Back
VISIBILITY & RISK ASSESSMENT
Go beyond SBOM with XBOM
Apiiro integrates and connects throughout the development lifecycle to build an exhaustive and continuous application inventory. We call it your eXtended software bill of materials (XBOM).
- Connect your source control management system and runtime sources to understand every facet of your application and software attack surface.
- By mapping component interconnections, risks, and changes over time, Apiiro closes gaps left by siloed tools and detects toxic combinations.
- With continuous visibility into your applications, you can reliably govern usage and minimize sprawl without having to rely on developers and security questionnaires.
Deep Code Analysis (DCA)
With our patented Deep Code Analysis (DCA) technology, we go beyond vulnerability detection to continuously analyze code and extrapolate all application components, insights, and risk context.
DCA is the foundation of Apiiro’s XBOM, transforming the complexity of cloud-native applications into a structured and contextual inventory for understanding your application attack surface.
Code-to-runtime context
Although deeply rooted in code, Apiiro enriches its inventory with runtime connectors, surfacing crucial risk context such as whether risks are deployed, internet-exposed, or behind a WAF.
Our code-to-runtime modeling enables us to match runtime APIs, containers, and security alerts to their sources in code, identify code owners, and map the entire exposure path of risks.
XBOM
What’s included in Apiiro’s application inventory?
Deeply rooted in code and enriched with runtime sources, Apiiro’s XBOM illuminates your entire application and software supply chain attack surface, including code modules, data, APIs, authorization and authentication controls, infrastructure, and more.
Application
Modules
APIs
GraphQL operations
Protobuf services
Languages
Technologies
OSS dependencies
OSS licenses
Serverless
Storage bucket
Supply Chain
Projects
Repositories
Source control managers
CI/CD Pipelines
Pipeline dependencies
Artifacts
Secrets
Contributors & teams
Tracked Issues
Data & Controls
Authorization
Authentication
Encryption
Session management
Key management
Data models
GraphQL objects
Protobuf messages
Data access objects
Sensitive data
Infrastructure
Infrastructure as code
Container images
Containers
Kubernetes services
Workloads
Clusters
Cloud providers
Cloud App Engine
API gateways
WHY APIIRO?
More than just visibility
Our XBOM is the foundation for everything we do. It provides the necessary context to prioritize findings, exposes coverage gaps, and gives you the visibility to deeply understand your application security posture. Because of our depth of visibility, it also surfaces risks, insights, and context that no other ASPM can.
- Apiiro’s deep inventory is what generates the context needed for accurate prioritization of security findings based on risk likelihood and impact.
- Apiiro analyzes developer behavior and surfaces insights to automatically identify security champions and flag anomalous behavior.
- By detecting, auditing, and tracking all material code changes, Apiiro takes the guesswork and manual data validation out of meeting regulatory requirements.
Explorer
Ask and answer any question about your application and software supply chain components, their connections, and their associated risks with Apiiro’s query-based Explorer.
Material change detection
Apiiro monitors each and every code change to automatically determine which may introduce material changes or risk, to more efficiently trigger security reviews, agile threat models, or other security controls.
Coverage map
Because Apiiro has visibility across your repositories and your security testing tools, we can map your testing coverage to expose gaps and redundancies.
Illuminate your app attack surface
Get a demo of Apiiro’s Deep ASPM platform.
Learn more about Apiiro’s visibility-first approach
XBOM Checklist: 16 Key eXtended Software Bill of Materials Components
Why You Need an XBOM: An eXtended Software Bill of Materials
