ThreadFix 2.7’s feature set represents the most significant expansion to the platform since ThreadFix was first released almost 10 years ago. This release bundles new application risk-ranking capabilities with the powerful addition to receive a 3rd party assessment for any application managed within ThreadFix. Join us to see how your team’s capacity and capabilities can be instantly expanded through on-demand application security assessments delivered directly into your ThreadFix instance, adding Denim Group’s nearly two decades of application security experience to your team anytime you need it.

1. © 2018 Denim Group – All Rights Reserved
Building a world where technology is trusted.
Optimize Your Security
Program with ThreadFix 2.7
Application Risk Management
+ On-Demand AppSec Assessments
Dan Cornell | CTO
Kyle Pippin | Product Manager

2. © 2018 Denim Group – All Rights Reserved
ThreadFix Overview

3. © 2018 Denim Group – All Rights Reserved
ThreadFix Overview
• Consolidate Test Results
• Manage Vulnerabilities
• Gain Access to Powerful Analytics
2

4. © 2018 Denim Group – All Rights Reserved
ThreadFix Overview
3

5. © 2018 Denim Group – All Rights Reserved
Consolidate Test
Results
4

6. © 2018 Denim Group – All Rights Reserved
Application Security Testing
• Application Security Testing
• SAST, DAST, IAST
• Software Composition Analysis (SCA)
• Manual Testing
• Code Reviews
• Application Assessments
• 3rd Party Testing
5

7. © 2018 Denim Group – All Rights Reserved
Application Portfolio Tracking
6

8. © 2018 Denim Group – All Rights Reserved
Test Result Consolidation
7

9. © 2018 Denim Group – All Rights Reserved
Test Result Consolidation
8
• Typically see a 15-35%
reduction in finding
count
• Includes technology
from Denim Group
patents:
• US 10,043,012 Method
of Correlating Static
and Dynamic
Application Security
Testing Results for
Web Applications
• US 10,043,004 Method
of Correlating Static
and Dynamic
Application Security
Testing Results for a
Web and Mobile
Application

10. © 2018 Denim Group – All Rights Reserved
Manage Vulnerabilities
9

11. © 2018 Denim Group – All Rights Reserved
Vulnerability Prioritization
10

12. © 2018 Denim Group – All Rights Reserved
HotSpot Technology
11
• Identify internally
developed and
shared code
responsible for
vulnerabilities
• Includes
technology from
Denim Group
patent US
10,116,681
Method of
Detecting Shared
Vulnerable Code

13. © 2018 Denim Group – All Rights Reserved
Defect Tracker Integration
12

14. © 2018 Denim Group – All Rights Reserved
Gain Access to Powerful
Analytics
13

15. © 2018 Denim Group – All Rights Reserved
Searching and Views
14

16. © 2018 Denim Group – All Rights Reserved
Program Benchmarking
15

17. © 2018 Denim Group – All Rights Reserved
Scanner Benchmarking
16

18. © 2018 Denim Group – All Rights Reserved
ThreadFix 2.7

19. © 2018 Denim Group – All Rights Reserved
ThreadFix 2.7
• Portfolio Risk Ranking
• CVE Filtering
• New Vulnerability Statuses
• Assessment Delivery
• Performance Enhancements
18

20. © 2018 Denim Group – All Rights Reserved
Portfolio Risk Ranking
19

21. © 2018 Denim Group – All Rights Reserved
CVE Filtering
20

22. © 2018 Denim Group – All Rights Reserved
New Vulnerability Statuses
21

23. © 2018 Denim Group – All Rights Reserved
Integrated Service Delivery
• Make service requests from platform
• Initial catalog of services: security testing /
assessment
• Future services: false positive culling, remediation
triage
• Receive and view results directly within
platform
• Load-balance between internal
efforts/capabilities and Denim Group’s
resources
22

24. © 2018 Denim Group – All Rights Reserved
Assessment Delivery
23

25. © 2018 Denim Group – All Rights Reserved
Make Service Requests From Platform
24

26. © 2018 Denim Group – All Rights Reserved
View Results Within Platform
25

27. © 2018 Denim Group – All Rights Reserved
ThreadFix 3.0
Preview

28. © 2018 Denim Group – All Rights Reserved
Unified Vulnerability Management
27

29. © 2018 Denim Group – All Rights Reserved
References
ThreadFix Web Site
ThreadFix 2.7 blog post
ThreadFix 3.0 preview blog post
Hybrid Analysis Mapping patents release
HotSpot patent release
28

30. © 2018 Denim Group – All Rights Reserved
Building a world where technology is trusted.
@denimgroup
www.denimgroup.com
29
dan@denimgroup.com
kyle@denimgroup.com