AppSec Phoenix got nominated as a leader in the ASOC category for the Application Security Hype cycle.


We are pleased to announce that AppSec Phoenix has been named a Leader in the 2022 Hype Cycle for Application Security Orchestration and Correlation. 

This article covers some of the critical vision and pillars that determine the recognition of leaders in the category.

What is ASOC

Application security orchestration and correlation (ASOC) tools ease software vulnerability testing and remediation by automating workflows and processing findings. They automate security testing within and across the development life cycle, ingesting data from multiple sources. They correlate and analyse results to centralise efforts for more straightforward interpretation, triage and remediation, acting as a management and orchestration layer and control between application development and security testing.

What are the characteristics of a next-generation ASOC?

How does ASOC help you: Visibility, control, correlation of vulnerabilities across your native deployment

> Application security native stack correlation

  • Code Vulnerabilities
  • Library Vulnerability
  • API Security
  • Website Security
  • IAST/DAST Vulnerability (Black Box Testing)

> Cloud security 

  • Cloud-native deployment
  • Cloud Misconfiguration
  • Cloud Visibility

> Infrastructure Security Vulnerability

  • Vulnerable Servers
  • Vulnerable images
  • AMI Images vulnerability
  • Cloud Misconfiguration and drift

> Container Security

  • Kubernetes Security
  • Container Security
  • Image Register Security

What is the vision of a modern Next Generation ASOC?

Correlate Results

Each of the security tools in the pipeline can deliver some severity results but having all the results in one single place prioritised and triaged is the nirvana of security professionals.

Correlation between results helps you remove false positives and focus your security efforts on the vulnerabilities that are most likely to get exploited tomorrow.

Prioritise Vulnerabilities in important conditions

Are you fixing all the vulnerabilities? An impossible task. Modern organisations focus on battling priorities and focus. Not all security issues, cloud misconfigurations and vulnerabilities are equally important. An attacker will more likely target a vulnerability, like log4j, or an authentication error on a web server exposed over the web without security controls. The system is protected by four layers of network security controls and not exposed over the web. 

Focusing your security engineering efforts on the more exploitable vulnerabilities first is the key to getting ahead of the attacker.

Contextualisation & Business Context

Which one would you choose: 

  • Fixing vulnerabilities on your critical systems and the one that generates most of the revenue-generating
  • Cafeteria software that enables the menu delivery on display

No brainer, right? It is hard to represent those business context decisions in the modern Software lifecycle or environment patching/upgrading. Organisations battle the complexity of vulnerabilities and struggle to correlate business context.

Transferring key business contextual knowledge onto the decision process for fixing and prioritising vulnerabilities ensures engineers are working on the business-critical apps first. 

Attackers think about what’s more valuable for the business and how do I get in the business; by reflecting those considerations into the vulnerability and risk prioritization, you will ensure your organization prioritises vulnerabilities with the eye of an attacker 

DevSecOps workloads 

Determining which team is working on what and delivering the prioritised and contextualised vulnerabilities that need to be solved to the backlog (or tools) of the groups responsible for it is key to false positive reduction and augmentation of focus. 

Track Path to Green & Remediation Progression

When you have to deal with a lot of vulnerabilities, the usual ask from executives and the rest of the business is how much and by when. Track progress toward risk-based objectives is key to keeping the whole business secure and executives aware of progress to risk reduction. 

Tracking metrics like vulnerability reduction, risk reduction, impact reduction, number of critical resolved, Vulnerabilities outside SLA, and number of tickets open helps business people to be more aware of the situation. 

Risk Based Objectives 

Businesses talk about risks and costs to reduce risk, they are good at evaluating risk-reward positions. Reporting on volumetrics and the number of vulnerabilities does not enable businesses to make risk-based decisions. 

Translating decisions into risk-based posture enables every application owner and executive to be aware of the security risks of their vulnerabilities. 

Translating risk-based objectives into several vulnerabilities to solve is key to linking the security engineering team and business together. 

Application security and Cloud Native Application deployment

Organisations nowadays focus on cloud-native deployments. Thinking and prioritising vulnerabilities in a vacuum is not effective and deliver a warped image. 

