Azul boosts Java security with improved runtime vulnerability detection
Azul has introduced enhanced vulnerability detection capabilities to its Intelligence Cloud that aim to reduce false positives and improve the accuracy of identifying Java application security risks.
The company's updated solution, called Azul Vulnerability Detection, now uses class-level production runtime data to detect known vulnerabilities within Java applications. This approach contrasts with conventional application security (AppSec) and application performance monitoring (APM) tools, which often flag vulnerabilities based on component file names or software bill of materials (SBOM) data. Such traditional practices can generate a large volume of false positives, which the company asserts unnecessarily divert DevOps teams' time and effort.
Based on findings from the Azul 2025 State of Java Survey & Report, a significant proportion of organisations are affected by this problem, with 33% indicating that more than half of their DevOps teams' time is spent addressing false positives related to Java Common Vulnerabilities and Exposures (CVEs) alerts. The broad-brush flagging approach, which does not distinguish between components actually used in production and those simply present, can result in alerts for unused or non-critical vulnerabilities.
Azul's approach leverages data from Java application production environments to establish whether vulnerable classes in a component are executed, rather than simply existing as part of a packaged file. The company claims this refinement enables the solution to eliminate up to 99% of false positives, translating to a potential 100 to 1,000 times reduction compared to earlier detection methods.
The technical approach
The solution operates by applying a curated knowledge base that maps CVEs to individual Java classes used at runtime. By examining actual code paths executed in live environments, the system can determine whether a flagged vulnerability is relevant and warrants action.One example cited is CVE-2024-1597, which affects specific versions of the PostgreSQL Java Database Connectivity (JDBC) driver.
This high-severity vulnerability, which scores 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS), can only be exploited when the driver is used in a particular non-default configuration. Conventional tools issue alerts if the driver is present in the application package, regardless of how it is used, contributing to unnecessary remediation efforts. Azul's detection mechanism discerns whether any of the 11 susceptible classes out of 470 in the component are used, thereby reducing irrelevant alerts.
Key benefits
According to Azul, the Intelliigence Cloud's Vulnerability Detection capability provides several benefits to enterprises managing extensive Java estates. These include continuous, real-time detection of vulnerabilities in production environments, which helps teams rapidly triage and prioritise critical issues in high-stakes scenarios like the Log4j vulnerability event. The platform retains both real-time and historical data on component and code use, using AI methods to focus forensic investigations on vulnerabilities actively exploited prior to their discovery.
Azul's vulnerability team updates the system's knowledge base with newly identified CVEs, using AI to monitor sources such as the National Vulnerabilities Database (NVD) and other repositories. The runtime data collection works across Oracle JDK as well as any OpenJDK-based Java Virtual Machine (JVM), providing flexibility for organisations using a range of Java distributions, including those from Amazon, Temurin, Microsoft, and Red Hat. Azul states that this data-gathering incurs no impact on production system performance, as it leverages information already generated by the JVM during application execution. "The improved Vulnerability Detection features strengthen the proposition of Azul's Intelligence Cloud analytics SaaS offering as a way to increase DevOps productivity and recover developer capacity by reducing the need for full-time employee time spent wasted on security false positives and inefficient triage," said William Fellows, research director at 451 Research, part of S&P Global Market Intelligence.
Company statement "Our mission is to help enterprises focus their security efforts on what matters - real risk, not noise," said Scott Sellers, co-founder and CEO of Azul. "By eliminating up to 99% of false positives and pinpointing vulnerabilities in Java applications with 100x – 1000x greater accuracy than traditional tools, Azul Intelligence Cloud enables capacity recovery across DevOps and security teams. As a result, teams can dramatically reduce noise, prioritise real risk and accelerate remediation - all with zero impact to performance and without slowing innovation."
Azul's enhancements to its Intelligence Cloud are positioned to address long-standing productivity challenges faced by DevOps teams handling Java application security, particularly the time lost to managing irrelevant or inaccurate alerts.
