How Does ShiftLeft Secure Application Code?

TL;DR

ShiftLeft analyzes source code, open source libraries, frameworks, and APIs through a Code Property Graph, then creates custom micro agents to protect known vulnerabilities that remain unfixed in production. Its approach combines code analysis with code-informed runtime protection, helping security teams and developers prioritize remediation without relying only on detection of constantly changing threats.

Transcript

Our next contestant, Continuous Application Security. Please welcome CEO of Shiftleft, Manish Gupta. And welcome. Thank you. All right. Here's a clicker. And Manish, your time begins right now. All right. Our $110 billion cybersecurity industry largely mitigates issues that arise because of software defects. Yet code analysis hasn't changed in the ... Read More

Key Insights

• ShiftLeft's Code Property Graph is a semantic representation of source code that also includes open source libraries, frameworks, and APIs. It combines multiple abstract code representations into one dense, navigable graph that the presentation compares to Google Maps for source code.
• Code-informed analysis can investigate application-specific security questions, including whether personally identifiable information is written to a new destination, whether router source code contains a planted backdoor, and whether credentials are mistakenly sent to a third-party API.
• Automated vulnerability detection largely follows taint analysis. ShiftLeft applies its rule sets to customer code to find vulnerabilities, while acknowledging that application-specific business logic flaws cannot be found automatically because different applications implement different behaviors and requirements.
• Business logic analysis depends on human knowledge of the application. ShiftLeft converts source code into a Code Property Graph and allows developers or security teams to search it, rather than claiming that the platform independently recognizes every form of fraud or logic error.
• Runtime protection addresses vulnerabilities that customers do not immediately fix. In the example provided, if analysis finds twenty vulnerabilities and only five are repaired, a custom micro agent can protect the fifteen known vulnerabilities remaining in the deployed application.
• Surgical protection is enabled by precise code knowledge. ShiftLeft argues that earlier inline patching approaches struggled because they lacked accurate vulnerability understanding, while its source analysis identifies what each vulnerability is and exactly where it appears in the code.
• Reported customer results include a fintech company finding vulnerabilities twenty times faster, a technology company analyzing more than eight thousand builds and fixing more than four hundred vulnerabilities, and a large bank identifying more than three million instances of sensitive data leaking to logs.
• Application security purchasing is shifting toward developers, although customer ownership varies by organization. ShiftLeft sells to AppSec teams when working with the largest Wall Street banks, while developers are the buyers at smaller companies with one hundred or two hundred people.

Questions & Answers

Q: What is ShiftLeft's Code Property Graph?

ShiftLeft's Code Property Graph is a semantic graph representing an application's source code, including its open source libraries, frameworks, and APIs. It combines multiple abstract representations of code into one dense structure that can be navigated and queried. The presentation compares it to Google Maps for source code because it helps users explore relationships and locate security-relevant behavior.

Q: How does ShiftLeft protect unfixed vulnerabilities?

ShiftLeft creates a custom micro agent to protect vulnerabilities that were identified but not repaired before production deployment. Because its analysis determines what the vulnerabilities are and where they occur in the code, the platform claims it can protect against them surgically. This code-informed runtime approach focuses on known weaknesses rather than chasing constantly changing threats.

Q: Can ShiftLeft automatically find business logic flaws?

ShiftLeft does not claim that it can automatically find all business logic flaws. Manish Gupta says each application has different logic, so complete automation is not possible. Instead, the platform converts source code into a Code Property Graph that customers can search using their own application knowledge, including queries concerning backdoors, data handling, or other specific risks.

Q: What security problems can a Code Property Graph investigate?

A Code Property Graph can support queries about vulnerabilities and application-specific behavior. Examples from the presentation include checking whether an application violates GDPR by writing personally identifiable information to a new destination, searching router code for a planted backdoor, finding credentials mistakenly written to a third-party API, and identifying vulnerabilities across the entire application.

Q: How does ShiftLeft find software vulnerabilities?

ShiftLeft analyzes an application's code through its Code Property Graph and uses rule sets to search for vulnerabilities. Gupta says vulnerability detection largely follows taint analysis and can therefore be automated. This differs from business logic analysis, which requires knowledge of the individual application and queries designed by the developers or security specialists who understand its intended behavior.

Q: What customer results did ShiftLeft report?

ShiftLeft reported that a large fintech company used its technology to find vulnerabilities twenty times faster. A technology company analyzed more than eight thousand builds, received results within minutes of each build, and fixed more than four hundred vulnerabilities. A large bank also identified more than three million instances in which sensitive data was leaking into logs.

Q: Why does ShiftLeft combine code analysis with runtime protection?

Code analysis by itself can leave organizations facing a difficult choice: repair every identified vulnerability or deploy while accepting exposure. Gupta says customers do not fix every vulnerability they find. ShiftLeft therefore combines analysis with custom micro agents that protect known, unfixed vulnerabilities in production, allowing remediation and protection to operate as parts of a continuous security process.

Q: Who buys and uses ShiftLeft's application security tools?

ShiftLeft targets both application security teams and developers, depending on the organization. Gupta says sales to the largest banks on Wall Street are directed toward AppSec teams. At smaller companies with one hundred or two hundred people, the company sells to developers. He describes this as part of a shift that increasingly makes application security a developer responsibility.

Summary & Key Takeaways

• ShiftLeft presents continuous application security as an alternative to reacting primarily to changing production threats. Its Code Property Graph combines multiple abstract representations of application code into a single semantic graph. The graph covers source code, open source libraries, frameworks, and APIs, making application structure and behavior searchable for security analysis.

• The platform uses automated taint analysis and supplied rule sets to identify vulnerabilities. For application-specific concerns, security specialists or developers query the graph using their own knowledge. ShiftLeft explicitly does not claim to discover every business logic flaw automatically, because each application has distinct logic, risks, and intended behavior.

• ShiftLeft supplements analysis with custom micro agents that protect vulnerabilities remaining after remediation. Because the platform knows each identified vulnerability and its precise code location, it claims to apply surgical runtime protection. The intended result is continuous security improvement across development and production, serving AppSec teams at banks and developers at smaller companies.