{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"We Built It Because We Had To - Tech Founder Backstories","title":"Your AppSec Tools Find 15% of Defects, Not 95% (Chris Near)","html":"","width":"100%","height":180,"duration":2048,"description":"The application security industry spent years believing its tools found roughly 95 percent of the defects in code. Chris Near studied 34 million findings across 57 tools and put the real number closer to 15 or 20 percent.\nIn this episode of We Built It Because We Had To, host Jonathan W. Buckley is joined by Chris Near, founder of CyberSagacity, the company he built to sit on top of application security tooling as an intelligence layer rather than as another scanner. Chris traces where the 95 percent number came from: a pre-published artificial test suite that vendors could design against. Run the same tools against real code and the results collapse. He connects that gap to zero days, which by his account drive around 80 percent of breaches, defects nobody knew were there because no single tool was ever going to find them.\nThe backstory runs long. A PhD in electrical engineering at Cornell after an undergraduate degree at Northwestern, then close to seven years at Bell Labs, then a decision in 1992 to leave and chase the mathematics of software on his own. He self-funded that work until 2007 on 120-hour weeks, picked up an angel backer, lost him, self-funded again, and got him back. He pitched venture capital roughly ten times across those years with different products out of the same research and never closed one. His own explanation is blunt: he was a technologist with no partner who understood go-to-market.\nUnderneath the product is a statistical engine. Defect-level attack and consequence probabilities are matched against a cybersecurity insurance database of historical loss events, which turns a bucket of ten thousand equally urgent defects into a ranked list and reframes the question as return on risk reduction rather than raw defect count. SATriage does the triage inside the development process, sorting what is true, what is false, and what actually matters. SATraits is the planning tool that compares which tools fit a given environment before a program...","thumbnail_url":"https://img.transistorcdn.com/qSYc3cBdFcsAT9NoNJB-b1WOXf_eKr0fZMdzan3rr64/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8xNDI0/Y2Y5ZGEyNjlhMWQ4/OGRiNDdjNTc5YjQ3/YTQzOS5qcGc.webp","thumbnail_width":300,"thumbnail_height":300}