We’ve all been there — that magical time when you have finally automated your application security testing tools to run nightly and are receiving testing results. You breathe a big sigh of relief. Then, when you return to your office the following day, your relief turns to horror as you are inundated with tens or hundreds of thousands of security warnings from the previous night’s scans. Going through all of those alerts one by one to separate the real security issues from the impostors (a process referred to as triage) could take weeks or months of time that you simply don’t have. Now what do you do?

It’s a conundrum that we all face: too many security warnings to sort through and not enough time. If you can automate the application security testing, why can’t you automate the triage? How can that be so hard? Enter the savior: Intelligent Finding Analytics (IFA).

What Is IFA?

IFA consists of several technologies utilized over several execution phases. The first phase uses cognitive learning to think like a security expert. With this baked-in knowledge, IFA can discern between a security warning representing a real vulnerability compared to a potential false positive. Additionally, the machine knows how to prioritize the problems it does find of interest.

But it doesn’t end there. The second phase of IFA uses understood and proven heuristics that we have discovered through years of using the security tool in real-world situations. These heuristics are applied to remove uninteresting or false security warnings, further reducing a security analyst’s workload.

Of course, we saved the best for last. The final phase of IFA includes what we call Fix Point Analysis. Fix Point Analysis takes the real security warnings that the machine generates during the initial phases of IFA and treats them as symptoms of an overall issue.

For example, if your code generates 10 security warnings, and each of those warnings contains tainted data that flows through a common intermediate code block or trace node, we can group those 10 traces on a common node. This capability results in a single overall location in the code where a developer can fix all 10 security warnings at once. This technique uses symptoms (i.e., security warnings) turned into fix-point sets to provide security analysts with the proper context in which they can focus on a single set of fixes at once.

IFA: Improving the Effectiveness of Your Application Security Testing Program

Let’s take a look at how IFA can improve your application security testing program. Consider John Smith, who works at a fictional company. He has to scan and triage security warnings for more than 60 applications. In addition, he’s tasked with distributing the issues that he finds to be true vulnerabilities to the appropriate developers. The scans in total produce over 160,000 findings.

The old way of triaging would be to look through each security warning and identify patterns that indicate whether an issue is real or an impostor. That is a tedious and time-consuming process. Most security scanning tools offer some assistance in the form of filters. But using filters is not automatic; it takes time and effort to set them up. Furthermore, usage of filters must be done through an iterative approach, which can be very inefficient. A solid understanding of general security practices and of the various vulnerabilities found in applications are required for this type of analysis.

Now let’s take a look at that same situation, but this time using IFA. John performs the same scans of the same 60 applications. The first and second phases of IFA execute immediately after the scan is completed, resulting in a reduced set of security warnings. In this case, John ends up with 14,000 security warnings for all 60 applications instead of 160,000 — IFA’s removal of false positives and noise resulted in 91 percent fewer warnings! If IFA stopped there, the resulting finding set would be more manageable for him, but it is still difficult and time-consuming to address 14,000 red flags.

Fortunately for John, IFA doesn’t stop there. The final phase of IFA groups the resulting security warnings into 300 overall issues (fix points). The real power here is that the 160,000 findings that John started with are now reduced to about 300 issues in total — about five issues per app. More than 98 percent of security warnings have been eliminated. When John returns to the office in the morning, all he has to do is distribute a handful of issues to the developers on each of the application teams, allowing them to focus on the issues that are of highest priority to the organization.

All of this processing is performed automatically through IFA, without the need for John to interact with anything. No special security knowledge was required from John and no manual triage steps were required.


If you are constantly under pressure to review application security testing results more quickly and you feel like you are fighting a losing battle, IFA is something you need to check out. It’s a revolutionary new way of looking at security tool results.

It’s not about the problem areas of your code; it’s about finding the most efficient ways to fix your code. It’s as if your friendly neighborhood security expert showed up and did all the work for you, and you still get all the credit.

To Learn More

IFA is available as a Static Analyzer feature of IBM’s Application Security on Cloud offering and has recently been extended to IBM Security AppScan Source. You can learn more about IFA’s capabilities by listening to our webinar below, titled  “Leverage IBM’s Cognitive Technology to Think Like a Security Expert.”

Watch the On-Demand Webinar Now

And, to extend your application source code testing knowledge, register for your complimentary trial plan of Application Security on Cloud today.

This post was updated on June 2, 2017, to reflect new IBM offerings. 

More from Application Security

Does Follina Mean It’s Time to Abandon Microsoft Office?

As a freelance writer, I spend most of my day working in Microsoft Word. Then, I send drafts to clients and companies across the globe. So, news of the newly discovered Microsoft Office vulnerability made me concerned about the possibility of accidentally spreading malware to my clients. I take extra precautions to ensure that I’m not introducing risk to my clients. Still, using Microsoft Office was something I did many times a day without a second thought. I brought up…

3 Reasons Why Technology Integration Matters

As John Donne once wrote, “No man is an island entire of itself.” With digitalization bridging any distance, the same logic could be applied to tech. Threat actors have vast underground forums for sharing their intelligence, while security professionals remain tight-lipped in a lot of data breach cases. Much like the way a vaccine can help stop the spread of infectious diseases, sharing threat intelligence and defense strategies can help to establish a more secure future for everyone.  So what…

Why Your Success Depends on Your IAM Capability

It’s truly universal: if you require your workforce, customers, patients, citizens, constituents, students, teachers… anyone, to register before digitally accessing information or buying goods or services, you are enabling that interaction with identity and access management (IAM). Many IAM vendors talk about how IAM solutions can be an enabler for productivity, about the return on investment (ROI) that can be achieved after successfully rolling out an identity strategy. They all talk about reduction in friction, improving users' perception of the…

Controlling the Source: Abusing Source Code Management Systems

For full details on this research, see the X-Force Red whitepaper “Controlling the Source: Abusing Source Code Management Systems”. This material is also being presented at Black Hat USA 2022. Source Code Management (SCM) systems play a vital role within organizations and have been an afterthought in terms of defenses compared to other critical enterprise systems such as Active Directory. SCM systems are used in the majority of organizations to manage source code and integrate with other systems within the…