3 ms·

Thanks for the comment. - I would agree that a big chunk of vulnerability market helps with things that companies don't own, but I'm not sure it's that high. A

Thanks for the comment. - I would agree that a big chunk of vulnerability market helps with things that companies don't own, but I'm not sure it's that high. A lot of companies use SaaS tools and deploy tools they don't own on their private cloud that they have to wait on patches for. Our perspective is that a lot of the tools that emerged in the last few years center around detection, and very little on remediation. We didn't want to be another tool that contributes to alert fatigue. With budgets tightening, tougher scrutiny of security and increasing threats, companies need automation in remediation. - We've designed Corgea to always have a human in the loop. Corgea doesn't push code automatically to prod. It creates a PR when someone clicks on the button to do so, and it will have an engineer to review the PR to ensure nothing breaks. Almost every company has those controls in place. Additionally, for the vast majority of cases the fixes are safe and don't lead to dependency issues further downstream, and for others we will be building logic to account for that. For example this SQL injection fix requires you to parameterize the inputs correctly, which is a one line code change and doesn't have dependency. https://demo.corgea.com/501 https://demo.corgea.com/501.

waihtis 3y ago
> A lot of companies use SaaS tools and deploy tools they don't own on their private cloud that they have to wait on patches for Dont forget ~ 85% of global compute is still on-premise stuff. > With budgets tightening, tougher scrutiny of security and increasing threats, companies need automation in remediation. Yes, but the main bulk of vulns for enterprises and SMB+ (as in, the orgs that actually do security spending) are in products they don't own the codebase of. Windows, Redhat, Cisco, Confluence, Jenkins, and more recently also solutions like Okta, Forgerock and others are getting exploited via vulns for the benefit of attackers. I'm not trying to be a dick btw, but I think you're confusing the market you're trying to play in. You're selling something closer to a dev tool than a security tool, and talking about detection and such doesn't really concern this area.
- asadeddin 3y ago
  No worries. I think we might be talking past each other, and that's ok :). I believe we're defining the market differently. It sounds like you're talking about vulnerable code in other apps, and I'm talking about vulnerability detection in general in security. Is that correct? For code you own, control or have over-sight over, we can help. Otherwise, we can't. When I mention vulnerability detection, I mean that generally as "findings". For example, our original product was detection data leakage issues in SaaS tools like Slack, Snowflake, JIRA, etc. For example, we could detect someone pasting credentials by mistake to their colleague in Slack because they wanted to share logs. This is a human caused problem facilitated by not properly sanitizing logs. I include these when I'm talking about the market. The comment about the dev tool vs security tool is interesting. How would you categorize Snyk?
  - waihtis 3y ago
    Gotcha, alert fatigue is usually associated with threat detection hence the qualys > How would you categorize Snyk? Im not a heavy user, but I believe they themself position themself as ”developer security” (think its even in their slogan)
    - asadeddin 3y ago
      I believe we're in a similar category. A telling sign of what category a company belongs to is based on what conferences and events they're sponsoring and attending. Snyk and the likes sell to the security teams with dev friendliness in mind. We're aiming to do the same here.

waihtis 3y ago

> A lot of companies use SaaS tools and deploy tools they don't own on their private cloud that they have to wait on patches for Dont forget ~ 85% of global compute is still on-premise stuff. > With budgets tightening, tougher scrutiny of security and increasing threats, companies need automation in remediation. Yes, but the main bulk of vulns for enterprises and SMB+ (as in, the orgs that actually do security spending) are in products they don't own the codebase of. Windows, Redhat, Cisco, Confluence, Jenkins, and more recently also solutions like Okta, Forgerock and others are getting exploited via vulns for the benefit of attackers. I'm not trying to be a dick btw, but I think you're confusing the market you're trying to play in. You're selling something closer to a dev tool than a security tool, and talking about detection and such doesn't really concern this area.

asadeddin 3y ago
No worries. I think we might be talking past each other, and that's ok :). I believe we're defining the market differently. It sounds like you're talking about vulnerable code in other apps, and I'm talking about vulnerability detection in general in security. Is that correct? For code you own, control or have over-sight over, we can help. Otherwise, we can't. When I mention vulnerability detection, I mean that generally as "findings". For example, our original product was detection data leakage issues in SaaS tools like Slack, Snowflake, JIRA, etc. For example, we could detect someone pasting credentials by mistake to their colleague in Slack because they wanted to share logs. This is a human caused problem facilitated by not properly sanitizing logs. I include these when I'm talking about the market. The comment about the dev tool vs security tool is interesting. How would you categorize Snyk?
- waihtis 3y ago
  Gotcha, alert fatigue is usually associated with threat detection hence the qualys > How would you categorize Snyk? Im not a heavy user, but I believe they themself position themself as ”developer security” (think its even in their slogan)
  - asadeddin 3y ago
    I believe we're in a similar category. A telling sign of what category a company belongs to is based on what conferences and events they're sponsoring and attending. Snyk and the likes sell to the security teams with dev friendliness in mind. We're aiming to do the same here.