Deepfence ThreatMapper 1.2.0 helps DevSecOps professionals identify critical vulnerabilities

Deepfence released ThreatMapper 1.2.0, which offers significant feature upgrades since the first fully open source release of the project in October 2021.

ThreatMapper 1.2.0 adds several in-demand features, including Attack Path Visualization, with a more sophisticated and representative calculation of the Most Exploitable Vulnerabilities, support for discovering and scanning AWS Fargate workloads for vulnerabilities, ARM support, and support for integration with Google Chronicle.

Deepfence also has added several community-inspired performance improvements and bugfixes, including better support for Kubernetes and containerd hosted workloads, better registry scanning, improved report generation, and UI enhancements.

Since the first open source release, the ThreatMapper project has grown to over 1,000 stars on GitHub and tens of thousands of pull requests from DockerHub. The project has been instrumental in assisting users in the onerous task of identifying vulnerable components, such as Log4j instances, in their running applications.

“We’re excited to bring these new features to ThreatMapper and provide our growing community of open source users with the tools they need to keep their organizations safe in the face of continuous and sophisticated security threats,” said Owen Garrett, Head of Products and Community at Deepfence. “By making it easier to scan and identify critical vulnerabilities both pre- and-post-deployment, the ThreatMapper project is quickly becoming essential software for securing the software supply chain and identifying vulnerabilities in production. By open sourcing and adding new features to ThreatMapper, Deepfence remains committed to building the best solution possible for the benefit of all industries.”

ThreatMapper’s primary purpose is to help DevSecOps professionals identify the key security vulnerabilities that need to be addressed first because they present the greatest risk to the security of the organization’s production applications. ThreatMapper 1.2.0 makes this task even easier, especially with its new Attack Path Visualization.

Identifying potentially-exploitable vulnerabilities may seem easy when you just consider directly-connected internet-facing services, but it is much harder to find vulnerable services that are further downstream, behind proxies and exposed indirectly to potentially malicious traffic. ThreatMapper monitors network traffic across multiple hops, finding these hidden attack paths by continuously correlating vulnerabilities with network traffic.

ThreatMapper also has added full support for AWS Fargate workloads, support for ARM which unlocks IoT and Edge use cases, support for Google Chronicle, as well as wider support for containerd and Kubernetes platforms. With these additional layers of support, Deepfence continues to make critical improvements to vulnerability scans while increasing speed for the more complex scans needed to identify today’s most sophisticated security threats.