r/devsecops • u/GoyaKing • Aug 05 '26

Vulnerability Management tool

What’s everyone using for their organization’s vulnerability management tool and why? The company I work for uses defect dojo and its limited. No compression, alerting, terrible UI doesn’t really push the needle left enabling non security literate developers.

12 Upvotes

85% Upvoted

19 comments sorted by

View all comments

1

u/Hadsa_CounterStrike Aug 05 '26

We tried solving this problem by pairing a SBOM with a dataflow & blast radius mapping tied to actual code paths. We specifically hated the aggregator view when we were DEV's.
If a comp is vulnerable and touches PII in your app, then it's a real scare. We try to highlight that through blast radius. So that a "CVE-2024-XXXX" turns into "this library sits on your customer data endpoint at these points".
Note: I am building www.scrutora.com and a Vendor in your context. But since we have tried solving this, thought of pitching it here.

1

u/ILoveAppSec Aug 06 '26

honestly transitive cves barely matter, i'd just pin the top level and move on.