New Features – February 2023 – Vulnerability Management Improvement

AppSec Phoenix February Release

The Cloud Security and AppSec teams at Phoenix Security are pleased to bring you another series of functionalities for vulnerability management and improvements. This release builds on top of our recent V3 release with key additions and improvements across multiple areas of the platform.

We are sure that you’ll find these quite interesting!

  • Manage your Vulnerabilities and Assets
    • Provide additional details in the vulnerability tickets.
    • Improve timing and SLA information in the Vulnerabilities list.
    • Update Risk Elements and Impact information display.
    • Evolve reporting functionality
  • Risk and business modelling
    • Add domain (FQDN) to the set of filters in Software context rules.
    • Updated risk formula better captures Application criticality
  • Integrations
    • Ability to select scanner targets when creating integrations
    • Notify users if they reach their asset license limit
    • Outbound asset API (preview)
  • Other improvements and features
    • Improve progress feedback in the frontend
    • Update 3-rd party dependencies in line with security policies

Manage your Vulnerabilities and Assets across application security and cloud security

Provide additional details in the vulnerability tickets

We want to make engineers’ live as easy as possible, and one important part of that is ensuring that they can continue working with their everyday tools while enjoying the benefits of Phoenix Security.

In this release, we have increased the details included in the issue tickets created by Phoenix Security so that engineers don’t have to leave their favourite workflow tools to gather information about the vulnerability and its resolution. There are still some links to extended information that we include in the ticket, but the key data should now be present directly in the ticket description.

Improve timing and SLA information in the Vulnerabilities list

In an information-rich platform like Phoenix Security times, it’s challenging to balance the level of detail and clean user interfaces. However, we keep trying to hit the sweet spot, and this time we have focused on the timing and SLA information displayed on the Vulnerabilities page.

Now you have a consolidated view of the time that a vulnerability has been open and it’s ticket created while receiving clear indication and details of the status of the vulnerability with regards to defined SLAs.

New SLA Timer Screen

Update Risk Elements and Impact information display.

With the improvement of the risk formula during our V3 release cycle, we introduced and updated adjustment factors at different levels of the calculation. In line with those changes, we are updating our information display to reflect better the key elements that conform to the risk calculation.

New Contextual Risk formula screen

Evolve reporting functionality

Phoenix Security is primarily a real-time risk exploration platform; however, there are times when a snapshot report is necessary for external communication. We are in the process of updating our PDF reporting infrastructure and have, temporarily removed this feature from the front until it’s fully updated.

Risk and Business Modelling

Improved filters in Software context rules

Now you can use the domain name (FQDN) as part of the Context Rules for software assets. These rules make it easy to define the locality (Internal, External, DMZ) of assets based on their attributes.

New Application Security Domain Contextual Rules

Updated risk formula better captures Application criticality

In our constant quest to refine our risk calculation, we have adjusted the weight and range that the application criticality (impact) factor has on vulnerability risk. This ensures that vulnerabilities affecting critical applications get a larger risk uplift, in line with expectations.

Integrations

Ability to select scanner targets when creating integrations

Phoenix Security is all about gathering and consolidating any assets and vulnerabilities your organisation is already detecting through scanners. However, there are times when some of the projects or targets included in the scanning are not relevant for day-to-day vulnerability and risk management.

This is where another of our key principles comes into play: avoid noise and duplication. And with this release, users can select exactly which scanner targets (projects, applications, etc.) are ingested by our engine. This is as simple as selecting to fetch all targets, only those specifically selected or all of them except for a few exclusions, whatever suits your use case.

Notify users if they reach their asset license limit

With the release of V3, much of the interaction with the scanners happens asynchronously in the background. This is necessary in order to properly manage the volumes of data that our clients have, but it makes feedback loops a bit more complicated.

With this release, we have included a notification event whenever a client reaches their licensed asset limit during a background operation. The user will receive an email as well as an on-screen notification.

Outbound asset API (preview)

As a technical preview, we are releasing the initial implementation of our outbound API. If you are interested in this feature, please let us know so we can guide you through your specific use case.

Other improvements and features

Improve progress feedback in the frontend.

We are continuously working on improving our user’s experience, and this time around, we have focused on the “interaction feedback loop”. When our users interact with Phoenix Security’s front end, it’s essential that they know when the platform is working to provide the results of each interaction: vulnerability lists, data updates, etc. These might seem like a secondary feature of the platform, but letting the user know when she has to wait for a page or data refresh avoids confusion. Fortunately, these feedback elements (e.g. loading spinners) don’t spend too long on our screens!

Update 3-rd party dependencies in line with security policies

We are constantly updating our frameworks and libraries to ensure that they are free of vulnerabilities. Most of the time, these are just minor updates (patches) to individual components.

