The DefectDojo Blog

Getting started with a new security platform can feel like a project in itself. Adding new scans, setting up reporting, and making sense of myriad new features is an involved and time-consuming process, especially without disrupting your current workflows. I was prepared for the same difficulties when I began using DefectDojo, but I’ve been pleasantly surprised to learn that they take a different approach: instead of asking you to change your processes to adapt to their tools, their tools adapt to your existing processes.

Dan Goelz

Sooner or later, someone will ask for your SBOM. A customer's procurement team, an assessor working through a compliance framework, or a downstream pipeline that will not deploy without one. Producing a component list at build time is the easy half. The more important part is the follow-up question: which of these components are actually vulnerable, and what are you doing about it?

Chris Azuma

Since we launched Sensei last year, it’s primarily done one job: scan your repositories, find what's wrong, and open the pull request that fixes it. Today that loop extends to your cloud.

MATT TESAURO

Your scanners report findings. Your team fixes vulnerabilities. Those are not the exact same thing, and the gap between them is where security teams spend an enormous amount of time.

GREG ANDERSON