Introducing GitHub vulnerability management integrations for security professionals

GitHub Advanced Security (GHAS) is a developer-first application security solution from GitHub. Included in GHAS is the security overview, a dashboard that provides a birds-eye view of your security coverage, as well as the capability to identify and drill down into repositories with the most risk which require more immediate attention. Security professionals may also want to consolidate vulnerabilities from multiple sources, automate risk mitigation, and visualize GitHub alerts in the context of their organization’s existing security posture.

To help enable this, we’re pleased to introduce new partnerships with vulnerability management providers: Brinqa, Kenna Security, Nucleus, and Threadfix. These integrations will allow you to prioritize vulnerabilities in software systems and applications, and take measures to reduce the risk they pose to your business.

If your tool of choice is not included below, we’ve written a detailed integration guide that you or the vendor can follow to replicate these integrations. If you’re a vulnerability management vendor interested in following this integration path, please join our technology partner program.

Brinqa

Brinqa orchestrates the entire cyber risk lifecycle—understanding the attack surface, prioritizing vulnerabilities, automating remediation, and continuously monitoring security posture—across all security tools and programs from on-premises infrastructure to cloud to applications.

Enterprises use Brinqa’s Attack Surface Intelligence Platform as the source of truth for cyber risk. It empowers organizations to elevate the security conversation, hold risk owners accountable, identify security control coverage gaps, and manage and track all vulnerabilities in a single, cloud-based platform. You can find Brinqa’s connector to GitHub on this page.

Kenna Security

Kenna Security is a risk-based vulnerability management SaaS platform that uses machine learning to prioritize vulnerabilities based on risk. The platform integrates with a variety of security tools, including web application scanners, network scanners, and software composition analysis tools.

You can easily integrate Kenna Security within your CI/CD workflow by utilizing GitHub Actions for code scanning, Dependabot, and secret scanning alerts. One of the unique features of Kenna Security is its ability to leverage real-world exploit data and predictive modeling to provide a real risk score of each vulnerability, helping security teams better prioritize their remediation strategies.

Nucleus

Nucleus is a cloud-based vulnerability management platform that provides real-time threat intelligence and remediation guidance for fast and precise risk-based decision support. Nucleus operationalizes and unifies all asset and vulnerability data through 100+ native integrations across network scanners, application scanners, code repositories, asset inventories, endpoint detection tools, and more.

Integrating with GitHub provides visibility into application vulnerabilities across all GitHub organizations, teams, repositories, and branches, plus tools to measure the effectiveness of remediation efforts through detailed reports and analytics. A standout benefit of Nucleus is its ability to provide real-time threat intelligence within the platform, allowing organizations to identify and respond to emerging threats quickly.

Threadfix

ThreadFix is an application vulnerability management platform that has been trusted by Fortune 500 companies for over a decade. It offers dozens of integrations with various scanning and analysis tools, as well as native integrations with popular developer defect tracking tools.

GitHub’s action integration with ThreadFix allows you to upload your code scanning results directly to ThreadFix, further streamlining your vulnerability management process. With ThreadFix, you can reduce the mean time to remediate and manage your entire AppSec program from discovery to remediation. By ingesting your findings into ThreadFix, you can significantly decrease the number of code problems that require work, resulting in substantial savings in time and money for large enterprises.

Written by

Alexander De Michieli

@alexdemichieli

Griffin Ashe

@griffinashe