overview
- We utilize Mend, which provides high-quality recommendations with an extremely low false positive rate.
- Detailed advice on countermeasures allows Microsoft engineers to quickly upgrade the packages they use.
- It can scale to match the ecosystem that Microsoft wants to target.
The challenges Microsoft faced
Microsoft developers utilize a vast amount of open-source software. Over 80,000 different open-source packages are used more than 11 million times across Microsoft's codebase. To ensure that Microsoft's 85,000 developers can use open-source software with confidence, Microsoft's One Engineering System (1ES) team, which selects and manages all the tools used by Microsoft developers, was tasked with finding the best open-source software security tool. The team sought a tool that was highly accurate, easy to use, and provided concrete, actionable recommendations on how to fix vulnerable open-source packages.
Why Microsoft chose Mend.io as the solution
Magnus Hedlund, Director of Engineering at Microsoft's 1ES team, said the following about Mend:
1. High accuracy
False positives can easily erode developers' trust in a tool. If a tool consistently produces false positives, developers will ignore it and never use it again. Microsoft relies on Mend for its extremely low false positive rate and high-quality recommendations.
2. Ease of use
We integrate Mend's vulnerability detection directly into the developer workflow. Without any action from the developer, our team automatically scans for vulnerabilities and notifies the developer of their own vulnerable code.
3. Excellent restoration advice
Identifying vulnerabilities and informing developers of the problem is useful, but if you don't tell them how to fix it, they can't improve it. There's no point in issuing a certain number of alerts that no one can do anything about without recommendations for remediation. With the detailed remediation advice that Mend provides, Microsoft engineers can quickly upgrade the packages they use to versions with fewer vulnerabilities.
Microsoft offers high-quality recommendations with a very low false positive rate.I'm relying on Mend to provide the information.―Magnus Hedlund, 1ES CheeHmm,Director of Engineering
Try using Mend.io
Bryan Sullivan (Manager, 1ES Security Tools Group, Microsoft): Mend plays an essential role in identifying where potentially risky or insecure open source is being used and ensuring that it is addressed as early as possible. We rely on Mend for its excellent remediation guides, which are crucial in helping developers fix problems correctly the first time around.
Poonam Gupta (Director of Microsoft's 1ES team): "Working with Mend was the right decision. Having the right recommendations in place gives us greater peace of mind about our security. Mend has scaled to meet our needs and to the extent that it can cover the ecosystem we want to cover. Overall, it was a great decision."