What is our primary use case?
I use Cycode for SAST scanning, Infrastructure as Code, and secret scanning, with a current proof of concept underway for containers.
Cycode scans all items when code is pushed into the Git repository, including secrets in that repository or in pull requests. This allows visibility into whether any secret tokens, email IDs, or data that should not be present are included before production deployment. The recommendation is to use vaults to save token secrets for application use. If someone has not adhered to this practice or accidentally used a token during development and forgot to change it before production, Cycode helps catch these violations. In the event of a code leak or cyber attack where code is exploited by vulnerabilities, tokens and secret information are not lost and cannot be further used to elevate application privileges.
Cycode results are integrated into the homegrown ASPM solution called Scout by using its APIs. Cycode has a valuable feature called risk intelligence that informs when there is a leak regardless of its source and provides a list of affected repositories. This helps in taking action and preparing an action plan. It becomes easier to resolve issues when the exact repositories are identified, and if a package is found vulnerable, it is possible to check which applications are using it. Cycode provides that repository information, so affected repository owners can be contacted to resolve issues, thus protecting against attacks or allowing countermeasures to be taken against tokens.
What is most valuable?
Cycode has an extensive vulnerability list, great AI that helps obtain vulnerability resolution, and risk intelligence features. Additionally, Cycode has seamless integration with GitHub, which saves time in the pipeline. Other tools like Checkmarx require integration into the pipeline, which takes additional time. Cycode reduces pipeline time and saves development time. The developer community in the organization is happy with Cycode, specifically with the GitHub integration feature.
Cycode's AI helps with vulnerability resolution because, while other tools have AI for resolving vulnerabilities, the key difference is that Cycode has access to GitHub and can actually read the code to give more appropriate answers. It analyzes the code instead of just small snippets like other tools do. While it does not work one hundred percent of the time, it works most of the time, helping developers fix code quickly and providing examples of how to mitigate risk. For instance, if there is an SQL injection vulnerability, Cycode suggests sanitizing it beforehand. If the developer has not done it already, Cycode will analyze it and recommend how to fix the code, providing specific lines of code or a snippet on how it should look.
Cycode has positively impacted the organization by saving time in the pipeline and providing one platform for secret scanning, SAST, and Infrastructure as Code facilities. Cycode has a great ASPM solution feature that gives a dashboard and informs about vulnerabilities or risks in the application. Most notably, it has streamlined the experience for those waiting for pipeline results. After getting the result, developers see it in one tool and can simply go back to GitHub to view results without navigating through different tools. This saves considerable time, and when all information can be accessed in one application, it creates substantial value.
What needs improvement?
Many organizations use legacy applications with COBOL, and currently a different tool is used for COBOL applications due to compliance requirements. It would be beneficial if Cycode increased the languages they support. While they have significantly increased support and are trying to improve their engines, Cycode could enhance container-specific capabilities. Currently, Cycode does not have good container security, and while it is a full solution, companies desiring a single platform must seek additional tools to scan container images. On the code side, it is satisfactory, but it lacks detection for OS-level vulnerabilities on the container side, which is an area for improvement.
Cycode receives a rating of eight out of ten, with two points deducted because it does not provide the full platform value that Cycode aims to achieve as a complete platform for everything needed. Container functionality is particularly critical as development mainly revolves around containers, and security in that space is essential. It is not a new area, and it is believed that adding it would boost value and support customers.
Cycode has good access control and compliance, but in the organization, a different team handles anything related to AI governance. While Cycode appears to possess good access control features, it might not offer the most helpful insight concerning governance. However, Cycode has enough flexibility for everything and everyone involved.
Regarding AI capabilities, Cycode is approximately eighty to eighty-five percent effective. The remaining percentage reflects its limitations, as it does not fully comprehend GitHub code like a developer or human would. It would be beneficial if Cycode could enhance their AI by introducing an optional checkbox asking developers if suggestions were helpful or seeking data where developers feel the answers are inappropriate. This feedback mechanism could significantly improve AI capabilities.
For how long have I used the solution?
I have used Cycode for about two years and integrates well into existing workflows without requiring an additional pipeline, making the transition seamless. During migration from Checkmarx to Cycode, this aspect helped tremendously because it was not necessary to create scripts or coordinate closely with each team; onboarding was straightforward. Cycode's great integration with GitHub gives it a significant advantage, especially as many industry tools strive for similar integration.
What do I think about the stability of the solution?
What do I think about the scalability of the solution?
Cycode's scalability has been excellent thus far with no scalability issues encountered in the organization, which consists of approximately four thousand projects, each containing a multitude of repositories.
How are customer service and support?
Customer support has been excellent. While there has not been frequent direct interaction with customer support, from what has been heard during meetings, the rating would be nine out of ten.
Which solution did I use previously and why did I switch?
Checkmarx was previously used as the solution. The reason for switching was convenience, as Cycode is more convenient due to its direct integration with GitHub, unlike the Checkmarx on-premises solution that was in place, which only provided SAST capability. For nearly the same pricing, although exact pricing cannot be confirmed, three services are now accessed with Cycode: SAST, Infrastructure as Code, and secret scanning.
How was the initial setup?
An automated onboarding process is not currently in place, but a script or solution for developers organization-wide is being developed. Cycode has a pretty good onboarding page that is excellent. The significant advantage experienced with Cycode is that multiple services are leveraged; when a project or team is onboarded onto Cycode, it covers three services, highlighting that benefit. Beyond that, there is nothing remarkable that distinguishes it compared to other tools in the industry.
Cycode is utilized as a SaaS solution hosted on a private cloud.
What about the implementation team?
The company does not have a business relationship with Cycode vendor aside from being a customer.
Which other solutions did I evaluate?
A proof of concept was conducted for multiple tools, including GitHub Actions, Checkmarx as the previous tool, and Cycode, along with considering additional tools.
What other advice do I have?
In the organization, sub-organizations have a regulatory compliance requirement to perform a SAST scan or security scan before going into production. Cycode helps adhere to these requirements well; while Cycode did not support Rust previously, it has now included the Rust language. However, support for legacy applications is still lacking, which presents a challenge since Cycode's vendor team has mentioned they do not plan to address this issue. Although it posed a challenge when transitioning from Checkmarx to Cycode, the experience has been beneficial overall as it delivers exact data and allows developers to see which repositories contain vulnerabilities. It even provides options to archive repositories that are no longer in use or required.
Cycode allows marking something as a false positive, giving the power to manage security findings effectively. This access is restricted to only the team admin for that specific project, enabling them to mark items as false positives as needed.
Cycode is not being used as a medium to create tickets or anything of that nature in the organization.
Cycode provides an extensive dashboard that aids in prioritizing vulnerabilities and security issues that need addressing first, and it also features a customized risk score that can be utilized for prioritization.
For others looking into using Cycode, if they seek a tool with multiple services, excluding container services, Cycode is a solid option. It is a solid option for at least SAST and secret scanning, despite the non-use of SCA. Cycode offers excellent secret scanning capabilities, and there does not appear to be another solution at the same pricing level that provides an equally good secret scanning tool like Cycode does.
Overall, Cycode receives a rating of eight out of ten.
