Veracode, Inc.

Christopher J Eng

Christopher J Wysopal

Matthew P Moynahan

Simeon Simeonov

Malcolm W Lockhart

At least a static analysis and a dynamic analysis to perform for a first software application are determined based, at least in part, on a profile of the first software application. The first software application is analyzed with the static analysis to generate static analysis results. The first software application is analyzed with dynamic analysis to generate dynamic analysis results. An assessment report is generated based on the static analysis results and the dynamic analysis results, wherein the assessment report indicates a security score of the first software application that is based, at least in part, on the static analysis results and the dynamic analysis results.

Assessment and analysis of software security flaws

Bedside shelf

Security analysis and vulnerability testing results are 'packaged' or 'bound to' the actual software it describes. By linking the results to the software itself, downstream users of the software can access information about the software, make informed decisions about implementation of the software, and analyze the security risk across an entire system by accessing all (or most) of the reports associated with the executables running on the system and summarizing the risks identified in the reports.

Security assessment and vulnerability testing of software applications is performed based at least in part on application metadata in order to determine an appropriate assurance level and associated test plan that includes multiple types of analysis. Steps from each test are combined into a 'custom' or 'application-specific' workflow, and the results of each test may then be correlated with other results to identify potential vulnerabilities and/or faults.

Growing community of inventors

Lexington, MA, United States of America

Christopher J Eng