Veracode Boosts Supply Chain Security Via Phylum Acquisition

Veracode purchased a Denver-area software supply chain startup led by a former Air Force computer scientist to help detect malicious packages in real time.

See Also: Accelerating defense missions with a global data mesh

The Boston-area application risk management provider said increasing software supply chain attacks such as the SolarWinds campaigns necessitate proactive measures like a strong database of vulnerabilities and exploits, plus real-time monitoring capabilities, said Veracode Chief Product Officer Ravi Iyer. Phylum’s detection capabilities will be integrated into Veracode’s software composition analysis platform, he said.

“More and more software is being written with open source and with malicious packages coming in,” Iyer said. “It’s become a huge attack vector, compromising the risk of many applications and companies. And we found this is a critical capability for our software composition offering, and we felt that doing a quick acquisition in the space would be beneficial to our customers and their overall security.”

Phylum, founded in 2020, employs 14 people and has raised $19.5 million of outside funding, most recently completing a $15 million Series A funding round in May 2022 led by ClearSky. The company has been led since inception by Aaron Bray, who spent two years as a red team developer at Sony, three years as an Air Force computer scientist, and six months as a senior system administrator at Leidos (see: Veracode CEO on Mastering Application Security in the AI Era).

What’s Driving the Surge in Supply Chain Attacks

Nation-state involvement has added more complexity to securing the supply chain, with attackers using short-lived, targeted campaigns to infiltrate systems and achieve objectives ranging from intelligence gathering to financial theft. The rapid growth in malicious packages detected in open-source settings exemplifies the urgency, with the figure rising from a few thousand quarterly to over 10,000 in the past 90 days.

“Now, we’ve gotten a couple of North Korean campaigns,” Bray told Information Security Media Group. “And in the case of the North Korean campaigns, it’s not just intelligence they’re looking for. There’s sort of financial motivations that they’re going after to steal cryptocurrency and other things.”

Veracode’s decision to acquire Phylum was driven by the need to bring advanced supply chain security capabilities to market faster. Building a similar tool in-house would have been time-consuming, and could result in Veracode falling behind competitors. Phylum’s ability to spot malicious packages at scale, combined with its low false positive rate, complements Veracode’s mission to enhance its SCA portfolio.

“We were initially looking to build this on our own, but we wanted an accelerated time to market, and that meant building it on our own would have been too slow for this,” Iyer told Information Security Media Group. “Hence, we went looking at Phylum.”

Phylum’s strength lies in its ability to detect and analyze malicious packages in real time using advanced machine learning models and heuristics, supported by a database that catalogs malicious software. The product is well-suited for enterprises dealing with large volumes of dependencies, and it complements Veracode’s existing SCA tools, which focus on identifying vulnerabilities and license compliance issues.

“We built a large aggregation platform that lets us look and analyze the open source ecosystem at scale, and we have a talented research team that’s been able to encode heuristics and analytics and machine learning models that can take and service indicators of risk in packages in near real time,” he said. “That allows us to allow customers to pre-screen suspicious packages or packages that have potential issues.”

How Veracode, Phylum Will Come Together

The integration process will involve combining Phylum’s database and detection tools with Veracode’s existing SCA workflows, which will enable customers to identify and block malicious packages more effectively while benefitting from a unified security platform. Iyer said Veracode initially will focus on its current customer base in industries like finance and then expand into new verticals and geographies (see: Veracode Promotes Brian Roche to CEO, Buys Longbow Security).

“What we will probably do is put a very aggressive roadmap to deliver this as part of our SCA offering into the hands of our customers,” Iyer said. “The Phylum team that’s coming in is going to be focused and dedicated on that effort.”

While some competitors in the software composition analysis space have started adding supply chain capabilities, Iyer said the Phylum acquisition will help Veracode leapfrog them by integrating more advanced capabilities. An all-in-one approach supports emerging standards such as the OpenSSF’s Secure Supply Chain Consumption Framework, which Bray said aims to improve software supply chain maturity.

“Some of them offer it, but the strength of their offering is maybe a version 1.0,” Iyer said. “This allows us to propel ourselves into a 3.0 or a 4.0 version. Most of them have done this organically, whereas this allows us to propel ourselves to the lead in this kind of offering.”

The success of the acquisition will be measured through the adoption of Phylum’s technology among Veracode’s existing customers, the ability to block malicious packages effectively, and the generation of new business opportunities, according to Iyer. New customer acquisition will also be a critical metric, he said, especially in industries and geographies where Veracode already has a strong presence.

“A key metric for us will be attachment – how many of our existing customers have upgraded to the new offering that includes Phylum?” Iyer said. “And how many of them are blocking and preventing malicious packages from coming in? And then, of course, how many new business opportunities does this open up for us, where this was critical reason for a new business to come to us?”