Discover, Manage and Secure Your Digital Supply Chain
Get 100% Visibility and Control in minutes over your entire 3rd Party Software Ecosystem: APIs, Libraries, SDKs, SaaS Services, and Installed Software.
What
Why
How
Reduce Your Attack Surface by Understanding 3rd Party Risk Exposure
A CMDB For your code base – Next generation SBOM, API inventory, run-time data auditing, real time accurate 3rd party vendor cataloging
Visibility
Get an accurate 3rd party vendor catalog – in minutes, not months – of professional service engagements. No more point-in-time, Excel exports. See In real time who your product is talking with and what data it is exchanging.
Analysis
Understand which 3rd party APIs, code libraries, and operating system libraries pose risks, via a complete, real time Executive Order 14028 compliant SBOM. Correlate the operational posture of your product with the risk exposure from the 3rd party components, and respond to the most critical issues faster.
Security
Optionally enable Trust But Verify for 3rd party APIs to identify and prevent business logic errors and input validation errors that cause data leaks. Gain unrivaled visibility by zooming into your platform – every component, CI/CD pipeline(s) – and being able to appropriately and swiftly respond.
Compliance
Easily map data processors and the information shared with them. Simplify adherence for GDPR, FDIC, FedRamp CCPA/CPRA, ISMS, PCI and more. Respond swiftly to “Right To Be Forgotten” requests.
Legal
Get real time visibility and detect if ITAR and Data Sovereignty Policies are being violated. Validate the known documented 3rd party vendors are actually the 3rd party vendors that your software is interacting with.
"Every single technology company needs to have visibility, control and security for the software stack which brings it revenue. Riscosity is a simple, yet, effective and complete solution which enables product security to elevate their game to the next level.
– Suresh Batchu, Digital Trust Networks
"All Technology leaders need to understand the risk and dependencies of 3rd party services. Knowing what your own software uses is the critical first step."
– Frank Weigel, Lattice
"The way we build software services has changed radically. Code re-use and short launch times are the norm. 3rd party code and APIs are a reality; every enterprise needs an effective mechanism to manage its software supply chain."
– Atif Yusuf, Hewlett Packard Enterprise
"Enterprises that understand deeply the risks of doing business with their software suppliers, are the ones who can mitigate those best. The tsunami always seems far away till it hits you in the face."
– Andrew “Drew” Daniels, SVCI
"We are only as strong as our weakest link. Understanding and gaining insights into the underlying code libraries, APIs, integrations, and the associated vulnerabilities is critical for any CIO in a responsible customer focused enterprise."
– Prasad Ramakrishnan, Freshworks
"The banking Industry is at an inflection point, all banks are actively building software services and API endpoints. Inventory, analysis and security are the fundamental building blocks of any next generation financial institution's software programs."
– Rich Watson, Enterprise Bank
"Any advancement of technology that helps manage the risk of doing business is very welcome. With this approach, companies can identify the directionality of data flows, which helps understand risks associated with 3rd party vendors."
– Ken Carter, Bitmovin
"Being able to demonstrate - in real time - all the time that your company is safe to do business with will be a need for all industries. The software supply chain is tremendously complex. Being able to visualize the components and track data across them is invaluable for any public company's security program."
– Jacob Elziq, Armature Systems
"The healthcare industry is in the midst of a mass migration to the cloud. Health systems have complex tech stacks made up of off the shelf and custom solutions, and with the stringent security and privacy regulations of the industry, it is of utmost importance that health systems have robust ways to manage their software supply chain vendors."
– Punit Soni, Suki
"Conventional industries, like the construction industry, have started adopting software products in the past decades. As the number of applications is rising, the need for automation, integrations, 3rd party libraries, and APIs is also becoming crucial."
– Yaser Masoudnia, BlueTape
"Companies must be cognizant that their existing tools may not provide as much (if any) value in the cloud. Visibility is the key to determining whether old tools still provide value, and if not, what should be replaced."
– Lamont Orange, Netskope
"Every financial institution, regulated by FDIC, FINRA and other agencies, needs to have a clear understanding of the risk that all 3rd party software components pose in their own software stack. This is not a choice, it's a necessity. Those that tempt fate will get burnt."
– Bam Azizi, Front
"APIs, Code Libraries, OS libraries and Standalone Software - for online businesses these are the equivalent of property, plant and equipment that offline businesses used to rely on. Understanding which component plays what kind of part in the one's business is critical for enterprises to manage their revenues."
-Peeyush Ranjan, Google
"Much like “no man is an island”, we all know information technology is no island either. Hence, gaining visibility into the security of the software components we leverage is critical if we’re serious about reducing risk."
– Bob Hollander, HEI
Solutions
The World’s First Software Supply Chain Management Platform makes it easy for Security, Compliance and SecOps to adhere to corporate security and privacy mandates, yet maintain high velocity development and deployment processes.
Who Benefits:
Sales, Security, Compliance, SecOps and Legal
Close Larger Deals, Faster
Riscosity cuts down back and forth with your client’s security/compliance/privacy team(s) by weeks. This allows customers to recognize revenue earlier in the quarter. Riscosity makes it possible to demonstrate a complete understanding of your 3rd party data flows with your SafeChain(TM) Certificate.
Understanding True Business Risk Exposure
Riscosity generates a complete Executive Order 14028 compliant Software Bill Of Materials (SBOM) in minutes. With coverage spanning APIs, code, libraries and more, customers can clearly understand the critical dependencies of their revenue generating services. Reduce your MTTR by 70%. Finding out about CVEs and the patch itself is not the challenge. The real problem is prioritizing what in your software inventory is most affected by the issue at hand.
