Snyk bolsters developer security with fresh devsecop, cloud capabilities

Snyk bolsters developer security with fresh devsecop, cloud capabilities

Snyk aims to bolster security support for developers across their software supply chain with coding, cloud and devsecops enhancements.

Credit: iStock

Cybersecurity application provider Snyk has added fresh capabilities to its flagship developer security platform to improve programming productivity and help secure software supply chains.

The series of enhancements to Snyk’s namesake platform includes security support for C/C++ applications, new capabilities for infrastructure as code (IaC), automated security for  container supply chains, and new devsecops collaboration features.

Using an in-house built, AI-based engine, Snyk scans C/C++ codes in development to identify all open source dependencies, associated vulnerabilities, and license compliance issues. The new capability offers features to help developers identify and fix issues as they code.

New support features include Snyk Learn lessons to help C/C++ developers fix manually copied code in applications. The aim is to help bolster security for desktop, server, and web application developers alike.

“C/C++ is still one of the top 10 programming languages in use today,” said Story Tweedie-Yates, head of product marketing at KSOC, a cybersecurity company that focuses on container infrastructure.  “In terms of new applications, it’s most dominant in the gaming industry (because it has great real-time performance) and in terms of older software it’s behind most major software applications like web browsers or Adobe. So, the addition of support for C/C++ apps is not insignificant.”

Languages currently supported by Snyk include Python, Java, JavaScript, Go, php, and .Net.

The Snyk update also includes integrations with new devsecops products from providers including AWS, ServiceNow, Jira and Dynatrace. Snyk has integrated with ServiceNow’s Vulnerability Response application and AWS CloudTrail Lake — both cloud workload visibility tools — to help bolster the security posture of  enterprise software supply chains.

Securing cloud apps with IaC

Snyk has also enhanced Snyk IaC with cloud-specific capabilities, which  automatically link running cloud resources to an IaC source template — a code infrastructure blueprint. This will enable security teams to trace a particular cloud issue back to its source code and notify the right team to fix it.

While the new features are important for fixing misconfigurations at the IaC level,  they  still cannot serve as a replacement to cloud security posture management (CSPM) for cloud resources. While IaC can be thought of as an architectural blueprint, CSPM secures the actual building, said Yates.  

“With IaC, you make sure the blueprint all adds up to create a great plan. With CSPM, you are closing down windows that have been left open in the actual building that was built from that plan,” added Yates.

In the analogy, Snyk’s enhancement trace back a window built with wrong shape in the actual building to the exact place in the blueprint where the plan was laid out and fix it there, Yates explained.

Snyk Container has also received an upgrade, offering enhanced support for “golden images,” which refer to standardised, preconfigured container bases used for the deployment of multiple instances of an application or service. Golden images are an important tool for managing container deployments, as they provide a consistent and repeatable deployment process that can be easily automated.

The extended support to these golden images has “quite a niche appeal” as the images take a lot of time, sometimes years, to develop and are only accomplished by the most mature devops organisations, according to Yates.

Snyk is priced in different tiers: a free plan unlocks a set number of security test types for IaC and open source dependencies, developer code, and containers; Team and Enterprise versions, which start at $52 per user, have unlimited test capabilities for different code types and open source dependencies; and a custom, pay-as-you-go level is aimed at companies with developers who want to access different modules.

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.


EDGE 2024

Register your interest now for EDGE 2024!



How MSPs can capitalise on integrating AI into existing services

How MSPs can capitalise on integrating AI into existing services

​Given the pace of change, scale of digitalisation and evolution of generative AI, partners must get ahead of the trends to capture the best use of innovative AI solutions to develop new service opportunities. For MSPs, integrating AI capabilities into existing service portfolios can unlock enhancements in key areas including managed hosting, cloud computing and data centre management. This exclusive Reseller News roundtable in association with rhipe, a Crayon company and VMware, focused on how partners can integrate generative AI solutions into existing service offerings and unlocking new revenue streams.

How MSPs can capitalise on integrating AI into existing services
Access4 holds inaugural A/NZ Annual Conference

Access4 holds inaugural A/NZ Annual Conference

​Access4 held its inaugural Annual Conference in Port Douglass, Queensland, for Australia and New Zealand from 9-11 October, hosting partners from across the region with presentations on Access4 product updates, its 2023 Partner of the Year awards and more.

Access4 holds inaugural A/NZ Annual Conference
Show Comments