January 2025 Summaries

Snyk Accelerate powered by Accenture is a new joint offering designed to help organizations adopt a developer-friendly security program that reduces business risk while speeding up developer innovation. It combines Snyk's developer security platform with Accenture's end-to-end service options, equipping and empowering enterprises to expedite their innovation securely. The joint offering provides a faster time to value and better business outcomes for clients while enabling them to manage their AppSec program independently. Key features include discovery, implementation, adoption, training, scale and support, and report and operationalize. Snyk Accelerate aims to improve application security sustainably across development teams while maximizing productivity, equipping organizations with the precision and prioritization needed to streamline security and minimize delays.

Snyk Accelerate, a collaboration between Snyk and Accenture, aims to help organizations adopt a developer-friendly security program that reduces business risk while speeding up developer innovation. The initiative addresses the growing challenge of complex software supply chains and an increasing backlog of vulnerabilities for security teams to manage. By leveraging Snyk's shift-left approach, security teams can keep pace with agile development methodologies and effectively manage new risks introduced by cloud and AI technologies. Snyk Accelerate provides a comprehensive solution that includes discovery, implementation, adoption, training, scale, and support, enabling organizations to grow and scale their AppSec program sustainably across development teams while maximizing productivity. The collaboration is designed to help enterprises overcome the complexities of modern software development, secure their software development lifecycle, reduce business risks, and empower developers to work with greater speed and efficiency.

Snyk's latest whitepaper, "DevSecOps is Dead," argues that traditional DevSecOps approaches are flawed due to the lack of trust between developers and security teams. The paper proposes a new framework for building trust and collaboration between these teams, highlighting three guiding principles: transparency, structured accountability, and collaborative risk reduction. Snyk's DevSecOps Maturity Framework aims to align developers and security teams on organizational goals and application security outcomes by fostering collaboration and trust through six key pillars, including DevOps foundations, strategy and culture, security design, testing and monitoring, response and remediation, and analysis and governance. By adopting this framework, organizations can reduce friction and siloed workflows between developer and security teams, promoting a culture dedicated to risk reduction and trust.

The Snyk team has announced the first round of changes to Probely, a Snyk Business, aimed at integrating it with Snyk's AppSec portfolio. The interface has been revamped to match Snyk's design language, with changes including a new side menu, collapsible design, and consistent visual framework. These updates aim to improve user experience, clean up and standardize the product, share a unified aesthetic, provide a refined familiarity, and ensure future changes are smooth and user-friendly.

The Cyber Resilience Act (CRA) is a new EU regulation that focuses on improving the cybersecurity of products with digital elements sold within the EU. The regulation sets clear expectations for hardware and software manufacturers, developers, and distributors, outlining how they should manage and address vulnerabilities at every stage of the product lifecycle. To meet the CRA's essential requirements, organizations must prioritize three foundational pillars: software bill of material (SBOM) generation, vulnerability management, and rapid reporting. The regulation emphasizes the importance of proactive risk management via its requirements for continuous monitoring and timely updates to address emerging threats. Organizations can address software supply chain risks by focusing on these essential security practices while promoting trust with partners, end-users, and regulators.

The Fetch the Flag CTF 2025 competition is scheduled to take place on February 27, 2025, and will feature 20+ hands-on hacking challenges designed for both beginners and experts. The top three teams will win Meta Quest 3S VR headsets, while participants can also sharpen their security skills, win prizes, and compete against thousands of players from across the globe. New to CTF competitions? A CTF 101 Workshop on February 13, 2025, is available to learn the basics of solving CTF challenges with live expert support. The event will be hosted by Snyk and cybersecurity expert John Hammond, and participants can sign up now to secure their spot.

BFI Finance Indonesia embarked on a digital transformation journey to elevate application security and developer experience. Initially relying on reactive security practices, they shifted towards a proactive approach with the help of Snyk's tools, including pull request scans, code scans during development, IaC scans for infrastructure, and container scans for production. This transition led to improved compliance, better developer experience, enhanced reporting, and ultimately, a culture shift that prioritized security as a standard part of deployments. The key to success lies in collaboration, cultural transformation, and setting clear standards, fostering accountability among teams. By adopting these practices, BFI Finance Indonesia set the standard for secure development, ensuring application and infrastructure security across their entire lifecycle.

