Regarding threat detection capability, I think that Ox Security is not used for that matter. The CISO mainly focuses on dev sec ops rather than runtime security or real-time security. I figure that the most important metrics for the analytics feature are the critical issues dashboard, which helps understand whether there is a leak of a secret or a very critical vulnerability that is not being used. Another important aspect is the integration with other products like JFrog and X-ray, which shows not all the findings but mostly focuses on what Ox Security considers the most important issues. For instance, we found some issues that were flagged by JFrog, but Ox Security dismissed them, leading to discussions about whether those issues are real, as there are often false positives in the security world, as well as considerations about the attack surface for each vulnerability and whether these are truly critical issues or not. I work extensively with JFrog X-ray, which is my major tool for another customer. I believe that JFrog is more pinpointing, and I have some integration with JFrog with the build system, the CI/CD and X-ray vulnerabilities meter. It's quite useful, but I think that they serve different purposes; JFrog comes mostly from the artifact management side and less from security. Ox Security is mostly focused on the DevSecOps and areas that cannot be detected. In terms of vulnerability management, Ox Security has strong integration, but sometimes there are vulnerabilities that are disputed or dismissed, which creates an interesting intersection between the two products. From what I talked about with the DevOps team, deployment is quite straightforward. My overall review rating for Ox Security is zero.
My advice to others looking into using Ox Security is that its strength relies on the aggregation of several tools. If a company is struggling with managing several tools just to get a better understanding of how their security posture is, tools like Ox Security are a must. I would rate this product an eight overall.
Static Application Security Testing provides tools to identify vulnerabilities in code early in the development cycle, improving security and minimizing risk exposure.SAST focuses on analyzing source code, binaries, or bytecode to detect issues like SQL injection, buffer overflows, and cross-site scripting. This proactive approach enables developers to remediate potential security flaws before applications are deployed. The solution integrates seamlessly with existing CI/CD pipelines,...
Regarding threat detection capability, I think that Ox Security is not used for that matter. The CISO mainly focuses on dev sec ops rather than runtime security or real-time security. I figure that the most important metrics for the analytics feature are the critical issues dashboard, which helps understand whether there is a leak of a secret or a very critical vulnerability that is not being used. Another important aspect is the integration with other products like JFrog and X-ray, which shows not all the findings but mostly focuses on what Ox Security considers the most important issues. For instance, we found some issues that were flagged by JFrog, but Ox Security dismissed them, leading to discussions about whether those issues are real, as there are often false positives in the security world, as well as considerations about the attack surface for each vulnerability and whether these are truly critical issues or not. I work extensively with JFrog X-ray, which is my major tool for another customer. I believe that JFrog is more pinpointing, and I have some integration with JFrog with the build system, the CI/CD and X-ray vulnerabilities meter. It's quite useful, but I think that they serve different purposes; JFrog comes mostly from the artifact management side and less from security. Ox Security is mostly focused on the DevSecOps and areas that cannot be detected. In terms of vulnerability management, Ox Security has strong integration, but sometimes there are vulnerabilities that are disputed or dismissed, which creates an interesting intersection between the two products. From what I talked about with the DevOps team, deployment is quite straightforward. My overall review rating for Ox Security is zero.
My advice to others looking into using Ox Security is that its strength relies on the aggregation of several tools. If a company is struggling with managing several tools just to get a better understanding of how their security posture is, tools like Ox Security are a must. I would rate this product an eight overall.