Our ambition isn’t incremental improvement. It’s radical transformation.
The Fatal Flaw
Currently there is no solution that protects you against zero-day attacks.
This is because as advanced as application security has become, all existing approaches are based on a fatal flaw.
Response is in the past.
By focusing on the threat vector, you automatically constrain your response to a problem that has already happened.
Whether it’s remediating a known vulnerability, scrambling to contain a zero-day exploit, or combing through open-source libraries to find a known weakness, all existing strategies focus on the threat vector and response therefore comes after the event.
That means that no matter what you do, your programs are always going to be vulnerable to attack. If you want to keep your programs safe, you need to change your approach.
Vulnerabilities are not the Problem
As controversial as it sounds, vulnerabilities are not the real problem.
The real problem is how those vulnerabilities are used to corrupt and exploit how your programs behave.
What if instead of trying to find and fix those vulnerabilities, you focused on what your programs are doing?
Better yet, what if you could know for sure what the full gamut of a program’s behavior was, and be able to enforce that it only ever does what you expect?
The real breakthrough in application security isn’t finding every possible flaw; it’s enforcing the expectation of behavior.
Introducing Program Behavior Intelligence™ (PBI™)
Logic paths; Function calls; Data interactions.
Together, they define what “expected” looks like.
Everything else, every unexpected call, unusual instruction, or unauthorized path, is, by definition, an anomaly.
And if that anomaly never executes, compromise never happens.
Program Behavior Intelligence™ (PBI™) is a radical new approach to Application Security.
It shifts your focus away from the backward-looking problem of vulnerabilities to the forward-looking enforcement of program behavior.
If software can only do what it’s designed and trained to do, it cannot be hijacked to do something else.