In this release, it was the turn of one of our key frameworks to get a significant update. This will ensure that we work with the latest and better-maintained version of the framework.

Get in control of your Application Security posture and Vulnerability management

Alfonso brings experience running international teams for multi-million dollar, technologically advanced projects for Telefónica, IBM and Vodafone. Alfonso joins with two decades of experience working for tech leaders, including at Dell EMC, Yahoo! and Intershop.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Are never-ending critical alerts leaving you scrambling? Explore how reachability analysis identifies vulnerabilities that truly matter, saving your teams from needless patch frenzies. This session, hosted by the OWASP NYC Chapter, uncovers the latest insights in ASPM, remediation techniques, and application security best practices. Attendees learn how to streamline vulnerability management through practical examples, advanced risk scoring, and live demonstrations of container-based architectures. Expect lively discussions, real-world success stories, and expert tips on targeting only the exploitable weaknesses—rather than chasing every single alert in your backlog.
Francesco Cipollone
The cybersecurity landscape is evolving rapidly, demanding a threat-centric, risk-based approach to vulnerability management. With the U.S. favoring voluntary guidelines and Europe enforcing stricter regulations, organizations must navigate compliance while focusing on real exploitability over CVE volume. This blog delves into ASPM, cloud security, and regulatory intelligence, exploring how businesses can move beyond the traditional patch-and-pray model to address root cause vulnerabilities before they become critical risks.
Francesco Cipollone
Enhance your vulnerability management with Application Security Posture Management (ASPM) and reachability analysis. Discover how ASPM helps prioritize exploitable vulnerabilities, reduce security noise, and improve risk management. Learn about advanced techniques like code and container reachability, contextual deduplication, and Phoenix Security’s cutting-edge solutions for smarter, more effective application security.
Francesco Cipollone
The 2024 CWE Top 25 is out, and it’s no casual stroll through the vulnerability garden—especially when ransomware operators are busy planting path traversal exploits, while bug bounty hunters dig up endless injection flaws. In this blog, we examine the biggest risers, the most surprising dips, and the divergence between real-world exploit data and official CWE rankings. We’ll also reveal how AI-driven ASPM (Application Security Posture Management) and Phoenix Security’s contextual risk-based approach unite to help you focus on your most pressing threats. After all, not all flaws are created equal—some are simply more mischievous than others.
Francesco Cipollone
The 2024 CWE Top 25 list highlights the most dangerous software weaknesses. This article explores the methodology behind the list and how AI is improving threat detection. Discover how Application Security Posture Management (ASPM) and unified vulnerability management can help organizations address these critical threats.
Francesco Cipollone
Phoenix Security kicks off 2025 with recognition from Gartner Digital Markets through GetApp, solidifying its position as a leader in Application Security Posture Management (ASPM). Recognised for best customer success and support in ASPM, Phoenix Security empowers organisations with comprehensive, contextual vulnerability management and actionable cybersecurity solutions. With a user-friendly interface, robust real-time monitoring, and seamless risk prioritisation, the platform reduces alert fatigue while delivering precise remediation. As a cloud security leader, Phoenix Security continues to innovate, partnering with enterprises like LastPass and ClearBank to tackle the modern cybersecurity landscape head-on.
Francesco Cipollone
Derek

Derek Fisher

Head of product security at a global fintech

Derek Fisher – Head of product security at a global fintech. Speaker, instructor, and author in application security.

Derek is an award winning author of a children’s book series in cybersecurity as well as the author of “The Application Security Handbook.” He is a university instructor at Temple University where he teaches software development security to undergraduate and graduate students. He is a speaker on topics in the cybersecurity space and has led teams, large and small, at organizations in the healthcare and financial industries. He has built and matured information security teams as well as implemented organizational information security strategies to reduce the organizations risk.

Derek got his start in the hardware engineering space where he learned about designing circuits and building assemblies for commercial and military applications. He later pursued a computer science degree in order to advance a career in software development. This is where Derek was introduced to cybersecurity and soon caught the bug. He found a mentor to help him grow in cybersecurity and then pursued a graduate degree in the subject.

Since then Derek has worked in the product security space as an architect and leader. He has led teams to deliver more secure software in organizations from multiple industries. His focus has been to raise the security awareness of the engineering organization while maintaining a practice of secure code development, delivery, and operations.

In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

Jeevan Singh

Jeevan Singh

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James

James Berthoty

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

christophe

Christophe Parisel

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris

Chris Romeo

Co-Founder
Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

jim

Jim Manico

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.

The IKIGAI concept
x  Powerful Protection for WordPress, from Shield Security
This Site Is Protected By
ShieldPRO