devopsy.kinsta.cloud

Category: AI

  • GitHub Revamps Search Engine for Code Repository

    GitHub Revamps Search Engine for Code Repository

    GitHub today unveiled a new search engine it has developed to make it simpler and faster to browse and navigate the world’s largest code repository.

    A completely redesigned search interface now provides suggestions, completions and the ability to slice and dice results, while a redesigned code view tool has integrated search, browsing and code navigation.

    Mario Rodriguez, vice president of product for GitHub, said the popular code repository provider decided to create a new search engine to improve developer productivity. There are more than 200 million GitHub repositories that can now be more easily explored, he noted. The updated search engine also makes it much easier to search for specific vulnerabilities that might exist in a codebase, added Rodriguez.

    This latest addition to the GitHub portfolio is part of an ongoing effort to inject more intelligence into software development using tools such as GitHub Copilot that employ generative artificial intelligence (AI) to make developers more productive, he said.

    During uncertain economic times, there’s always going to be more focus on productivity. Organizations of all sizes are reluctant to hire additional full-time developers, so any effort to make existing developers more productive is welcome. The challenge is the DevOps teams that support those developers are now under increased pressure to reduce or eliminate as many bottlenecks as possible. In most instances, that will require increased investments in automation and AI to enable greater amounts of code moving through multiple pipelines to be managed at an unprecedented scale.

    In the meantime, instead of focusing on metrics such as recovery times, DevOps teams might want to focus more on how much they are improving developer productivity. After all, developers are an expensive asset, so in the age of digital business transformation, most business executives are squarely focused on increasing the rate at which applications are being built and deployed. In many cases, the amount of profit and revenue being generated by any business is now a direct reflection of the pace at which quality software is developed and deployed.

    One way or another, a new age of software development is dawning. Most of the innovations being brought forward are focused on issues that impact developers, but it’s only a matter of time before AI is also increasingly applied to DevOps workflows. As more organizations begin to realize how much of a bottleneck manual steps in DevOps processes have become, the willingness to invest in more advanced platforms should increase.

    The challenge, as always, is there are a lot more developers than software engineers, so the immediate focus is on developer productivity. That’s not necessarily a bad thing, but in the absence of any advances on the back end of the software development process, it is likely to aggravate an imbalance that most DevOps teams strive daily to correct.

  • Honeycomb Taps ChatGPT to Simplify Observability

    Honeycomb Taps ChatGPT to Simplify Observability

    Honeycomb today added a Query Assistant to its observability platform that uses OpenAI’s ChatGPT generative artificial intelligence (AI) platform to launch queries via a natural language interface rather than having to master a query language.

    That capability complements an existing tool based on machine learning algorithms, dubbed BubbleUP, that DevOps teams already use to debug code.

    Honeycomb CTO Charity Majors said both tools make the Honeycomb observability platform more accessible to IT teams that are tasked with managing complex application environments. Those teams are not going to be able to accomplish that goal without relying more heavily on AI to determine the root causes of an issue.

    Generative AI augments DevOps teams by making it possible to build a relevant, modifiable query that they can continuously iterate as IT staff investigate an issue. This approach means teams don’t necessarily need a deep understanding of code behavior and the underlying infrastructure it depends on, noted Majors.

    That’s critical, because not every IT professional immediately knows what query to launch. One of the challenges with adopting any observability platform is they require a a DevOps team member to frame a query to generate a result. If multiple queries are required, coding them in a query language becomes a cumbersome task.

    As AI continues to improve, algorithms should be able to automatically surface more issues. But given all the dependencies that exist in modern application environments, there will still be a need for a DevOps specialist to ensure application availability and optimize performance, at least for the foreseeable future.

    In general, generative AI represents a significant leap forward compared to AI for IT operations (AIOps) platforms that, in comparison, are not nearly as useful, noted Majors.

    It’s still early days as far as measuring the impact AI will have on DevOps workflows. But the AI genie is already out of the proverbial bottle. Many of the low-level tasks that tend to make DevOps jobs tedious will soon be automated. As a result, job roles within DevOps teams will need to evolve.

