Rezilion Vulnerability Scanner Benchmark Report Finds Top Scanners Only 73% Accurate

PRESS RELEASE

BE'ER SHEVA, Israel, Oct. 26, 2022 /PRNewswire/ — Rezilion, an automated vulnerability management platform accelerating software security, announced today the release of the company's Vulnerability Benchmark Report, which provides visibility into the inaccuracies and noise that are created by the market's most popular commercial and open source scanning technologies.

"Every day there are a multitude of new vulnerability disclosures across the software ecosystem, driving end-users to rely on vulnerability scanners to detect if these potentially exploitable vulnerabilities exist within their environment," said Yotam Perkal, Director of Vulnerability Research with Rezilion. "With a proven variability in the accuracy of the scanning tools on the market, companies are paying the cost of time spent triaging irrelevant vulnerabilities and worst, in the case of false negative detections, create blind spots for the organization and a false sense of security."

Inconsistent results in scanners are common. In this first-of-its-kind benchmark and root cause analysis, Rezilion researchers examined 20 popular containers on DockerHub, ran them locally, and scanned them using six different, popular vulnerability scanners in the commercial and open source market.

Each vulnerability scanner reported a different number of vulnerabilities, equating to less than 50 percent of common findings, exposing an exceptional amount of false positives and negatives. As a result, Rezilion has opened issues/support tickets for the misidentification of over 1,600 different CVEs.

Key Findings:

"The primary problem is that the scanner performance data is not transparent and leaves end-users without visibility to accurately evaluate effectiveness of vulnerability scanners," continued Perkal. "With this research, we're committed to driving the industry forward and proactively approaching the issue. Rezilion's ultimate goal is to provide transparency about the performance of the scanners and improve the quality of vulnerability scanning across the board."

Best Practices:

To download the full report, please visit: https://www.rezilion.com/lp/scanning-the-scanners-what-vulnerability-scanners-miss-and-why/.

About Rezilion:

Rezilion's platform automatically secures the software you deliver to customers. Rezilion's continuous runtime analysis detects vulnerable software components on any layer of the software stack and determines their exploitability, filtering out up to 95% of identified vulnerabilities. Rezilion then automatically mitigates exploitable vulnerabilities across the SDLC, reducing vulnerability backlogs and remediation timelines from months to hours while giving DevOps teams time to build.

Learn more about Rezilion's software attack surface management platform at www.rezilion.com and get a 30-day free trial.

SOURCE: Rezilion