Withnetworks Presents AI-Powered Vulnerability Combination Correlation Analysis

Integrates services, SBOMs, and APIs to analyze complex security threats Provides unified management from identifying externally exposed assets to remediation and verification

withVTM의 자산 관리 대시보드

Withnetworks, an artificial intelligence (AI)-powered information and communications technology (ICT) and cybersecurity specialist, has introduced Vulnerability Combination Correlation Analysis, a technology that links services, software bills of materials (SBOMs), and application programming interfaces (APIs) to analyze complex security threats.

On October 21, Withnetworks, led by CEO Ahn Jong-up, announced that its integrated asset and vulnerability management platform, withVTM, helps organizations analyze not only vulnerabilities in individual IT assets but also risks arising from combinations of multiple security weaknesses, enabling them to determine remediation priorities.

As security breaches continue to affect the financial sector, organizations are strengthening security assessments across externally exposed IT assets and services. A key challenge is to identify all systems accessible from outside, regardless of whether they provide customer-facing services, and verify that authentication and access controls for internal information, including personal data, are properly implemented.

However, even when organizations maintain server and software inventories and scan for vulnerabilities, it can be difficult to understand the overall threat landscape if individual assets are not mapped to the services they support. Open-source libraries and packages, as well as APIs omitted from management systems, are particularly easy to overlook in conventional asset management frameworks.

To address this issue, withVTM expands asset management beyond servers and IP addresses to include services, APIs, and software components.

The platform identifies the servers and applications that make up each service, then maps internal libraries, packages, and dependencies through an SBOM for centralized management.

CTEM 기반 자산 및 취약점 통합 관리 플랫폼 withVTM

It supports the international SBOM standards CycloneDX and SPDX and verifies software supply chain integrity through hash and digital signature validation. When a vulnerability is discovered in a particular component, organizations can trace the assets and services that use it to determine the scope of impact and identify the systems requiring remediation.

The platform also integrates API security management capabilities. Without requiring agents to be installed, it uses network scanning to identify shadow APIs that have been omitted from existing management systems and examines whether they are externally exposed, how authentication and authorization are implemented, and how data can be accessed.

At the core of the platform is Vulnerability Combination Correlation Analysis, which examines the relationships among multiple vulnerabilities.

Even if individual vulnerabilities have relatively low severity ratings, a vulnerable library, inadequate security configuration, and excessive access privileges can combine through an externally exposed API to create an attack path to sensitive data.

withVTM analyzes these compound risks using the relationship data connecting services, assets, SBOMs, and APIs. It also applies Withnetworks’ patented AI-based Risk Scoring (VRS) technology to assess asset criticality, vulnerability scores, signs of active exploitation, and external exposure collectively.

“Properly assessing externally exposed systems starts with understanding which assets, software components, and APIs make up those systems,” said Ahn Jong-up, CEO of Withnetworks. “With withVTM, we aim to help customers, including organizations in the financial sector, establish continuous security management frameworks by identifying all systems that need to be assessed and prioritizing combinations of weaknesses that could lead to real threats.”

---

원문 보기

전자신문