Myrror Security

New founder: "How much do you have to network?" Me:

"At Microsoft I spent 50 percent of my time triaging things I knew weren't being used in the code." Myrror CEO & Co-Founder Yoad Fekete chats with Cássio Batista Pereira and Rodrigo Balbino on the DevSecOps podcast about fixing vulnerable functions that were not exploitable. Give this post a 👍 if you relate... P.S. Our proprietary Reachability Engine determines whether a vulnerable function can be reached by your code, and prioritizes only the vulnerabilities that pose a true risk to your business. Learn more here: https://lnkd.in/d8UbEkq9

As we’re nearing the holiday season, a quick reminder: 0-day ≠ incident. Understanding if and how you’re impacted in the context of your application gives you the power to act—or confidently choose not to. Going back to Log4j, everybody went crazy in understanding where the most immediate assets to tackle are—it ruined the holidays for some people. Using Code and production Reachability can greatly help focus teams on the most important assets to tackle: first by understanding where a vulnerable function is found, if/where it’s actually used in the code, and whether it’s deployed to production and where. Wishing all our customers and friends a peaceful holiday season with zero incidents :)

Webinar DevSecOps: Réduction des Faux Positifs Myrror Security et Cat-Amania

Customer spotlight💡: Tamnoon is using Myrror to verify each component––ensuring that they ship only trusted software.

Our Reachability Engine reduces up to 80% of alerts––prioritizing only the vulnerabilities that pose a risk to your environment. Combined with our Remediation Engine––which points out the impact on the developer’s code––you get a complete workflow that breaks the Engineering <> Security miscommunication pattern. Here’s how it works:

We sat down and thought: how are we going to be the Wiz of AppSec? We tried reverse engineering their success, and then we figured it out... Their navigation bar is on the top, and so more data can be seen on the main pane. So that’s exactly what we’ve done! Google – we are open to a $20B offer now

"If you give developers the right tools, they might eventually invite you to the after-hours party.” Myrror CEO & Co-Founder Yoad Fekete and CISO Marius Poskus discuss building trust between security teams and developers––and the main KPI––getting the coveted invite to the party ;) 🎉 Do you agree?

"Security engineers and software developers often have competing sub-goals, but always share the same ultimate goal: the success of the business." Couldn't agree more with Taylor Brudos' article on "Trust Algebra for Security Engineers" and the formula security engineers should follow to build trust with development teams. From my experience, lack of communication, trust, and 'buy-in' can be the difference between having risks in the SDLC or not––although we like to point at everything but (probably because it's easier to blame tooling, systems or preparation). This article is worth a read and thank you Taylor for including Myrror Security in this important conversation :)