Open Source Runtime Protection

When it is not possible to quickly upgrade a vulnerable library, open source run-time protection can be a lifesaver. It also shrinks your attack surface by up to 90% and dramatically reduce remediation efforts.

How to protect log4j instantly at run-time with Julius Musseau and Delan Elliott

Schedule a Demo Watch DEMO

Protect your software supply chain at run-time:

Visibility and Monitoring:

RunGreen tracks your applications instances to all data centre including cloud and gives you a complete and up to date overview of risk and actual usage.

Instant Protection:

With MergeBase you can instantly reduce risk in production for vulnerabilities that have not
been remediated yet.

Superior Prioritization:

RunGreen collects high-level usage data for all libraries in a system which in turn, helps inform and prioritize triage and patching work for development teams.

What’s better than a “Software Bill of Materials (SBOM)?”

You use SBOM to determine the risk you run in production. MergeBase provides security analysts with an instant component inventory and “live” vulnerability reports. This component inventory is far superior to the “Software Bill of Materials” (SBOM) produced by traditional SCA vendors because RunGreen references actual software running in production. Unlike vulnerability reports generated by traditional SCA’s at earlier stages of the software development lifecycle, the live vulnerability report is based on automatic tracking of deployed libraries within every application instance in every data centre or cloud it is deployed to.

Notifications for detection and blocking can be broadcast to all stakeholders

When my enterprise is unable to eliminate all known application vulnerabilities, what effective options are left?

Enterprises often face scenarios that prevent them from eliminating known vulnerabilities. Sometimes, resolving a vulnerability involves a large scale upgrade that is not feasible for your enterprise to implement. MergeBase offers effective options in these scenarios. You can disable the library or specifically the suspicious method in the library to prevent any execution or invocation of its functionality (“blocking”) and be marked for
closer monitoring. Once blocked, any attempt by an adversary to invoke the library a notification is broadcast to operations and security team

Discover More from MergeBase

Open Source Protection

Stay on top of the real risk of open source at any time.

Avoid false positives and get sophisticated upgrade guidance based on risk, compatibility and popularity.

Add RunTime Protection

Detect and defend against known-vulnerabilities at runtime. The only SCA to do so.

The quickest way to respond to an imminent threat like log4j with CVE-2021-44228.

Shift Left Now

CodeGreen is an early-warning defence for your in-house development and integrates directly into GitHub and BitBucket