    Less clear is what impact the rise of generative AI might have on the adoption of observability platforms. While there is no shortage of observability platforms, adoption has been limited by the number of DevOps professionals that could master a specific query language created for that observability platform. The ability to rely on a natural language interface instead reduces the need to use a proprietary query tool.

    In the longer term, the simpler it becomes to use DevOps best practices, the more widely they will be adopted. AI platforms should enable more organizations to embrace DevOps in a way that reduces the level of cognitive load currently required.

    In the meantime, there’s no doubt that current DevOps professionals are cautiously watching the rise of generative AI, much like everyone else. The difference is that most DevOps professionals are not going to want to work for organizations that don’t provide access to AI-infused tools and platforms that make their jobs easier.

  • GitLab Allies With Google to Bring AI to DevOps

    GitLab Allies With Google to Bring AI to DevOps

    GitLab extended its alliance with Google as part of an effort to bring more generative artificial intelligence (AI) capabilities to DevOps workflows.

    The GitLab suite of software-as-a-service (SaaS) applications already reside on the Google cloud platform to provide GitLab with the foundation of data required to train those AI models. Over the course of the last two months, GitLab has already added numerous capabilities that rely on multiple types of AI technologies.

    For example, there is now an experimental Explain This Vulnerability capability that provides a natural language summary of an issue in a way developers and cybersecurity teams can easily comprehend.

    Taylor McCaslin, a product group manager for data science and AI/machine learning for GitLab, said going forward, most of the AI focus is going to be on leveraging generative AI capabilities. Those capability will be enabled by Google using a large language model (LLM) that GitLab developed for DevOps workflows. That approach enables GitLab to surface more accurate recommendations based on validated data compared to the general purpose LLM that was used to create the ChatGPT service.

    In addition, GitLab can continuously update the AI models it is running on the Google Vertex AI cloud service using the data from its SaaS application environment which is continuously monitored and updated, McCaslin noted.

    It’s not clear what impact AI may have DevOps workflows, but GitLab is forecasting a 10x improvement. That will be accomplished by, for example, surfacing code that can be used to remediate a vulnerability. Today, many vulnerabilities are not addressed simply because developers don’t have enough time to write a patch.

    A recent GitLab survey, however, suggested developers are already embracing AI to improve productivity, with 62% of developers using AI and machine learning algorithms to check code. More than a third (36%) also rely on AI and machine learning algorithms to review code.

    At this juncture, the one thing that is certain is AI and other associated technologies are going to make developers more productive. It’s not nearly as apparent what impact increased amounts of code moving simultaneously through DevOps pipelines is going to have on the software engineers that manage those processes. The expectation is that similar types of AI advances will also enable more code to flow through those pipelines without, hopefully, further exacerbating any existing bottlenecks that might exist.

    In the meantime, it’s clear the AI genie is out of the bottle. There will soon be more LLMs for all kinds of tasks. DevOps teams should start planning today based on the assumption that many manual tasks that conspire to make software engineering tedious are going to fade away. As such, the roles with a DevOps team are going to change and evolve. The assumption those DevOps teams should make is that these changes will be for the better. After all, the reason organizations embraced DevOps in the first place was to ruthlessly automate IT processes—AI is simply the latest iteration of that commitment.

  • ClickUp Adds Project Management Templates to Invoke ChatGPT

    ClickUp Adds Project Management Templates to Invoke ChatGPT

    ClickUp is adding templates and collaboration tools to make it easier to access generative artificial intelligence platforms such as ChatGPT from within its project management application.

    Haris Butt, head of product design for ClickUp, said ClickUp AI now includes pre-built department-specific prompts that any product managers, developers or designers can easily access rather than having to develop prompt engineering skills to engage a generative AI platform more effectively.

    The templates, for example, make it simpler to produce summaries of project timelines in addition to the ability to automatically generate a whiteboard that lists tasks that need to be finished to complete a project.

    In the longer term, ClickUp is also moving toward developing its own large language model (LLM) using its own data to provide a generative AI experience specifically optimized for project management, added Butt.

