Silicon Valley venture capital juggernaut Sequoia is backing a fledgling Danish startup to build a next-gen software composition analysis (SCA) tool, one that promises to help companies filter through the noise and identify vulnerabilities that are a genuine threat.
For context, most software contains at least some open source components, many of which are out-of-date and irregularly -- if at all -- maintained. This has led to all manner of security flaws, such as Log4Shell which impacted the open source Java logging framework Log4j and led to breaches impacting high-profile organisations such as a U.S. Federal agency which failed to patch the bug. In turn, this is leading to an array of fresh regulation, designed to strong-arm businesses into running a tighter software supply chain.
The problem is, with millions of components permeating the software supply chain, it's not always easy to know whether a given application is using a particular component. There are, of course, many software composition analysis (SCA) tools out there, from Snyk to Synopsis, which alert companies about known vulnerabilities in their technology stack -- but this can create a lot of noise, particularly if an application isn't actively using that component, thus making it difficult for security teams to prioritize the vulnerabilities that really matter.
And this is where Danish cybersecurity startup Coana is setting out to make a difference, using "code aware" SCA to help its users separate out irrelevant alerts and focus only on those that matter.
Coana: Example alerts
To help fund their company through its early-access stage to full commercialization, Coana today announced it has raised $1.6 million in a pre-seed round of funding led by Sequoia Capital, with participation from Essence VC and a slew of angels including current and former executives from Google, Red Hat, and GitHub.
A typical application can consist of as much as 90% third-party libraries, the majority of which are open source and maintained (or not) by any number of volunteer developers.
So a company building software might build their own application layer that draws on these myriad libraries, creating a long chain of dependencies that are connected by functions. Traditionally, a SCA tool would look at the version number of a particular dependency, and map it against a database of known vulnerabilities and then report back to the developers if it finds a match. However, in many cases, an application might only use one or two functions from a library of maybe 50 -- so if a vulnerability exists in a part of the library that the app never calls, it shouldn't really impact that application.
Companies can use Coana to build what it calls a "call graph" of the entire application, spanning application code and dependencies, to understand the data flow paths, and then use that to eliminate false positives.
"The amount of packages being used and the lines of code can be extremely high volume, so it requires some really sophisticated static analysis," Søndergaard told TechCrunch. "The call graph enables us to do a huge analysis on all the possible paths between different dependencies. So imagine an application consisting of hundreds or thousands of dependencies, we can identify all the paths between those dependencies to understand which ones are truly vulnerable -- and which ones are not."
"As our product matures, and our company matures, we're moving up market, eventually targeting large enterprises, but that will take a while before we have the sophistication on the language support to get to get to that level," Søndergaard said.
Companies looking to check out Coana today can apply for early access now.