Features

Post-build binary analysis is crucial because it identifies vulnerabilities and security defects that might not be apparent at the source code level and could be introduced during compilation or other build processes.

It also enables you to understand the true composition of a binary, how parts of the binary may behave at execution time, if security mitigations have actually been applied, how dependencies might impact the security of your software and what may have changed between releases.

Most products that identify security defects match file names, hashes, and versions to a list of known CVEs. While using this basic data is useful, it often results in many false positives.

To address this, we employ approaches that enable us to analyze the composition of the binary, the context in which it is used, and, in some cases, perform reachability analysis of the vulnerability, which substantially reduces false positives.

Additionally, vendors often backport fixes, and the filenames and versions do not necessarily match, producing a lot of false positives.

We use our own datasets to identify backported fixes, significantly reducing false positives. This combination of advanced binary analysis, reachability analysis, and patch analysis helps you focus on what matters without having to deal with the noise typically associated with other platforms.