Yael Citro
Ox Security emerges from stealth with $34M to provide end-to-end software supply chain security
The company also announced its collaboration with leading cyber-security-conscious enterprises to create an open standard for verifying the security of software throughout the entire development process
Tel Aviv, Israel, September 29, 2022 — Ox Security, the end-to-end software supply chain security platform for DevSecOps, exited stealth today with $34M in funding led by Evolution Equity Partners, Team8, and M12, Microsoft’s venture fund, with participation from Rain Capital. OX was founded less than a year ago by Neatsun Ziv and Lior Arzi, two top Check Point executives. Its platform is already used by over 30 leading companies to secure their software supply chains, including Kaltura and Bloomreach.
The rise in software supply chain attacks, like the SolarWinds hack, prompted last year’s executive order requiring vendors to provide a software bill of materials (SBOM). This software “ingredients list” can help security teams understand if a newly disclosed vulnerability impacts them. However, industry experts caution that it isn’t comprehensive enough to prevent attacks or address the challenges of securing today’s dynamic software supply chains.
“The introduction of SBOM is an important step, however, it isn’t sufficient to ensure the security and integrity of software supply chains,” said Admiral Mike Rogers, former director of the NSA. “Recent high-profile breaches — like those that affected SolarWinds, Codecov and Log4j — could not have been detected or prevented with the static list of software components contained in an SBOM. There’s a real risk of providing a false sense of protection by having a standard for compliance that does not equate to security.”
To address these issues, OX is developing a new open standard, PBOM, in collaboration with leading cybersecurity-conscious companies. The Pipeline Bill of Materials (PBOM) includes within it the SBOM but goes further, covering not only the code in the final product but also the procedures and processes that impacted the software throughout its development. OX and its partners undertook extensive research on the root causes of more than 70 attacks from the past year. They specifically designed the PBOM to contain the information that would have been needed to prevent each of the recent attacks.
OX’s platform is the first product using the PBOM standard to provide end-to-end software supply chain security, allowing it to cover every step of the development pipeline, from the earliest planning stages until deployment to production. OX seamlessly integrates with existing tools and infrastructure to monitor and record every action affecting software throughout the entire development lifecycle. It gives security and DevOps teams complete visibility and control over the attack surface, including source code, pipeline, artifacts, container images, runtime assets, and applications.
“Developers and DevOps make constant changes to the software supply chain, adding new tools, open source components and SaaS services,” said Neatsun Ziv, OX’s CEO and co-founder. “The OX platform gives DevSecOps teams real-time, end-to-end visibility into all aspects that impact software through the entire pipeline, so they have the necessary context and control to ensure security.”
OX connects to an organization’s code repository and performs a scan of the environment from code to cloud, to automatically produce a full mapping of assets, apps and pipelines. OX identifies which security tools are in use, verifies they’re all connected and operational, and determines if additional tools are necessary. Following the scan, OX presents any security issues that were found, prioritized by their business impact, alongside context, automated fixes and recommendations, empowering DevSecOps teams to tackle their cybersecurity backlog. A PBOM, which includes an SBOM, version lineage, SaaSBOM, build hashes and more, can be automatically generated and shared with internal stakeholders or customers, so they in turn can verify that the software they use is derived from trusted, secure builds.
“Ox Security is tackling a critical challenge facing companies today, and are uniquely positioned to become leaders in their space,” said Nadav Zafrir, Managing Partner at Team8 Group and former head of Israel’s elite intelligence Unit 8200. “We are thrilled to join forces with Neatsun and Lior. The ground-breaking PBOM standard enables OX’s platform to provide unparalleled security coverage and I have no doubt that PBOM will be widely adopted across the industry.”
PRESS RELEASE
