Snyk is security tooling for developers, covering code, dependencies, containers and infrastructure as code.
The challenge: every vulnerability looks urgent
An exploit is a demonstration of how a vulnerability can be taken advantage of. When an exploit is widely published, it is commonly referred to as an exploit "in the wild."
A scanner returns hundreds of known vulnerabilities, many of them marked critical. A development team can't fix all of them, and at equal urgency the genuinely dangerous ones wait behind the ones that are only severe on paper. Shani Gal owned the new exploits in the wild feature.
The solution: prioritize by what is actually being exploited
The new Snyk feature separated vulnerabilities with exploits observed in the wild from the rest. The new filter enabled users to filter for the vulnerabilities that were more or less likely to pose a threat:
- Mature: Snyk has published a code exploit for this vulnerability.
- Proof of concept: Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.Proof of concept vulnerability patches cannot be disabled and are visible in the fix PRs where they are found.
- No known exploit: Snyk did not find a proof-of-concept or a published exploit for this vulnerability.
- No data: The issue is not a vulnerability, but a license issue or a vulnerability advisory.
Why
As was true for most of our activity at Snyk during that year, we needed to educate the market and also launch the product feature to support adoption.
