Polaris: Your no-compromise SaaS AST solution

Security at the speed of DevOps

Development teams need application security testing (AST) tools that bring simplicity, scalability, and power in addition to speed. Polaris fAST Static and fAST SCA services are built on the same powerful analysis engines at the core of Synopsys market-leading Coverity® and Black Duck® products, integrated and delivered from the cloud via the latest version of Polaris Software Integrity Platform®.

The industry has been moving to cloud-based solutions for development toolchains for several years now because cloud-based options are more affordable, scalable, flexible, and easier to use. Development teams also want these benefits from their AST tools, but until now, most cloud-based AST platforms have forced them to give up one or more of their basic demands. An intuitive platform might not be powerful enough to uncover security problems in complex applications. But a tool that is fast locally may not scale for enterprise. Most cloud-based AST systems perform well for static application security testing (SAST) but poorly for software composition analysis (SCA), or vice versa.

Speed without compromise

Polaris delivers a SaaS AST solution that doesn’t require teams to make these compromises. Polaris is the only platform on today’s market that provides both best-in-class SAST and SCA in a single solution. Teams no longer have to settle for a platform that is strong in SAST but weaker in SCA or vice versa. With Polaris, you get a solution that gives you fast, accurate, and comprehensive SAST and SCA analysis to identify security risks in both your proprietary code and open source dependencies.

With Polaris, your teams get multiple powerful analysis engines in a single solution that provides

• Accurate analysis. Polaris fAST static and fAST SCA are built on market-leading analysis engines, giving you fast and accurate detection of vulnerabilities in source code and open source.
• Flexible configuration. Teams can easily configure Polaris to run different tests at different times based on application, project, schedule, or software development life cycle (SDLC) events.
• Unified view of results. With Polaris, teams can easily review and prioritize security issues across proprietary code, open source components, container images, and infrastructure-as-code templates.

Polaris offers simple, powerful, and scalable AST analysis that simplifies life for both security and development teams while scaling to manage multiple applications and releases across hundreds or thousands of projects.

The integrations you need

Modern software development is defined by integration and automation. Continuous integration (CI) systems automate the build, test, package, and deploy processes. Teams might miss deadlines or be forced to omit tests in order to stay on schedule if their tools don’t integrate smoothly into their CI workflows.

The automated vulnerability scanning and assessment in Polaris enable teams to test and triage continuously. For instance, teams can plan routine security checks that will automatically retrieve and analyze code from GitHub or GitLab repositories. Alternatively, events in Jenkins and other CI workflows can be used to trigger SAST or SCA scans. For ad hoc tests, teams can upload code directly using the Polaris interface.

Polaris can also accelerate vulnerability triage and remediation by defining policies that alert teams or "break the build" when high-severity vulnerabilities are detected. And assigning bugs to developers for correction is simple with the Polaris integration with Jira. Polaris empowers teams to build fast and secure with the tools you already have.

Manage testing across teams, applications, and scan types

The majority of the responsibility for application security testing, triage, and vulnerability fixes falls on development teams, while security teams, particularly in midsize to large enterprises, are typically responsible for the overall coverage and performance of the AppSec program. With integrated reports and dashboards, Polaris helps security teams manage testing throughout their organization by providing insights into

• Vulnerability trends. Using views that display vulnerability severity and type information across applications, projects, and test types, teams can locate AppSec hotspots in portfolios.
• Test status and performance. Teams receive a real-time view of ongoing and completed tests for all projects, applications, and teams.
• Admin adjustments. To maintain the integrity of test environments and help with troubleshooting, administrators can keep track of configuration changes.