Developer Security Platform

Deepfactor generates software bills of materials (SBOMs) in CycloneDX and SPDX formats to help businesses that develop software automatically create and manage SBOMs as part of their Software Development Lifecycle (SDLC). These capabilities will enable businesses to improve supply chain security and comply with requirements set by the U.S. Federal Government.

Deepfactor scans containers, open source software, OS packages, and dependencies for CVEs and provides the ability to gate builds and pull requests if Deepfactor detects critical vulnerabilities. Deepfactor performs a scan of containers, OS packages, and images to analyze them against over a dozen publicly available vulnerability databases (such as the NIST Vulnerability Database).

Unlike traditional static Software Composition Analysis (SCA) tools, Deepfactor Runtime SCA correlates static SCA findings with runtime usage behavior to filter and prioritize vulnerability alerts. The Deepfactor correlation engine observes the application while it’s running in test, dev, staging, or production environments to determine whether vulnerable dependencies and packages are used during the application runtime, providing valuable context that accelerates remediation of vulnerabilities and provides guidance on slimming down unused components.

Deepfactor identifies unknown vulnerabilities by analyzing running applications in the development and test environments before releasing code to production. Based on deep visibility of every thread and process, Deepfactor can detect application risks based on customizable policies that monitor for vulnerabilities such as insecure execution, file system behavior, remote code execution, and buffer overflows that can lead to data breaches or be used by zero day attacks.

Deepfactor Container Runtime Security monitors applications in production environments to detect runtime security risks in filesystem, network, process, and memory behavior including exposing sensitive information, privilege escalation, and prohibited network communications. Runtime security in production environments helps demonstrate compliance (SOC 2, etc.) and uncovers indicators of compromise by pinpointing suspicious file, network, and memory behaviors.