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Techday NZ
2 days ago
- Techday NZ
Azul boosts Java security with improved runtime vulnerability detection
Azul has introduced enhanced vulnerability detection capabilities to its Intelligence Cloud that aim to reduce false positives and improve the accuracy of identifying Java application security risks. The company's updated solution, called Azul Vulnerability Detection, now uses class-level production runtime data to detect known vulnerabilities within Java applications. This approach contrasts with conventional application security (AppSec) and application performance monitoring (APM) tools, which often flag vulnerabilities based on component file names or software bill of materials (SBOM) data. Such traditional practices can generate a large volume of false positives, which the company asserts unnecessarily divert DevOps teams' time and effort. Based on findings from the Azul 2025 State of Java Survey & Report, a significant proportion of organisations are affected by this problem, with 33% indicating that more than half of their DevOps teams' time is spent addressing false positives related to Java Common Vulnerabilities and Exposures (CVEs) alerts. The broad-brush flagging approach, which does not distinguish between components actually used in production and those simply present, can result in alerts for unused or non-critical vulnerabilities. Azul's approach leverages data from Java application production environments to establish whether vulnerable classes in a component are executed, rather than simply existing as part of a packaged file. The company claims this refinement enables the solution to eliminate up to 99% of false positives, translating to a potential 100 to 1,000 times reduction compared to earlier detection methods. The technical approach The solution operates by applying a curated knowledge base that maps CVEs to individual Java classes used at runtime. By examining actual code paths executed in live environments, the system can determine whether a flagged vulnerability is relevant and warrants example cited is CVE-2024-1597, which affects specific versions of the PostgreSQL Java Database Connectivity (JDBC) driver. This high-severity vulnerability, which scores 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS), can only be exploited when the driver is used in a particular non-default configuration. Conventional tools issue alerts if the driver is present in the application package, regardless of how it is used, contributing to unnecessary remediation efforts. Azul's detection mechanism discerns whether any of the 11 susceptible classes out of 470 in the component are used, thereby reducing irrelevant alerts. Key benefits According to Azul, the Intelliigence Cloud's Vulnerability Detection capability provides several benefits to enterprises managing extensive Java estates. These include continuous, real-time detection of vulnerabilities in production environments, which helps teams rapidly triage and prioritise critical issues in high-stakes scenarios like the Log4j vulnerability event. The platform retains both real-time and historical data on component and code use, using AI methods to focus forensic investigations on vulnerabilities actively exploited prior to their discovery. Azul's vulnerability team updates the system's knowledge base with newly identified CVEs, using AI to monitor sources such as the National Vulnerabilities Database (NVD) and other repositories. The runtime data collection works across Oracle JDK as well as any OpenJDK-based Java Virtual Machine (JVM), providing flexibility for organisations using a range of Java distributions, including those from Amazon, Temurin, Microsoft, and Red Hat. Azul states that this data-gathering incurs no impact on production system performance, as it leverages information already generated by the JVM during application execution. "The improved Vulnerability Detection features strengthen the proposition of Azul's Intelligence Cloud analytics SaaS offering as a way to increase DevOps productivity and recover developer capacity by reducing the need for full-time employee time spent wasted on security false positives and inefficient triage," said William Fellows, research director at 451 Research, part of S&P Global Market Intelligence. Company statement "Our mission is to help enterprises focus their security efforts on what matters - real risk, not noise," said Scott Sellers, co-founder and CEO of Azul. "By eliminating up to 99% of false positives and pinpointing vulnerabilities in Java applications with 100x – 1000x greater accuracy than traditional tools, Azul Intelligence Cloud enables capacity recovery across DevOps and security teams. As a result, teams can dramatically reduce noise, prioritise real risk and accelerate remediation - all with zero impact to performance and without slowing innovation." Azul's enhancements to its Intelligence Cloud are positioned to address long-standing productivity challenges faced by DevOps teams handling Java application security, particularly the time lost to managing irrelevant or inaccurate alerts.
Techday NZ
2 days ago
- Techday NZ
Contrast Northstar brings real-time AI to application security
Contrast Security has announced the general availability of its new platform, Northstar, aimed at providing a unified application security experience for development, AppSec, and security operations teams. The Northstar release introduces features which allow teams to monitor application-layer attacks in real time, mitigate breaches, and remediate vulnerabilities using artificial intelligence within minutes, according to the company. The Contrast Graph Central to the platform is the Contrast Graph, which creates a digital twin of an organisation's application and API environment. The Graph maps live attack paths, monitors runtime behaviour, and visualises the connection between vulnerabilities, threats, and system assets to facilitate prioritisation and remediation. The company states that this live, dynamic context is intended to "eliminate the guesswork that plagues traditional tools" by focusing efforts on actual risk and allowing targeted, automated responses. Contrast's approach combines runtime data, contextual analysis, and AI-enabled auto-remediation in an effort to reduce noise and enable precise responses. Tyler Shields, Principal Analyst at Enterprise Strategy Group, said: "Connecting security operations processes with application security incident and vulnerability detection capabilities is a significant step towards breaking down the silos that exist between developers, application security, and security operations teams. This broad contextual analysis offering lends itself well to advanced AI-based prioritisation and automated remediation, which are the key security outcomes required by security organisations today." Runtime intelligence The Northstar release is designed to give Security Operations and AppSec teams a real-time understanding of application-layer threats as they occur. Active vulnerabilities can be auto-remediated with the new Contrast AI functionality, using live context and dynamic risk scoring to support decision making. The unified platform offers different views tailored to specific roles, so that developers can focus on prioritising remediation while SOC teams can identify and act on the