S&T at RSA Conference 2024

DeepBits has developed an AI-powered platform for large-scale accurate binary code identification across languages and hardware platforms. They will be leveraging this platform to generate Software Bill of Materials (SBOMs) for the Cybersecurity and Infrastructure Security Agency (CISA) directly from application binaries to firmware images in a way that will provide continuous protection and integration into the software supply chain lifecycle. DeepBits’ solution will also help create new risk assessment capabilities.

Manifest provides end-to-end bill of materials lifecycle management—from SBOM solicitation, enrichment, analysis, visualization, and secure sharing—to industry leading AIBOM generation and management capabilities. Manifest’s technologies enable the building and buying of more secure software. They will be applying this expertise to develop a solution that helps improve transparency of the CISA software supply chain as a key component to ensuring the security of critical infrastructure systems.

Scribe provides an end-to-end software supply chain security software as a service (SaaS) platform that secures code throughout its entire software supply chain and software development life cycle. Scribe Hub easily integrates with your pipeline to give you deep visibility, integrity protection, risk insights, and continuous compliance with the leading standards such as Secure Software Development Framework (SSFD) by NIST, and Supply Chain Levels for Software Artifacts (SLSA) by Google. Scribe signs and verifies the evidence cryptographically, enriches it with open intelligence sources, and analyzes aspects such as integrity to mitigate tampering risk. They will leverage their online SaaS platform to design a solution that will allow CISA to generate shareable product SBOMs and pipeline attestations automatically to gain insights into risks and continuous code assurance.

TestifySec unifies developers and cybersecurity teams in defending against software supply chain threats by integrating zero trust governance principles into build pipelines. We create transparency and accountability with our open-source and commercial products that observe, manage, and act on metadata at each step of the software or AI model generation process. Everyone deserves secure software.