Success Story

Prexis™, from Ounce Labs, uses embedded NetCharts®
Server to report software vulnerabilities

Prexis’ software security assurance dashboard, powered by NetCharts Server, offers executives and project managers the metrics and information they need to assess risk and make the right security investments.

Ounce Labs delivers actionable metrics to help organizations assess risk and prioritize security investments in their critical applications. Customers use this information to:

• Comply with regulatory demands concerning data integrity
  and privacy;
• Hold outsourcers accountable for the security of the
  applications they deliver;
• Understand and manage application vulnerabilities

Prexis™, Ounce Labs’ flagship product family, delivers precise vulnerability metrics that security executives, managers, and developers need to understand and manage the vulnerabilities in their applications. Prexis locates and categorizes vulnerabilities in application source code using patents-pending contextual analysis
technology. Applications are then rated by vulnerability density (V-Density™) to enable comparative analysis and progress reporting. These results appear in tailored interactive reports for security officers, project managers, and application developers.

Decreasing Time to Market for Customer-
Requested Features

It was the need for an interactive, web-based reporting solution that brought Ounce Labs to evaluate a “build vs. buy” decision in 2003; the company chose to buy because the high cost to build was such a barrier. They needed a rich full featured charting and graphing package along with the data visualization and reporting capabilities. Developing and supporting these features in-house would not only incur high monetary costs, but would also delay the Prexis features that rely on the technology, subsequently delaying the company’s
customers from realizing the benefit of the reporting features they had asked for in Prexis.

“We performed a very detailed investigation of companies that provided web-based reporting solutions. We chose NetCharts Server for its capability, price, performance, and tremendous support,” said Larry Rose, Vice President of Engineering at Ounce Labs. “NetCharts Server was integrated into the Prexis product by my development staff. It was fairly straightforward and the support staff at Visual Mining was very responsive to any issue or concern we had during the integration.”

Prexis provides multi-language, cross-platform source code vulnerability analysis, enabling companies to manage risk at every stage of the software development lifecycle, and throughout the organization, including:

• Development Managers use a client web-based application
  to prepare and print reports related to their source code
  vulnerability analysis performed by the Prexis analysis
  product and displayed using the embedded NetCharts
  Server.
• Product Managers use it in a similar configuration to access
  higher-level vulnerability information, such as trending
  data and metrics, presented using NetCharts Server. There
  is some interaction with this data allowing the Product
  Manager to customize the data based upon the desired
  results.
• C-level Executives use Prexis much the same way to
  prepare and customize Summary and Detail Reports, which
  NetCharts Server displays in a graphical format for quick
  assimilation. These reports sum up areas of concern about
  the security state of the business’ critical applications.
  The user can also drilldown to details about one particular
  application, and interact with the data to cut it in many
  different views.

As each customer’s needs are unique, Ounce Labs tailors the Prexis deployment for each. NetCharts Server’s own customization capability provides additional flexibility for Ounce Labs’ solutions. And the customers see the benefit of the reporting features and functionality
built around NetCharts Server.

Looking to future enhancements

“We see a lot more expansion to our product line using NetCharts Server - in the future we will provide more in-depth reporting capabilities,” said Larry Rose. “Prexis will also provide much more interaction with the analysis data, as well as the ability for all users to
customize their reports. ”

About Ounce Labs, Inc.:

Ounce Labs, the leader in software security assurance, delivers technology that allows customers to manage software risk across their organization and throughout the software development lifecycle. Ounce Labs’ product Prexis uses patents-pending automated source code analysis to locate and categorize software vulnerabilities, providing actionable metrics and remediation information to executives, managers, security analysts, and developers. Founded in 2002, Ounce Labs is located in Waltham, Massachusetts. For more information, please visit www.ouncelabs.com.