Tel Aviv, Israel, September 29, 2022 — Ox Security, the end-to-end software supply chain security platform for DevSecOps, exited stealth today with $34M in funding led by Evolution Equity Partners, Team8, and M12, Microsoft’s venture fund, with participation from Rain Capital. OX was founded less than a year ago by Neatsun Ziv and Lior Arzi, two top Check Point executives. Its platform is already used by over 30 leading companies to secure their software supply chains, including Kaltura and Bloomreach.
The rise in software supply chain attacks, like the SolarWinds hack, prompted last year’s executive order requiring vendors to provide a software bill of materials (SBOM). This software “ingredients list” can help security teams understand if a newly disclosed vulnerability impacts them. However, industry experts caution that it isn’t comprehensive enough to prevent attacks or address the challenges of securing today’s dynamic software supply chains.
“The introduction of SBOM is an important step, however, it isn’t sufficient to ensure the security and integrity of software supply chains,” said Admiral Mike Rogers, former director of the NSA. “Recent high-profile breaches — like those that affected SolarWinds, Codecov and Log4j — could not have been detected or prevented with the static list of software components contained in an SBOM. There’s a real risk of providing a false sense of protection by having a standard for compliance that does not equate to security.”
To address these issues, OX is developing a new open standard, PBOM, in collaboration with leading cybersecurity-conscious companies. The Pipeline Bill of Materials (PBOM) includes within it the SBOM but goes further, covering not only the code in the final product but also the procedures and processes that impacted the software throughout its development. OX and its partners undertook extensive research on the root causes of more than 70 attacks from the past year. They specifically designed the PBOM to contain the information that would have been needed to prevent each of the recent attacks.
OX’s platform is the first product using the PBOM standard to provide end-to-end software supply chain security, allowing it to cover every step of the development pipeline, from the earliest planning stages until deployment to production. OX seamlessly integrates with existing tools and infrastructure to monitor and record every action affecting software throughout the entire development lifecycle. It gives security and DevOps teams complete visibility and control over the attack surface, including source code, pipeline, artifacts, container images, runtime assets, and applications.
“Developers and DevOps make constant changes to the software supply chain, adding new tools, open source components and SaaS services,” said Neatsun Ziv, OX’s CEO and co-founder. “The OX platform gives DevSecOps teams real-time, end-to-end visibility into all aspects that impact software through the entire pipeline, so they have the necessary context and control to ensure security.”
OX connects to an organization’s code repository and performs a scan of the environment from code to cloud, to automatically produce a full mapping of assets, apps and pipelines. OX identifies which security tools are in use, verifies they’re all connected and operational, and determines if additional tools are necessary. Following the scan, OX presents any security issues that were found, prioritized by their business impact, alongside context, automated fixes and recommendations, empowering DevSecOps teams to tackle their cybersecurity backlog. A PBOM, which includes an SBOM, version lineage, SaaSBOM, build hashes and more, can be automatically generated and shared with internal stakeholders or customers, so they in turn can verify that the software they use is derived from trusted, secure builds.
“Ox Security is tackling a critical challenge facing companies today, and are uniquely positioned to become leaders in their space,” said Nadav Zafrir, Managing Partner at Team8 Group and former head of Israel’s elite intelligence Unit 8200. “We are thrilled to join forces with Neatsun and Lior. The ground-breaking PBOM standard enables OX’s platform to provide unparalleled security coverage and I have no doubt that PBOM will be widely adopted across the industry.”
Additional quotes:
“Supply chain attacks are on the rise, and the attack surface is growing,” said Mony Hassid, Managing Partner at M12, Microsoft’s venture fund. “When it comes to software security and integrity, you have to look beyond which components were used and consider the overall security posture throughout the development process. Ox Security is pioneering a standard that will be transformative for supply chain security. We’re proud to work with OX to improve software security.”
“The cybersecurity industry has been playing catch-up so far by pursuing a never-ending process of patching production environments and chasing alerts, issues and fixes,” said Karthik Subramanian, General Partner at Evolution Equity Partners. “OX’s groundbreaking approach brings control back to DevSecOps teams by providing visibility and complete control over an organization’s code. The level of innovation in OX’s platform is truly remarkable and provides value to everyone in an organization — from developers to DevSecOps teams to executives.”
“I believe the PBOM standard will reverse the tide,” said Mario Duarte, Vice-President of Security at Snowflake. “I am proud to take part in a project that can have such a major impact on the future security landscape, and to share our knowledge and expertise.”
“OX is truly changing how software supply chains are protected, ensuring that all code comes from secure and trusted builds,” said Naor Penso, Senior Director of Product Security at leading applied analytics company FICO. “The OX platform prevents software supply chain attacks while accelerating and streamlining development. The PBOM framework created by OX, expands the traditional SBOM with contextual knowledge and true end-to-end lineage that drives assurance in software security across its entire life-cycle.