UltraViolet Adds AppSec Services Depth With Black Duck Deal

UltraViolet Cyber bought Black Duck’s application security testing services business to expand the company’s capabilities further left in the software development lifecycle.

See Also: 2022 Enterprise Search Trend: Machine Learning-Powered Relevance

The Washington D.C.-based offensive and defensive cybersecurity services provider said its acquisition of the 400-person business unit will get UltraViolet into application security at a time when artificial intelligence generated code is growing exponentially, said CEO Ira Goldstein. Tightly integrating assessment and response will help CISOs address cyberthreats as automation, AI and global scale redefine the threat landscape.

”We experienced an AI boom over the past couple of years, and a real outcome of that has been the volume of code being generated has gotten exponentially higher,” Goldstein told Information Security Media Group. “And to us, there’s just a huge and compounding market opportunity to help secure software that’s going into production right now that has been written with AI-assisted IDEs.”

The sale of Black Duck’s application security testing unit comes less than a year after Clearlake and Francisco Partners paid $2.1 billion to acquire Synopsys’ software integrity group, which consisted of both software and services. The software capabilities will remain under the control of Clearlake and Francisco and continue to go by Black Duck, while the services capabilities will move to UltraViolet (see: Black Duck’s Blueprint for Growth as an Independent Company).

Why UltraViolet Wants to Get Into Application Security

The growing complexity and volume of code creates a massive and expanding market need for early-stage application security services. Rather than only engaging in traditional pen testing after code is in production, UltraViolet wants to be embedded earlier in the software development lifecycle. The AST services from Black Duck allow UltraViolet to provide threat modeling and architecture advisory.

“At its core, we wanted to do more in application security and offensive security services beyond just pen testing, and go earlier in the SDLC,” Goldstein said.

UltraViolet’s existing offensive services such as pen testing and red-teaming occur late in the development or deployment process, but Goldstein said this model no longer suffices in a world where software is being built and shipped quickly. The deal boosts UltraViolet’s ability to engage in advisory services such as threat modeling, helping clients build security into their applications rather than bolting it on afterward.

“In traditional SOC, typically the person you’re escalating to is not the developer of software,” Goldstein said. “You don’t say to them, ‘Hey, you should go build better software.’ It’s other places in the business where they then go on a process to fix something that’s been identified as being a risk.”

Application security testing offers an opportunity to work directly with developers, engage in threat modeling, influencing the architecture and design of applications before they’re deployed. UltraViolet wants to treat every vulnerability as a ticket with a clear workflow toward remediation while also infusing offensive expertise into the SOC to improve the relevance and quality of threat detections.

“In application security testing, you really get a chance to create this partnership and build a relationship with developers and help them,” Goldstein said. “Whether it’s through formal engagements or just through the feedback loop of application security testing, to tell them, ‘Hey, these are a couple of things that you can do from an architecture perspective in order to build more resilient applications.'”

How UltraViolet, Black Duck Will Come Together

Goldstein envisions giving all existing UltraViolet customers access to a new interface and feature set that enables self-service test coordination, feedback loops with testers and visibility into the application security testing workflow. By embedding AST into the broader UV Lens environment, Goldstein said customers can manage both offensive and defensive services from a unified dashboard.

“We want to get this right and make sure that we make it clear to customers what the breadth of our offerings look like with this deal getting done,” Goldstein said. “I think it’s very important to us to make these discrete capabilities clear and available to our combined customers.”

Goldstein said Black Duck doesn’t intend to build a full-fledged application security software product, but will instead partner with best-in-class providers including Black Duck and integrate its technology into the service workflow. This helps UltraViolet remain focused on what it does best – service delivery – while still offering customers the technology tools required for success, Goldstein said.

“The motion of a company to be a software company investing in R&D, and to be a services company who also has a platform but is really focused on services over time,” Goldstein said. “In some companies, those belong together, and in some companies, they don’t.”

Goldstein said the acquisition will be successful if current customers stay and continue to invest while new customers join because of the enhanced capabilities. UltraViolet also wants to maintain the talent acquired in the Black Duck deal, supporting them through training and development, and unifying them under the company’s mission, according to Goldstein.

“Customers vote with their dollars, and employees vote with their presence,” Goldstein said. “We want to make sure that all existing customers remain with us, and that new customers join in and are excited about this vision.”