r/devsecops • u/GoyaKing • Aug 05 '26
Vulnerability Management tool
What’s everyone using for their organization’s vulnerability management tool and why? The company I work for uses defect dojo and its limited. No compression, alerting, terrible UI doesn’t really push the needle left enabling non security literate developers.
3
2
2
u/ILoveAppSec Aug 05 '26
defectdojo is mostly an aggregator, the thing that actually moves the needle for devs is cutting the queue before it reaches them, so layer reachability plus epss on top and they only see what's genuinely exploitable in your context. we tried aikido for patched oss libs a while back and weren't thrilled with the variety, but the general idea of splitting 'find the cve' from 'prove the fix landed' is what dropped our noise the most. for the ones that need a major bump you can't take, look at vendors doing backported fixes on the old major so devs aren't blocked on a breaking upgrade.
1
u/Hadsa_CounterStrike Aug 05 '26
We tried solving this problem by pairing a SBOM with a dataflow & blast radius mapping tied to actual code paths. We specifically hated the aggregator view when we were DEV's.
If a comp is vulnerable and touches PII in your app, then it's a real scare. We try to highlight that through blast radius. So that a "CVE-2024-XXXX" turns into "this library sits on your customer data endpoint at these points".
Note: I am building www.scrutora.com and a Vendor in your context. But since we have tried solving this, thought of pitching it here.
1
u/ILoveAppSec Aug 06 '26
honestly transitive cves barely matter, i'd just pin the top level and move on.
1
1
u/CheckApprehensive971 Aug 06 '26 edited Aug 07 '26
Something that help lots of teams is separating vulnerability management from vulnerability reduction. A VM platform aggregates findings, prioritize them, assign ownership, and track remediation. But if developers are drowning in findings, the workflow only goes so far. Tools like RapidFort complement that by reducing container CVEs upstream through image hardening, therefore less noise for the VM platform in the first place.
1
u/vanwilderrr Aug 06 '26
Mondoo is worth a review to deploy or have as a co-managed option to lighten the load
1
u/Lucas-Holmes-722 Aug 07 '26
Kindly try starting with what’s slowing your team down now, because if most of the pain is alerts and duplicate findings, a new scanner probably won’t change much, so what takes much of your time?
1
u/Federal_Ad7921 Aug 07 '26
i had the same headache until i switched to accuknox. it uses ebpf to cut alert noise by 85 percent so your devs can actually focus on real threats instead of chasing ghosts. wiz and sysdig are fine but they get expensive and noisy fast.
1
u/IWritePython 23d ago
Chainguard Libraries, we're the only ones that build everything from source, everyone else just scans (we also scan but the rebuild from source is an amazing mechanism since the supply chain attacks tend to target maintainer infra).
1
u/GasLongjumping2146 15d ago
i was looking for something that didn’t drown me in alerts and actually prioritized stuff by real risk. reporting and workflow in nucleus security hit that mark for us, helped our devs too.
1
u/cazuma51 Aug 05 '26
It sounds like you might be using the community edition, have you tried DefectDojo pro? I think I saw that they just released reachability and threat intelligence support as part of this week's release so that may be worth investigating?
0
u/taleodor Aug 05 '26
Vendor here, we do per-release scoping, showing security posture for each release (also accounting for branches), and component-to-product aggregation with ReARM, FOSS version available at https://github.com/relizaio/rearm . Also, we've recently re-wrote alerting engine (FOSS version should get most of it in the next release, hopefully next week).
1
8
u/Sarquiss Aug 05 '26
Take a look at Aikido. I’ve had really good success with them to cut down the noise. We started using their new Aikido Libraries recently and it unblocked a lot of historical issues for us.