Vulnerability needs to be prioritised based on context

  • Business context =  how important is the application that is being developed 
  • Environment context = Cloud and non-cloud infrastructure have different challenges. Containers and Infrastructure elements have very different characteristics and challenges 
  • Control Context = determining which system is protected by controls is critical in determining the mitigation of risks
  • Deployment Relation = determining which application is deployed is critical to deciding the prioritisation and risk level of a vulnerability affecting software and infrastructure posture. 

Central Risk-based platform

Centralise the results for every team to determine the risk profile and how much work needs to be done to be secure.

Security insights 

Correlation and contextualisation provide valuable insights to the security team to organise security training and practical work to give the best return on effort for security remediations. 

Take the example of a single library with 100 vulnerabilities affecting 100 applications and 1000 developers. Would the security team effectively resolve the issue using all 1000 developers to solve the 100’000 vulnerabilities? 

It is more effective for the security team to have a central repository with the golden library or AMI, and solving the vulnerabilities centrally helps 1000 developers with a more focused effort. It removes the friction between security and the development environment.

Impact analysis

Understanding the position of your team and how much damage an application could suffer if a data breach happens or you lose productivity is key. 

Business is keener to listen to an impact and risk analysis of the business and business risk from a security executive rather than a report on vulnerabilities. 

How can Appsec Phoenix help?

Introducing Appsec Phoenix, a Cloud Native and Risk-based platform for vulnerability and posture management

Application and infrastructure testing tools output large amounts of data, and teams spend time and resources to aggregate this information into something actionable. ASOC tools should centralise this information into one location for teams to view and analyse, allowing them to craft better plans for future development. This information can be used for security teams and executives, SCA tracking, and more.

> Risk Posture & Risk-Based Vulnerability Management (RBVM) – We help organisations to understand the risk posture across application, infrastructure and cloud security in a prioritised and simple way

> Asset information, Software Bill of Materials, * (ANY) Bill of materials  – We help organisations understand where their assets are at from a risk and vulnerability angle

> CSPM/Vuln Management – Infrastructure/Cloud – we help you understand the posture of your endpoints and correlate the software developed. 

> Business Context and intelligence – we help organisations reflect the business context, criticality and data insights onto the remediation of vulnerabilities to reflect which application is more critical and needs attention first

> Real-Time Threat Intelligence applied directly to prioritisation – Appsec Phoenix applies cybersecurity threat intelligence like exploitability prediction based on honeypot feedback, exploit prediction based on the dark web and clean web chatter (like Twitter, LinkedIn, Reddit, Pastebin) 

> Security Insights – we help organisation security teams be more effective by identifying the work that is more significant and the security improvements that are more impactful across the organisation

> Correlation of vulnerability across domains – we help organisations correlate application security vulnerabilities into which environments are deployed (container, cloud, infrastructure) 

> DevSecOps automated workloads – We help security teams to scale across the organisation, enabling them to codify decision-making when suggesting which vulnerabilities need to be solved first

Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Explore ASPM’s role in modern application security, offering a panoramic view that extends beyond code vulnerabilities. This guide demystifies concepts like traceability, reachability analysis, and asset lineage, pivotal for securing digital assets. Learn how ASPM empowers organizations with actionable insights for precise vulnerability management. #Cybersecurity #ASPM #ApplicationSecurity
Francesco Cipollone
Explore the transformative role of ASPM in cybersecurity. Uncover how Application Security Posture Management aligns business and security objectives for effective vulnerability management and risk reduction. Discover Phoenix Security’s innovative approach to tackling the staggering challenge of CVEs with a strategic focus on prioritization. #ASPM #Cybersecurity #VulnerabilityManagement
Francesco Cipollone
Explore the critical insights into the latest container security vulnerabilities named leaky vessels, including CVE-2024-21626, CVE-2024-23651, CVE-2024-23653, and CVE-2024-23652, BuildKit flaws, with our comprehensive guide on mitigation strategies, best practices for application security, and tips for robust vulnerability management in Docker and Kubernetes environments. Stay ahead in securing your container deployments against potential threats with ASPM help
Francesco Cipollone

Jeevan Singh

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James Berthoty

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

Christophe Parisel

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris Romeo

Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

Jim Manico

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.