Socket Acquires Startup Coana to Boost Code Risk Precision

Socket bought a Danish reachability analysis startup led by a former executive at the venture capital arm of plastic toy block giant Lego, saying the startup’s technology will reduce alert fatigue among developers and security teams.

See Also: OnDemand: Mobile Apps are the New Endpoint

The San Francisco-based software supply chain security vendor said its purchase of Aarhus, Denmark-based Coana will address customer pain points around alert fatigue and false positives in vulnerability scanning. Founder and CEO Feross Aboukhadijeh said Coana’s strength lies in its control flow and call graph analysis, allowing security teams to discern which issues are genuinely exploitable.

“Most solutions out there don’t do a great job,” he said. “They either have extremely slow performance, so you can’t really roll it out at a large company on a large code base without it taking forever. Or you have accuracy issues where they aren’t really doing a great job. When we met Coana, we felt like they had none of those problems. They built something extremely impressive from a technical perspective.”

Coana was founded in 2022, employs 10 people, and raised $1.6 million of pre-seed funding from Sequoia Capital in January 2024. The company has been led since inception by Anders Søndergaard, who previously spent nearly two years as a senior venture architect at Lego Ventures and four-and-a-half years leading biometrics company Resilio before it was acquired by meQuilibrium in March 2021 (see: Socket Accelerates Open-Source Security With $40M Series B).

A Better Approach to Alerts

Security teams today are overwhelmed by a deluge of vulnerability alerts, with as many of 80% of alerts identifying issues that, while technically present in the codebase, are not exploitable at runtime, he said. Reachability analysis examines how the code actually behaves when executed, using control flow and call graph analysis to determine whether an attacker could realistically trigger a vulnerable code path.

Aboukhadijeh said many vulnerabilities exist in the codebase that cannot be triggered or reached by an attacker due to how the application is structured. Without reachability analysis, teams are forced to address all vulnerabilities as if they’re equally dangerous, causing alert fatigue and wasted engineering effort. Reachability analysis filters out unreachable threats, allowing teams to focus on true risk.

“It’s basically analyzing what the code is going to do when it’s run to figure out whether or not a vulnerability is actually going to affect an application,” Aboukhadijeh told Information Security Media Group. “The reason this is important is that around 80% of the vulnerabilities that are reported by all the different vulnerability scanners are false positives, meaning they’re not going to affect security.”

Most tools in the reachability analysis space suffer from either extremely slow performance – taking hours or even days to analyze large repositories – or from low precision, leading to inaccurate results, he said. Socket was built by pioneers in static and control flow analysis, and Aboukhadijeh said it offered the most scalable and precise reachability solution Socket had seen.

“It’s not just about the technology,” Aboukhadijeh said. “There’s a very impressive team behind Coana. The company was founded by some of the world’s top static analysis experts.”

Unlike traditional approaches that require each user to run heavy scans inside their own environments, Socket will pre-analyze open-source dependencies and deliver real-time insights as soon as a customer connects their GitHub environment, Aboukhadijeh said. This eliminates the need for long CI/CD pipelines or resource-heavy scanning, reducing time to value and lowering the barrier to adoption.

“Even without the customer running Coana in their environment, they can get the benefits of reachability analysis,” Aboukhadijeh said. “Basically, we are pre-computing the results based on all the open source code that’s out there in the world.”

Socket will track the number of alerts avoided thanks to reachability filtering, the amount of developer and security team time saved, and what that time savings equates to in dollar value to measure the efficacy of the Coana acquisition. By eliminating false positives and irrelevant tickets, he said Socket can improve not just security efficiency, but also the relationship between engineering and security teams.

“By the end of Q2, this is going to be available all of our customers, and so we’re going to be tracking how many of them are using it and getting benefit from it, and trying to quantify that,” Aboukhadijeh said.