Snyk has been recognized as a trusted partner and innovator by JPMorgan Chase, one of the world's largest financial institutions, for its role in helping the bank build a secure future through its application security platform. Snyk delivers tools that enhance cloud security without slowing developers down, enabling enterprises to build secure apps, manage vulnerabilities, and streamline compliance. The company's shift-left approach to application security has earned it an award from JPMorgan Chase, which acknowledges Snyk's impact on the bank's cybersecurity efforts. With its commitment to the developer community, Snyk continues to push the boundaries of the application security market with cutting-edge technology that enables developers to develop fast and stay secure.

Snyk's Security Labs team has been testing the Cursor AI Code Editor, a popular developer IDE, to identify potential vulnerabilities. The research found no indications that Cursor is vulnerable to dependency confusion attacks, and no sensitive data was disclosed during testing. This test aimed to identify potential attack vectors in AI-enabled development environments, which are becoming increasingly popular. Snyk's Security Labs regularly conducts vulnerability research to ensure software and systems used by developers around the world are safe, beating malicious actors to the punch. The team's goal is to improve developer security through integrated and automated security solutions.

Snyk has released an ebook titled "Taming AI Code: Securing GenAI Development with Snyk" to address the challenges of securing AI-generated code. The rise in AI tools and AI-generated code is changing developer workflows, enabling them to focus on more complex tasks. However, this shift also poses significant risks for security teams, as 96% of developers use AI coding assistants to streamline their work. GenAI tools like ChatGPT and Copilot are prevalent in developer workflows, but without proper guardrails, AppSec teams will struggle to meet demands while prioritizing security. Snyk's solution, Snyk Code, enables teams to implement a developer-first approach to code security, integrating directly into the IDE for real-time scanning and fixing vulnerabilities without slowing production or interrupting developer workflow. Snyk Code also addresses the challenges of securing AI-generated code using AI-powered tools like DeepCodeAI and DeepCode AI Fix, offering enhanced productivity and security while balancing speed and accuracy.

Snyk's Field CTO Pas Apicella delivered a presentation at the Digital Banking Asia Summit 2024 in Malaysia, focusing on actionable strategies to address pressing challenges in digital banking. The key areas highlighted by Apicella were top challenges in application security, key challenges for developers and security teams, and leadership considerations and defining success in application security. Financial services institutions face unique obstacles such as regulatory compliance, third-party integration, sophisticated attackers, complexity of applications, legacy systems, resource limitations, insider threats, and release velocity and secure customer experience. Collaboration between developers and security teams is vital but often falls short due to a lack of shared context and business and technical context, which complicates risk prioritization. Leadership priorities center on automation, developer productivity, and ease of use for CTOs, while CISOs prioritize compliance, detailed reporting, and real-time visibility into the organization's risk posture. Achieving success in application security requires a clear strategy and the right tools, defined by five pillars: developer adoption, security trust, delivering fixes, comprehensive platform, and partner ecosystem.

As the new year begins, improving application security is crucial to avoid "AppSec exhaustion" and stay ahead of growing vulnerabilities. To achieve this, adopt workflows and tools that enable automated vulnerability fixes, such as Snyk's auto-fix capabilities, to quickly identify and address vulnerabilities in code, dependencies, containers, and infrastructure as code. Combining AI-powered speed with human expertise is also essential, ensuring seamless integration, actionable insights, and human validation to build trust in the growing role of AI in security. Furthermore, integrating security testing and remediation into development processes from the start can help build trust in AI-generated code. Finally, securing AI models should be a top priority by protecting training data, monitoring for data drift, implementing model hardening, and more. By making these improvements, organizations can prepare for the software development world of tomorrow and stay ahead of emerging security challenges.