- Black Duck Software uses AI to speed up sending security advisories to customers.
- It says that with AI it can send out about five times its usual number of notifications a month.
- This article is part of "CXO AI Playbook" — straight talk from business leaders on how they're testing and using AI.
For "CXO AI Playbook," Business Insider takes a look at mini case studies about AI adoption across industries, company sizes, and technology DNA. We've asked each of the featured companies to tell us about the problems they're trying to solve with AI, who's making these decisions internally, and their vision for using AI in the future.
Black Duck Software, formerly Synopsys Software Integrity Group, offers security products and services — including security testing, audits, and risk assessments — to help companies protect their software. Black Duck is headquartered in Burlington, Massachusetts, and has about 2,000 employees.
Situation analysis: What problem was the company trying to solve?
Beth Linker, a senior director of product management for AI and static application security testing at Black Duck, said the company had been using artificial intelligence internally for several years but recently began developing the tech for its customers.
The company sends Black Duck Security Advisories, or BDSAs, to notify users that their software is at risk and potentially exploitable. Linker said this spring Black Duck started using generative AI to send BDSAs faster so that customers could act swiftly to address issues.
The need for speedier BDSAs arose after the National Vulnerability Database, a government cybersecurity resource that provides information on data threats, started publishing fewer vulnerability reports because of a backlog. At the same time, Linker said, the Linux kernel, an open-source operating system, began flagging more risks, significantly increasing the number of vulnerabilities it disclosed.
"The net effect was that all of a sudden you had a much larger number of vulnerabilities and less support from the National Vulnerability Database," Linker said. "This is something that was making things a lot harder for our customers because they were not able to get all the info that they were used to receiving."
Key staff and partners
Linker said Black Duck's engineering and research teams were involved in integrating gen AI with BDSAs. The system also uses some commercially available large language models.
AI in action
Linker said that accelerating BDSA delivery with gen AI was an opportunity to provide customers with a "timely and comprehensive feed of data that they need to make decisions."
To speed up BDSAs, Black Duck developed prompts, which they input into commercial LLMs, to query their internal data. This information is used to compile the advisory reports. Previously, this process was done manually.
A researcher reviews each AI-produced report before it's sent to customers. "Hallucinations are a risk," Linker said, "and everything we put in front of our customers has to meet a certain standard of quality."
Once BDSAs are created, the research teams review the reports and provide analysis and context about the seriousness of an identified vulnerability. This helps customers make decisions about the risk: Some vulnerabilities may need immediate attention, while others are less serious and could be fixed during a planned software update.
Did it work, and how did leaders know?
Linker said that more than 5,200 BDSAs were created with AI from March to October and that the company could now send out about five times the number of notifications each month that it could send before the tech was rolled out.
"We've been able to really scale this up to meet the need," they said.
What's next?
Black Duck recently unveiled Polaris Assist, an AI-powered security assistant. This new addition to the platform will help customers' security and development teams work more efficiently. It combines the company's existing application security tools with LLMs to give automated summaries of detected vulnerabilities and suggestions for how to fix the code.
"It's still a work in progress," Linker said. Polaris Assist is in beta testing, which is likely to wrap up by the end of the year.
They added that Black Duck continues to invest in AI to serve its customers. "A lot of that boils down to how can we make application security testing and remediation easier, faster, and more scalable?" they said.