3 ms·

> A lot of companies use SaaS tools and deploy tools they don't own on their private cloud that they have to wait on patches for Dont forget ~ 85% of global co

> A lot of companies use SaaS tools and deploy tools they don't own on their private cloud that they have to wait on patches for Dont forget ~ 85% of global compute is still on-premise stuff. > With budgets tightening, tougher scrutiny of security and increasing threats, companies need automation in remediation. Yes, but the main bulk of vulns for enterprises and SMB+ (as in, the orgs that actually do security spending) are in products they don't own the codebase of. Windows, Redhat, Cisco, Confluence, Jenkins, and more recently also solutions like Okta, Forgerock and others are getting exploited via vulns for the benefit of attackers. I'm not trying to be a dick btw, but I think you're confusing the market you're trying to play in. You're selling something closer to a dev tool than a security tool, and talking about detection and such doesn't really concern this area.

asadeddin 3y ago
No worries. I think we might be talking past each other, and that's ok :). I believe we're defining the market differently. It sounds like you're talking about vulnerable code in other apps, and I'm talking about vulnerability detection in general in security. Is that correct? For code you own, control or have over-sight over, we can help. Otherwise, we can't. When I mention vulnerability detection, I mean that generally as "findings". For example, our original product was detection data leakage issues in SaaS tools like Slack, Snowflake, JIRA, etc. For example, we could detect someone pasting credentials by mistake to their colleague in Slack because they wanted to share logs. This is a human caused problem facilitated by not properly sanitizing logs. I include these when I'm talking about the market. The comment about the dev tool vs security tool is interesting. How would you categorize Snyk?
- waihtis 3y ago
  Gotcha, alert fatigue is usually associated with threat detection hence the qualys > How would you categorize Snyk? Im not a heavy user, but I believe they themself position themself as ”developer security” (think its even in their slogan)
  - asadeddin 3y ago
    I believe we're in a similar category. A telling sign of what category a company belongs to is based on what conferences and events they're sponsoring and attending. Snyk and the likes sell to the security teams with dev friendliness in mind. We're aiming to do the same here.

asadeddin 3y ago

No worries. I think we might be talking past each other, and that's ok :). I believe we're defining the market differently. It sounds like you're talking about vulnerable code in other apps, and I'm talking about vulnerability detection in general in security. Is that correct? For code you own, control or have over-sight over, we can help. Otherwise, we can't. When I mention vulnerability detection, I mean that generally as "findings". For example, our original product was detection data leakage issues in SaaS tools like Slack, Snowflake, JIRA, etc. For example, we could detect someone pasting credentials by mistake to their colleague in Slack because they wanted to share logs. This is a human caused problem facilitated by not properly sanitizing logs. I include these when I'm talking about the market. The comment about the dev tool vs security tool is interesting. How would you categorize Snyk?

waihtis 3y ago
Gotcha, alert fatigue is usually associated with threat detection hence the qualys > How would you categorize Snyk? Im not a heavy user, but I believe they themself position themself as ”developer security” (think its even in their slogan)
- asadeddin 3y ago
  I believe we're in a similar category. A telling sign of what category a company belongs to is based on what conferences and events they're sponsoring and attending. Snyk and the likes sell to the security teams with dev friendliness in mind. We're aiming to do the same here.