A couple of weeks ago, we announced our emergence from stealth, highlighting a significant milestone in the field of open source vulnerability and patch management.
A couple of weeks ago, we announced our emergence from stealth, highlighting a significant milestone in the field of open source vulnerability and patch management.
Our story began in 2022. Having been on the receiving end of many current application security solutions in the market, my co-founders and I experienced firsthand the inefficiencies and gaps in open source security. Our understanding deepened when we spoke with over 50 organizations, most of which reported that, although many tools (both free and commercial) are available, they still faced problems properly managing their vulnerabilities. They struggled to scale their patching efforts, which pushed R&D into a cycle of continuous updates and manual processes. This not only required significant time but also diverted their focus from the company's primary goals.
Why is open source vulnerability remediation so challenging?
Security professionals highlighted several critical obstacles:
Vulnerability overload: Organizations face thousands of vulnerabilities across various business units, cumulating into millions of vulnerable instances.
Incentive Misalignment: The R&D teams responsible for remediation lack the necessary incentives to perform this work.
Process inefficiency: Considerable time is spent identifying the appropriate owner and providing them with remediation guidelines.
Limited remediation options: Typically, the sole strategy is to update vulnerable components, While this sounds simple, the open source community doesn’t have a process for providing standalone security patches. This coupling between security patching and other code changes forces developers to manually review each update (or risk breaking production).
Unpatched Transitive dependency: Organizations are powerless to fix transitive dependencies, relying instead on community efforts.
We also learned that other security vendors primarily concentrate on helping organizations sift through the multitude of vulnerabilities by offering smarter prioritization, shifting the responsibility for patching to the developers, and assisting the security team in identifying the correct individual to carry out the remediation. However, this approach proves insufficient. Even when organizations manage to de-prioritize 70% of the issues, developers are still overwhelmed by thousands of remaining vulnerabilities, leading to a bloated backlog.
Introducing Seal Security
Given the insights gained, we realized that a significant transformation was necessary for companies to approach the coveted goal of achieving zero vulnerabilities in production. This led us to develop a solution designed to eliminate the need for manual intervention by developers, provide centralized control over the patching process, and relieve security engineers from the task of prioritization.
Our secret sauce
With over 30 years of combined experience in exploiting and mitigating software vulnerabilities, our co-founding team possessed a unique advantage: we had the knowledge of how vulnerabilities typically manifest in code, and we suspected that the majority of patches for these vulnerabilities would not cause breaking changes.
We set out to validate and confirm that over 98% of critical and high vulnerabilities could be patched without introducing breaking changes.
This validation strengthened our confidence in our unique value proposition–enabling organizations to patch vulnerabilities without forcing them to update their software.
This simple concept bypasses many of the issues that exist with the current approach:
Since then, our engineers developed a sophisticated patching engine that automates many of the manual processes needed to create our standalone security patches, significantly reducing our average patch creation time from 5 hours to 30 minutes.
For most patches, the only human intervention necessary is to verify the automatic testing results and approve them for publishing.
How the remediation process looks like using our solution
Seal Security seamlessly integrates with SCM providers to continuously scan for vulnerable open source components. Our solution facilitates effortless patching through either a CLI addition to the CI/CD pipeline or integration with an organization’s internal artifact server. Upon identifying a vulnerability, developers are notified via an automatic PR, ensuring that the next build is patched seamlessly. This process not only saves resources but also significantly enhances organizational efficiency through enterprise-scale automation.
What’s next?
Our focus remains on providing a solution that integrates seamlessly into existing processes and tools. To that end, Here’s what you can expect moving forward:
Join us in this revolution
We invite you to be part of this journey. As we deploy our solution across dozens of organizations, including Fortune 100 companies, we remain committed to being SOC2 and ISO27001 compliant.
Join us in this journey. Book a live demo today!
