Solving The Cloud Native AppSec Equation
Accuracy has long been the issue of legacy application security testing (AST) solutions. In order to automate security for cloud native apps, the results must be reliable, accurate, and with context. While most AST tools are strictly focused on finding vulnerabilities, Oxeye provides rich vulnerability context while limiting the noise of false positives/negatives.
(SAST, DAST, IAST)
Cloud Native Application Security Testing
Distributed solutions. Per each component and different stage in the CI/CD. Must install on each container separately and require changes in the code.
Manual. Requires configuration. Dependent on professional services and support.
Correlated between codebases across microservices depending on the app flow
Each component separately
Active Testing (Automation)
Modern approach. Inside and outside the cluster. Designed for distributed applications
Container, Cluster, and Cloud for contextual risk assessment
In the cluster, out of the cluster, and between microservices
Infrastructure configurations combined with custom code vulnerabilities
Single infrastructure layer (IaC) through SAST
Inner application tracing
Via multilayer and multiservice, End to end tracing capability
Limited. HTTP interfaces only
Vulnerable flow visibility