    ClickUp is embedding AI into project management applications as part of an effort to eliminate drudgery, added Butt. One of the primary issues that makes project management challenging is that navigating workflows can be challenging, especially for stakeholders that might not be as well versed in, for example, how a Gantt chart flows.

    It’s still early days as far as generative AI is concerned, but it’s already apparent that a wide range of templates are being developed to make it simpler to invoke these platforms. The need for project managers to become well-versed in all the nuances of prompt engineering techniques to optimize generative AI queries is likely to be limited.

    In fact, the general expectation is that every application will eventually include templates for invoking generative AI capabilities. Less clear is the impact that should have on productivity. In the case of DevOps teams, however, many tedious project management tasks should become increasingly automated.

    Generative AI will, of course, soon be employed across the entire DevOps workflow. Many of the tasks that have historically conspired to make DevOps processes tedious will be automated. In fact, many application developers are already using AI to test and review code. DevOps teams that have historically advocated ruthless approaches to automation are likely to be at the forefront of AI adoption.

    There are, of course, concerns about the accuracy of generative AI platforms such as ChatGPT that have been trained using data that hasn’t always been verified. As a result, it’s possible that some of the results being surfaced by these platforms should be reviewed by humans before being acted on. However, LLMs trained on narrower ranges of validated data will soon become commonplace. As those AI advances are made, the accuracy of generative AI platforms that are optimized for specific use cases will increase.

    In the meantime, DevOps teams should be more concerned about being left behind than about how generative AI impacts their employment prospects. There is no doubt generative AI will transform DevOps workflows along with a wide range of processes. The issue now is determining where DevOps teams can add value—and where machines can’t—in an era where IT environments are becoming more complex with each passing day.

  • Sendbird Adds API to Invoke ChatGPT From Mobile Apps

    Sendbird Adds API to Invoke ChatGPT From Mobile Apps

    Sendbird today added an application programming interface (API) to its low-code platform for building mobile applications that enables developers to add bots that communicate with OpenAI’s ChatGPT.

    Shailesh Nalawadi, head of product for Sendbird, said this API makes it possible to add the ability to communicate directly with the generative artificial intelligence (AI) platform from within both new and existing applications in just a few minutes.

    Most developers will add natural language processing (NLP) interfaces to complement the graphical user interfaces that most mobile applications today surface, added Nalawadi. It will be up to each development team to determine how best to employ that capability, but Sendbird envisions, for example, a health care application being able to invoke ChatGPT to answer queries, he noted.

    In the longer term, Sendbird will provide APIs to enable mobile app developers to invoke a wide range of large language models (LLMs). LLMs are increasingly being developed for generative AI platforms and are being optimized for a range of use cases.

    While OpenAI’s generative AI model is being widely used thanks mainly to Microsoft, there are already LLMs that are being created for a narrower range of use cases using much less data. DevOps teams should expect APIs invoking any number of generative AI platforms from within applications to become commonplace in the weeks and months ahead as more end user come to expect to be able to engage these platforms from within almost every application Sendbird’s chatbot API can now be invoked by more 1,300 existing mobile applications alone.

    In general, developers have tended to employ chatbots sparingly because they are often too scripted and inflexible. ChatGPT, conversely, provides a much more open-ended user experience. Organizations can also feed historical conversations or customer relationship management (CRM) data to ChatGPT to drive more personalized and accurate responses, given the veracity of some of the data used to train ChatGPT.

    A recent survey of digital quality testing professionals conducted by Applause, a provider of a platform for accessing a networking of independent testers, found nearly one-third (30%) of respondents are dissatisfied with their current chatbot, IVR and conversational assistant experiences, with wrong answers (29%) and a lack of understanding (24%) as the top two reasons cited. The results indicate there is plenty of opportunity for improvement.

    Nearly three-quarters (74%) said they had a positive experience with the ChatGPT generative artificial intelligence (AI) platform, with more than two-thirds (67%) reporting the platform provided helpful answers to questions. In terms of work-related tasks, most said ChatGPT would either be “very” (43%) or “somewhat” (37%) helpful.

