exploitable vulnerabilities, including precise details on the location and context of the issue.
"IDC research shows that organizations implementing DevSecOps empower developers to find and fix vulnerabilities, but to do so, they need application security testing solutions that can keep up with the speed of software development and do not impede innovation," said Katie Norton, Research Manager, DevSecOps and Software Supply Chain Security at IDC. "This can be challenging to do with DAST because traditional solutions were not designed for developers and lack code context. DevSecOps teams are more willing and able to shift DAST left if they have confidence that the tool will help them deploy more secure software products without losing time to market."
