Endor Labs this week added an artificial intelligence (AI) tool to its portfolio that evaluates every reachable open source vulnerability against a code context graph to generate fixes that typically require only 10 lines of code to be generated and applied.
Joe Harrington, a principal product manager for Endor Labs, said AURI Fix for Open Source provides DevSecOps teams with an autonomous remediation engine that enables them to apply small amounts of highly targeted code to remediate vulnerabilities. That capability is critical at a time when advanced AI models are discovering thousands of vulnerabilities in open source code that cybercriminals can now exploit in a matter of minutes using AI tools of their own, he noted.
Without the aid of AI tools, it’s simply not going to be possible for DevSecOps teams to manually keep pace with the number of vulnerabilities that need to be investigated and ultimately fixed, added Harrington. Making matters worse, the mean time to exploitation for vulnerabilities is already at 39 days and continues to decline, he noted.
AURI checks reachability, exploitability, severity and deployment context, and documents findings that pose no real risk. When an upgrade doesn’t break the application, the AURI AI agent identifies the minimum safe version of a package and opens a pull request.
When exposure runs through configuration or application code, DevSecOps teams can trigger a fix using a command-line interface (CLI) that invokes the Endor Labs policy engine to open a pull request for review. DevSecOps teams can optionally assign an AURI AI agent to triage findings, select the remediation method and apply the fix. For applications with pinned versions where API changes might cause compatibility issues, or when no fix is available in an upstream release of the open source code, AURI applies a backported or zero-day patch.
If the code in use is unmaintained or found to be repeatedly vulnerable, Endor Labs also provides a scoring tool that helps DevSecOps teams identify an alternative open source software package to replace the vulnerable dependency.
Regardless of how the fix is applied, each one comes with a VEX report documenting why the vulnerability is no longer exploitable, providing clear evidence for why a vulnerability finding should be suppressed, said Harrington.
Endor Labs researchers have thus far assessed 264,643 reachable vulnerabilities in enterprise codebases. Less than 10% of the issues discovered could be fixed by upgrading or patching the dependency. In contrast, 82% could be mitigated with a small change in the application without touching the dependency. In effect, Endor Labs is combining the deterministic capabilities of its SAST and SCA tools with probabilistic AI coding tools to generate a much more targeted fix that DevSecOps teams can confidently deploy, said Harrington.
There have, of course, always been more vulnerabilities than DevSecOps teams could ever hope to fix, an issue that is becoming even more problematic in the age of AI. However, with the help of AI, it’s also becoming possible to address those issues much faster than ever.
Mike Vizard is a veteran IT journalist with more than 25 years of experience covering the technology industry, having previously served as Editor-in-Chief of both CRN and InfoWorld and as editorial director for Ziff-Davis Enterprise, where he oversaw titles including eWEEK, CIO Insight and Baseline. Over his career he has also edited or contributed to a wide range of enterprise technology publications, including IT Business Edge, Channel Insider, ComputerWorld, TMCNet and Digital Review, and he later led editorial for CTOEdge.com. His reporting and analysis span software development, cloud computing, cybersecurity, IT channel strategy and, more recently, artificial intelligence and DevOps practices. A recognized voice in enterprise IT journalism, Vizard is known for tracking emerging technology trends as they move from early adoption into mainstream enterprise use. He now serves as Chief Content Officer for Techstrong Group, where he oversees editorial strategy across the full network — DevOps.com, Security Boulevard, Cloud Native Now, Digital CxO, Techstrong.ai, TechStrong.IT, Techstrong Semi and PlatformEngineering.com — in addition to writing and hosting content for Techstrong TV and the Techstrong Gang podcast.