    It’s apparent now that generative AI platforms are about to change the way humans engage with machines. Instead of always creating an abstraction to interface with a machine it’s now feasible for interactions to occur between them using language humans readily understand. As such, the way applications are built and employed is about to fundamentally change in ways that are difficult to predict.

  • GitLab Survey Reveals DevSecOps Gains

    GitLab Survey Reveals DevSecOps Gains

    A global survey of 5,010 IT leaders, CISOs and developers published by GitLab this week found well over half (56%) of respondents are working for organizations that are using DevOps or DevSecOps practices. However, 72% of respondents said they are using a DevSecOps platform (36%) or are considering adopting one in the next year (36%).

    Overall, less than a third of survey respondents (30%) said they were “completely” responsible for application security, with 53% reporting they are part of a larger application security team. Well over a third (38%) of the 1,453 security professionals surveyed said they are part of a cross-functional team focused on security.

    License compliance checks and security capabilities for cloud-native or serverless tied for the top of the list of current priorities (19%), but shifting security left (29%) was the top focus for the coming year. Nearly three-quarters (74%) of security professionals said their organizations either shifted left or plan to in the next three years. Nearly as many (71%) said a quarter or more of all security vulnerabilities were discovered by developers.

    Top frustrations identified specifically by security professionals included testing happening too late in the development cycle (43%) and difficulty prioritizing vulnerability remediation (41%).

    Those frustrations might increase in the coming year, with 85% of security professionals reporting they either have the same or lower budget in 2023.

    On the plus side, nearly two-thirds of the 1,954 developers surveyed said they are either using artificial intelligence (AI) and machine learning (ML) algorithms in testing today or will be in the next three years. A full 62% said they used AI/ML to check code, while 53% use bots for testing and 36% use AI/ML for code review.

    Nevertheless, more than two-thirds of security professionals (67%) said they are concerned about the impact of AI/ML capabilities on their job, with 28% of them admitting they are “very” or “extremely” concerned. Of those respondents who expressed concern, 25% said they are worried about the potential for AI/ML to introduce errors that will make their job more difficult.

    David DeSanto, chief product officer at GitLab, said GitLab is also working to address those concerns by embedding a range of AI/ML capabilities into its platform to optimize DevSecOps workflows and, most recently, enhanced its GitLab Remote Development module to make it easier to centralize the maintenance and security of development environments.

    GitLab this week also announced it is partnering with Oracle to make it easier to use the GitLab continuous integration/continuous delivery (CI/CD) platform to run AI and ML workloads on the Oracle cloud platforms. AI/ML is going to play a critical role in enabling organizations to build and deploy secure code without slowing down the pace of application development, said DeSanto. In fact, many organizations will soon be consolidating toolchains to enable them to achieve that goal, he added.

    The GitLab survey found 57% of security respondents said they use six or more tools, but many of those tools are legacy software composition analysis (SCA) tools that will be replaced as more responsibility for application security shifts left toward developers, noted DeSanto. Two-thirds of survey respondents (66%) reported they want to consolidate their toolchains this year.

    Collectively, the GitLab survey makes it clear that DevOps and DevSecOps practices and platforms continue to evolve rapidly. The challenge, as always, is keeping up with the pace of that change.

  • Preparing for Machine Learning Readiness to Unlock its Full Potential

    Preparing for Machine Learning Readiness to Unlock its Full Potential

    With the rapid advancement of artificial intelligence (AI) and machine learning (ML), companies need to understand and evaluate their readiness to adopt these technologies and drive material business outcomes.

    To assess a company’s machine learning readiness, we must consider several key factors, including:

    ● Vision/strategy
    ● Data availability
    ● Expertise, infrastructure and resources
    ● MLOps and governance

    In this article, I will review these three key factors in assessing ML readiness and how they can help your organization prepare.

    1. Vision/Strategy

    A company’s vision for its AI/ML strategy is essential to consider when assessing its machine learning readiness. This includes ensuring that the expected AI transformation aligns with the company’s strategic goals and that it will ultimately be meaningful for the business. To evaluate this, organizations should consider their overall strategy for AI adoption and determine how it fits into their broader business objectives. Additionally, companies should identify specific use cases and applications of AI that support their goals and how those can be implemented to drive business outcomes. A company that has already woven an AI/ML strategy into its business planning is in a far better position to assess its ML readiness.