most critical threats. Martha Gamez-Smith, Information Security Officer at Texas Computer Cooperative | Education Service Center, Region 20, commented: "We are excited to see the new features and feel that Contrast is set apart from other competitors, beyond reach. It makes our jobs better and easier. The real data will allow our team to take action more efficiently." Contrast Northstar pairs runtime intelligence with automation, and aims to streamline how organisations defend software against evolving risks by providing a shared perspective for development, security, and operational teams. Unified user experience The new release delivers a visual experience built around the Contrast Graph, providing real-time visibility into attacks, vulnerabilities, and business risks. These views can be tailored for each team and integrated with existing developer, CNAPP, and SIEM tools. The Contrast Graph functions as a live map, helping teams to better understand the relationships between vulnerabilities, threats, and assets to enable collaborative response. Key features Northstar features dynamic risk scoring that prioritises vulnerabilities based on their context in production, including architecture, threats, and business risk. The platform unifies Application Detection and Response (ADR) with Application Security Testing (AST), providing shared context for incident and vulnerability correlation. This aims to break down silos between teams and improve the speed and accuracy of threat resolution. The Contrast AI SmartFix capability utilises Graph data to generate specific remediation plans, write code, create test scripts, and draft pull requests. The Contrast MCP Server makes runtime insights available across environments, supporting future AI-driven use cases. The Deployment Hub is designed to simplify onboarding and the roll-out of updates across complex environments, helping organisations to deploy protection faster. The Flex Agent streamlines the process of agent deployment and updates, requiring no manual configuration and lessening installation times. Northstar integrates with established security products such as Splunk, Wiz, and Sumo Logic, and the company says that additional integrations and strategic partnerships will be announced in the coming weeks. Discussing the release, Jeff Williams, OWASP Founder, and Contrast Security Founder and CTO, said, "Northstar is the culmination of everything we've learned about defending modern software. We didn't just bolt together another set of tools—we reimagined AppSec from first principles. By combining runtime observability, real-time graph context, and AI-powered automation, we built a platform that doesn't just find problems—it understands them, prioritises them, and helps teams fix them fast. This is the platform I've wanted since OWASP's earliest days—one that doesn't just generate alerts, but actually defends the software that powers our world." The Northstar release is now available to partners and enterprises looking to update their application security programmes via a unified, real-time security operations and remediation toolset. Additional partnerships and integrations are set to follow in the coming weeks.
Techday NZ
3 days ago
- Techday NZ
Datadog unveils IDP to boost developer autonomy & speed
Datadog has introduced its Internal Developer Portal (IDP), billed as the first developer portal built on live observability data, aiming to support engineering teams under increasing demands for faster and more reliable software delivery. Engineering teams reportedly face rising pressure to deliver code that is not only fast and secure but also compliant with legal, regulatory, and internal policies. In this environment, developers are expected to manage a broad span of requirements, including code quality, testing, security scans, infrastructure configurations, observability, and compliance—while also understanding dependencies and real-time system performance. Increasing system complexity and corresponding cognitive load mean that developers increasingly depend on platform engineers to resolve bottlenecks, which, according to Datadog, can slow down software delivery as both groups tackle resource constraints. According to the company, the Datadog IDP is designed to grant developers greater autonomy, enabling them to ship updates quickly while adhering to established standards. The IDP relies on Datadog's Application Performance Monitoring (APM) suite to automatically map services and dependencies. This creates a real-time, unified view of performance, service ownership, and relevant engineering information. The product allows developers to build, test, deploy, and monitor software through self-service actions that include built-in guardrails for delivery. Meanwhile, platform engineers can use scorecards to track compliance with criteria such as reliability, security, and monitoring standards. Capabilities Datadog IDP incorporates several core features designed to support these objectives. The Software Catalog offers a continually updated record of organisational software, including ownership, real-time performance metrics, and links to documentation, dashboards, and source code. The catalog is automatically synchronized to Datadog's telemetry stream. Self-service actions are provided via pre-built templates, facilitating tasks such as provisioning infrastructure or triggering remediation steps without the need for direct intervention from platform engineers. These templates are powered by Datadog's App Builder and Workflow Automation tools. Scorecards, part of the IDP, allow for the setting and monitoring of pass/fail rules in areas such as reliability, security, observability, and cost, with options for both standard and custom criteria. Engineering Reports provide visibility into reliability, performance, and compliance status, supplying targeted views for team leads, developers, and executives. "Datadog's IDP brings together both observed and declared system states, as well as existing systems of record. This combination shows not only developer intention but also what is actually in production. Whether developers onboard new teams or are tasked with complex projects such as migrating code from EC2 to Kubernetes, Datadog automatically provides visibility into their systems and reflects changes as they are being made—without stale metadata or manual syncing," said Michael Whetten, VP of Product at Datadog. "Datadog IDP empowers developers to collaborate more effectively and deliver software that meets their organisation's standards, at the pace that is expected from them." The company states that IDP also enhances incident response by providing a live, central knowledge base for quicker triage and decision making during service outages or other technical incidents. This information is integrated with other tools across the Datadog platform, such as Status Pages, which uses the same ownership metadata to communicate incident scope and impact to stakeholders. Additional functionality includes a voice interface, enabling on-call engineers to query service owners, review recent changes, and access other relevant information hands-free for faster diagnostics and investigations using data from the IDP. The launch of Datadog IDP coincided with the company's announcements in areas including AI observability, applied AI, AI security, and log management.
