Trend Micro will integrate its cloud security platform with Snyk’s developer-focused open source vulnerability detection service in a bid to mitigate open source code risks.

“We’re taking part of Snyk’s capability and truly embedding it into our platform,” Trend Micro COO Kevin Simzer said.

The new capabilities will help teams find vulnerabilities in open source code automatically and also support compliance with ISO 27001, SOC 2, and other key security frameworks and standards.

The two companies first teamed up about a year ago. That initial partnership focused on developers and helping DevOps teams detect vulnerabilities stemming from code reuse, public repositories, and open source. Snyk’s open source and container security technology detects and patches vulnerabilities while Trend Micro’s cloud security platform blocks them.

The extended partnership, on the other hand, targets the security operations teams. “With this new product we’re trying to address three different types of gaps,” said Geva Solomonovich, Snyk global alliances CTO. “One is a visibility gap into this very important technology, which is open source.” Open source typically falls under the developers’ purview. “And so the security team generally has less visibility into that compared to other surfaces.”

Secondly, Trend Micro and Snyk want to “bridge visibility into the process gap,” Solomonovich said. As software development shifts left to detect and prevent flaws early in the development process, “we need to give security people visibility into that,” he explained.

The final gap is an organizational one brought on by the absence of tools that enable security and Dev teams to collaborate effectively, said Solomonovich. “We are taking a step forward for the two teams to have a common language, to have a conversation, and build better security tools together versus conflict inside organizations.”

The companies are working with “leading customers” to shape the final product and plan to make it generally available by the end of the year, Simzer said.

This type of DevSecOps approach is important for a couple reasons. First, open source vulnerabilities increased 250% over the past three years, according to Snyk’s annual State of Open Source Security report.

Second, the COVID-19 pandemic and now-remote workforce pushed companies to move applications to the cloud, which expands the attack surface. “And the hackers, the bad guys, are also sitting at home and a little bit more bored, and so we have seen the amount of attacks, the frequency, and the magnitude going up,” Solomonovich said. “So this also increases the urgency and precision needed to tackle the security problem.”