July Office Hours: Embracing an AI-First Approach with DefectDojo TY Page

July Office Hours: Embracing an AI-First Approach with DefectDojo

Transcript

Hi everyone, happy Thursday. Like Dawn mentioned, my name is Greg Anderson, and I'm the creator and CEO at DefectDojo. Happy Thursday. Thanks for taking the time to join our office hours. I'm excited to show you the latest and greatest on what we're doing in the AI space. Before I start the presentation, just a quick heads up, there is a massive thunderstorm going on outside my office. So if you hear some banging or whatnot, it's.

It's just thunder. If I disappear, it's not because I don't want to be with you, lovely people. Just, probably lost power. But with that caveat, let's dive into our agenda for today. We like to have, we like to split our office hours into two sessions. One talking about what's new and exciting and commercial, and then what's new and exciting and open source. And so on the pro side of the house today, we have our new MCP feature, and we'll talk about

Why we created it and what's next, and how we've seen AI working well in security, and where maybe AI is not working so well in security. And then some of the open-source updates that are coming as well. So the new feature in dojo pro is, is MCP. And so if you're not familiar with MCP, it's short for model context protocol. It's essentially a way for.

AIs to connect to and utilize APIs or a translation later for AIs to access platforms. And so I have been a very big skeptic of AI and security until MCP arrived. I really think MCP is really transformational when it comes to security.

I went from a non-believer and a skeptic to honestly a total believer in what MCP can do for security. We have spent a lot of time playing with AI to understand how it could help security professionals. And one of the things that we consistently saw with any technique that we tried to use an AI smarter is that it failed to understand nuance that is so, so important for security data.

And so, like two different cross-site scripting vulnerabilities, for example, like DOM-based cross-site scripting versus traditional stored cross-site scripting. When one of these types of issues would get fixed, AI consistently failed to understand the nuance. And the magical line in the sand for us always seemed to be 10 megabytes. I don't know why that is.

But things got consistently worse with regard to hallucinations, specifically around 10 megabytes. And so we first started playing with rag pipelines to try and make AI more intelligent with regard to security data, vulnerability triage, vulnerability intelligence, et cetera. And it just didn't go super well. We also tried traditional prompt engineering, et cetera.

but nothing was really fruitful for us until MCP came along. AI has some great applications in security, specifically with anomaly detection, but with regard to security intelligence, vulnerability management, we were very unimpressed to begin with. But then MCP came along, and this greatly changed our perspective.

MCP, we see as the best way so far to get data into AI that is meaningful and useful and able to correctly separate context. And so we talked about the challenges that we saw with rag pipelines or just generic prompt engineering. But what we've seen is in hooking up Dojo to these different AIs, we've typically been able to make that AI

As performant as Dojo is or as smart as enriching, able to make concise and conclusive decisions on what you should do in security or what you should fix or how you should prioritize your time, or what training should your employees receive. And we'll actually demo that shortly, so you can see it in action.

As we watch AI agents get developed, the thing that seems to be emerging is agents really need workflows to perform well.

Before MCPs again, we just saw AI is just wasting a ton of money, a great way to burn up a lot of infrastructure. And with MCPs, just the focus that we've been able to add has been transformational in terms of what's possible with regard to having a conversational approach to security or using AI for security intelligence to make decisions about your vulnerability management program or really anything in security.

is that we see all these vulnerabilities and all these new attack techniques coming out every single day. And so I think this is one of the largest challenges to AI adoption insecurity is the innate security of the usage of AI.

But primarily organizations that have their internal models to date, just so you're not trusting a third party with all that enriched security data, essentially. there are a couple other security considerations to work through, but we think this is the best way to protect customers. We have a lot of organizations that are turning away from OpenAI or some of the larger providers because they have had security incidents.

They're building their own models to keep everything internal, to not expose that data to a third party. And so we see that as the greatest and initial application. You can hook this up to open AI. You can hook it up to anthropic. You can hook it up to any AI that supports MCP.

Let me flip over to our demo. So for my demo, in terms of what I've set up, this is connected to Claude for simplicity. It is exclusively using test data for that reason. Let's see, what are the other caveats? Our testers really like Super Mario, so it's Super Mario themed.

You could ask it things like what products may need more testing.

And so when we ask this, it'll go off and think, and then it'll pull the DefectDojo data. And I think this is a really interesting analysis.

You can ask it say to tell you what findings you should spend time on.

Some other prompts that we've seen are incredibly successful are like what training should our employees spend time on? And so we'll take a look at that one next.

We also tried to prompt it a multitude of different ways with Claude specifically to not show that, but we haven't had success with that.

You can also ask it to generate reports. Sometimes we've had trouble with generating the size of the report, but we can go ahead and try that.

The other thing we've seen people do successfully with this and kind of it's very early previews is generate reports that are specific to your format.

So we've seen the ask a lot for custom reporting, which can be kind of challenging.

we found this to be much more accurate than the other forms of AI manipulation that are available.

We don't recommend cooking this up to Claude just because we don't want to expose that information. What I'm showing you today is exclusively for demo purposes.

We want to make your job easier, be a force multiplier, make the job of implementing and keeping us a company secure actually possible.

when we bring an AI agent to market, everyone can be confident that it will accomplish these two things and we'll have the data to prove it.

So we're testing against all the major providers today with regard to the MCP, but we don't recommend hooking the MCP up to those just because it shares data.

So turning our focus to the open source side of the house. On our last office hours, we had a pretty big update and you know, if you didn't have a chance to attend, I just wanted to quickly recap our quarter update on the open source side of the house.

open source has, I mean, just steadily grown. I think one of the things that's so crazy about DefectDojo is open source space is that we've never really seen a fall off of growth in our history.

If you are interested in contributing to open source or customizing the open source version of DefectDojo, the OAS Slack channel is a great resource around that to get help.

report generation and the global calendar have aged essentially and they've reached end of life. So we're aware that some of the dependencies related to report generation and the global calendar have aged essentially and they've reached end of life.

And so this is essentially how we're approaching it. And I think you'll see this here soon.

I'm happy to take any questions anyone has about Pro, open source, questions about the platform.