Preventing Accidental Compliance Violations
Riscosity helps implement Trust But Verify on 3rd party API data transfers to make sure what enterprises think they are transferring to vendors is actually what is being shared. Business logic errors due to weak input validation silently allow sensitive information to pass through; and Riscosity detects and prevents this issue.
Tracking Data Flows with Vendors
Riscosity helps customers respond quickly to “Right to be forgotten” requests and track down which piece of data was shared with which specific vendor(s). Thus, allowing a clear data flow diagram of all interaction with 3rd party data processors. With Riscosity, achieve and demonstrate better compliance with GDPR, CPRA (CCPA) and other privacy centric guidance.
The technology industry is now a colossus with systems that run into billions of dollars and cannot be replaced. This has made 3rd party integrations a necessary component of the software industry. One of the biggest challenges we now face is that the integrations are black-boxes. Lack of visibility into what systems the APIs are invoking, what information is being shared, who the 3rd parties are and their security profile is a serious concern, and can introduce a significant risk to the overall security posture of your products. A product is only as secure as the weakest link in the chain, and having that visibility is an important factor in delivering products that live up to the trust placed by your customers.
Resources
The SafeChain™ Certification Program
The SafeChain™ Certification enables Riscosity’s customers to demonstrate the highest level of assurance, akin to SLSA level 4, for their entire software supply chain from a 3rd party exposure perspective. The certification program ensures that companies can provide to their prospective clients an independently verifiable certificate which demonstrates that the potential client will not get compromised as a result of buying the customer’s software.
The Certification program provides an attestation which can show the building blocks of the software a client is about to purchase and deploy. This enables a potential client to check off all necessary pre purchase due diligence in minutes instead of weeks.
The various certification levels progress upwards based upon the amount of security guidance implemented by the certified party. Average timelines to obtain Level 1 certification can be as less as 1 calendar week and for Level 3 can range from 30-60 calendar days.
There is no charge for the certification process for Riscosity customers, and non customers may also get certified for a small fee.
Security Thought Leadership Series
In this series we explore how security leaders around the world perceive the issues, solutions and technologies that help with solving the Digital Supply Chain crisis.
This series of episodes is product agnostic, does not discuss any feature sets covered by Riscosity and provides an educational bent to understand the core problems rather than publicize a specific solution or strategy.
Please subscribe to our Youtube channel to stay in touch with new releases with influential CISOs, CIOs and C level Executives.
Blog
On this blog , team members from Riscosity and invited security leaders share their thoughts on the state of the Digital Supply Chain.
What is HIPAA and the HIPAA Privacy Rule?
The HIPAA Privacy Rule is a federal law that protects the privacy of health information and establishes standards for business practices. Signed in 2001, it covers all forms of protected health data held by covered entities (like doctors or hospitals) as well as their...
Software Supply Chain Risk Management: Identifying and Mitigating Risks in ICT (Information and Communications Technology) Software
In this article, we discuss the software supply chain risk management process needed to protect your business from risks in the software supply chain and how that affects product development speed in what seems like an ever-changing market landscape. While not exhaustive regarding managing risks in a software supply chain, it does cover the important basics.
Vendor Risk Management – Benefits, Process, Software & Tools
What is vendor risk management? Vendor risk management is a process that helps businesses manage the risks associated with their vendors. Vendor risk management involves understanding and managing the risks posed by your vendor relationships. This includes assessing...
A Comprehensive Guide to Open-Source Security – Components, Code, and Tools
What is open source security? Open source security is a term used to describe the process of protecting your organization's data and network from attack by using open-source software. Open source security refers to the use of open-source software for data protection....
What is SBOM (Software Bill of Materials) and why do you need it
Why do organizations need a software Bill of Materials? A Software Bill of Materials (SBoM) is a document that lists all of the software components and their versions that are used in the organization’s revenue generating product. The SBoM is used to track and manage...
What is application risk assessment and how do you perform it?
What is application risk assessment? Application risk assessment is the process of evaluating and understanding the security risks associated with an application. This metric is used to help organizations make better decisions about how to protect their applications...
Understanding and Managing Your Shadow Liability in 5 Minutes
Understanding Risk is a complicated subject. In the world of Information Technology, the FAIR framework is well accepted. However there are some areas of operational risk that are simple to understand and verbalize, but actually difficult to measure. In this article...
API Security is the “David S. Pumpkins” Of Security Programs
There we go - Anirban is at it again! What now? Saturday Night Live (SNL) has a great skit based on a character played by veteran artist- Tom Hanks. I call this the "David S Pumpkins" (DSP) series. The reactions of the SNL characters, mainly the couple riding in the...
NIST Guidance – Defending Against Software Supply Chain Attacks
In this article, we will provide a breakdown of the NIST guidance for defending against software supply chain attacks. A software supply chain attack occurs when a cyber threat actor infiltrates a software vendor’s network and employs malicious code to compromise the...
What is Digital Supply Chain Security and Why is it Important?
Ever since the coronavirus pandemic began, people have been talking about how businesses have been moving online more and more. However, this development only accelerated and brought attention to a dynamic that was already occurring. One sign of this is the growth of...
About
We are a small, effective team of repeat entrepreneurs. We believe in transparent discussions, a friendly and open minded work environment and are intensely focused on customer success. We are based in Austin, Texas and the San Francisco Bay Area. Our Mantra is – Stay Focused, Stay Hungry, Stay Humble.
Team
Anirban Banerjee
CEO, Co-Founder
James Greene
VP of Engineering, Co-Founder
Jeremy Swedroe
Senior Software Engineer
Nick Mahnke
Senior Software Engineer
Miriam Kappen
Senior Software Engineer
Jonathan Litovitz
Senior Platform Engineer
Oliver Bock
Marketing Lead