Jeff Williams

Contrast Security Founder & CTO
Streamlining appsec with runtime security

[Jeff Williams @planetlevel]

Check out my latest article: How to Vulnerability https://t.co/tWgS2xtDn2 via @LinkedIn

[Sam Stepanyan @securestep9]

#OWASP @LASCONATX Conference is starting with @planetlevel 's keynote about the flawed mindset holding security back:
#LASCON

[Isaac Levin @isaacrlevin]

Had a great time chatting with @planetlevel on Coffee & OSS today about all kinds of #tech topics. Video is live on YouTube and podcast is available wherever you find them. Take a look/listen and thanks!
https://t.co/MC5g9cyK3q

[Contrast Security @contrastsec]

Join us on August 14 to learn why existing approaches to application security fall short, and how #DevOps principles can improve #AppSec practices. Register here: https://t.co/vw6OImOAkb

[Jeff Williams @planetlevel]

@dbleich Into the Kandinskyverse

[Kate Brew @securitybrew]

Austin #owasp chapter meeting coming up 3/26 at lunchtime. Both in-person with free lunch and virtual. Great speaker - @planetlevel ! Register here: https://t.co/0pxvP4cUEl

[Contrast Security @contrastsec]

Break free from the tunnel vision of traditional AppSec tools like #SAST and #DAST. They lack context, leading to a skewed view of your application security. Our Co-Founder and CTO @planetlevel breaks down the modern-day solution on @AppSecPodcast: https://t.co/sslXFf5sLJ

[Contrast Security @contrastsec]

In the 2023 Security Survey, @forrester reports that breach numbers continue to rise. Watch the webinar recap with @planetlevel and #Forrester analyst, Janet and learn how to secure your #apps in 2024 with a context-focused solution, Runtime Security: https://t.co/ldYbTU7L7M

[Founders Circle Capital @FoundersCC]

Congratulations to @cribl_io, @contrastsec, and @druvainc for being recognized in the @Gartner_inc Peer Insights Customers' Choice 2023👏

✨Cribl - Voice of the Customer for Event Stream Processing https://t.co/6zM54yg3PQ
✨Contrast Security - Voice of the Customer for AppSec Testing https://t.co/DBuizGN5YV
✨Druva - Only Customers’ Choice for Disaster Recovery as a Service https://t.co/3YC7z3wRdC

#gartner #gartnerpeerinsights

[Jeff Williams @planetlevel]

@IAMZee67 @contrastsec I’ll just leave this here… https://t.co/kcbO0rpuPc

[Contrast Security @contrastsec]

Ditch #AppSec's broken math and discover the modern-day approach to analyze real-time data and detect vulnerabilities: https://t.co/QgdneqAPTq

[Contrast Security @contrastsec]

We are excited to announce that our Secure Code Platform has been recognized by our customers in the 2023 #Gartner Peer Insights' Voice of the Customer for Application Security Testing! See why we received a 4.7/5 rating & a 94% willingness to recommend: https://t.co/cdIA1peZk9

[Jeff Williams @planetlevel]

This should be a good discussion building on Janet’s extensive analysis of the appsec industry

[Contrast Security @contrastsec]

Join @planetlevel, CTO and Co-Founder of Contrast, and guest speaker Janet Worthington, #Forrester Research Analyst, for an in-depth discussion on how Runtime Security is revolutionizing #AppSec. Register now 👉 https://t.co/FGqQoaigqS

[Jeff Williams @planetlevel]

@ddccffvv Agree! For most things, B is the most cost-effective approach. There are a few things that are pretty accurate early and can be found with SAST/SCA. But for most vulnerabilities, waiting a few minutes for IAST testing and full context from a fully assembled, running app is best.

[Jeff Williams @planetlevel]

@ddccffvv Over 62% of open source libraries are completely inactive - never even load into memory. Of code that does run, over 2/3 is custom code… just 1/3 is libraries. And when a library has a vulnerability, exploitation is *possible* only 10% of the time.

[Jeff Williams @planetlevel]

@ddccffvv In modern pipelines, A and B are only minutes apart. So it's not worth it to shift that far left and lose ALL the context of the running app/API. Wait a few minutes, and get a much smaller list.

[Jeff Williams @planetlevel]

@ddccffvv I don't see why Scenario B items are "bigger" -- they're the same issues as in Scenario A, but true positives.

You *could* fix a root cause, and eliminate a whole bunch of them at a time, but that's different.

[Jeff Williams @planetlevel]

@stevespringett Except that even heavyweight SAST isn’t accurate enough. Lightweight SAST is kind of a joke. If it’s fast, it’s trash :-) And if it’s slow you can’t integrate into workflows. Especially if you include triage. Try IAST if you want fast and accurate during workflows.

[Contrast Security @contrastsec]

You can't have DevSecOps without DevOps.

On the @FedGovToday podcast, @LMaccherone explains how, flow, feedback, and a culture of experimentation and learning are essential to #DevSecOps. Listen now: https://t.co/I8X13vDeiy

[ReversingLabs @ReversingLabs]

Experts say scan-and-fix will remain for some time. But #appsec tools are evolving to provide prioritization and automation. Here's what you need to know, ft. insights from @edgeroute, @travismcpeak, @planetlevel, @izar_t, and more.
https://t.co/A7oQ4KlvTr

[Contrast Security @contrastsec]

WAFs leave back-end systems vulnerable to attacks. Read @TAKellermann's thoughts on why Contrast Protect RASP is the #API solution to block back-end attacks and reduce false positives, helping your dev teams prioritize vulnerabilities: https://t.co/BqIukqI4QT