    2. Data Availability

    I believe data availability is another crucial factor in assessing ML readiness. Machine learning algorithms require vast amounts of data for training and validation to offer real value. It would be challenging for a company to successfully implement machine learning without access to sufficient data, or they’d risk a model that cannot be trained effectively and that would, in turn, perform poorly. Companies must consider the quality and quantity of data at their disposal, as well as any potential future data sources when assessing their readiness for this important element of machine learning. I also think organizations should consider the feasibility of collecting and integrating data from various sources, whether internal or external, to have the most impactful machine learning initiative.

    3. Expertise, Infrastructure and Resources

    It’s no secret machine learning requires a diverse set of skills, including data science, programming and statistics, and every organization must be sure they have all the necessary talent and resources when building that function. These resources include data preprocessing, model development, model validation, deployment, monitoring, maintenance and the ability to train and onboard new employees to oversee AI/ML programs. Companies should also enable collaboration across these different units and roles. If a company chooses to outsource machine learning projects to third parties, the skills needed internally may need to shift toward project management and collaboration with external teams, as well as a nuanced and sophisticated understanding of the business problem, industry and technical capabilities of the vendors, to ensure proper execution.

    A company’s systems and technology stack are key to any operation. This includes selecting the right technologies and tools to enable the end-to-end creation and use of AI/ML-powered analytical applications. Before adopting ML, companies should evaluate their current stack to determine if it’s equipped to handle AI, including the availability of hardware, software and programming languages. Organizations should also consider the costs associated with selecting and implementing the right technology stack for AI/ML, including the costs of any necessary upgrades or new investments. Decision makers should also research and evaluate different technology vendors, their products and services, and find the one that best suits their needs in regards to cost, value and alignment with long-term goals.

    4. MLOps and Governance

    To be machine learning-ready, I find it important for companies to have machine learning ops (MLOps) in place. MLOps is a set of practices that allows companies to manage the end-to-end machine learning life cycle. It covers the entire machine learning process, from data preparation to model deployment and monitoring. Implementing MLOps includes continuous integration and delivery, model versioning and management and monitoring and alerting. Additionally, MLOps practices such as automated testing, model evaluation and deployment can help organizations improve the overall efficiency and effectiveness of their machine-learning efforts over time.

    A company’s governance structure for AI/ML adoption is another factor to consider when assessing machine learning readiness. Companies should evaluate their existing governance structures and determine if they are equipped to handle the implementation of AI, including data governance, compliance and risk management. We must also consider how we will manage the deployment and scaling of AI, including the development of policies and procedures to govern the use of AI and the identification of internal stakeholders and decision-makers who will be responsible for its implementation.

    Ultimately, I believe the key to machine learning readiness is to assess current capabilities, identify areas for improvement and develop strategies to address them. By taking the time to assess their machine learning readiness, companies can ensure they are in the best position to take full advantage of the benefits that machine learning can provide.

  • Atlassian Embeds Generative AI Across Cloud App Portfolio

    Atlassian Embeds Generative AI Across Cloud App Portfolio

    At its Team 23 conference today, Atlassian announced it is adding an artificial intelligence (AI) capability to the enterprise editions of its cloud portfolio to automate a wide range of routine tasks.

    Sherif Mansour, distinguished product manager for Atlassian, said Atlassian Intelligence uses natural language to drive a virtual agent that resolves routine help desk issues from within Slack or Microsoft Teams. Atlassian Intelligence can also identify incidents that have been previously resolved along with issues that are related to one another.

    In addition, IT teams can also leverage Atlassian Intelligence to create summaries for projects being tracked using the company’s Jira project management software, noted Mansour.

    The overall goal is to streamline incident management processes while also making it simpler for application stakeholders to collaboratively participate in software development, he added.

    Generative AI capabilities are likely to be infused into almost every imaginable application going forward, but Atlassian is clearly at the forefront of an effort to leverage AI to improve productivity. For example, instead of spending time handling routine issues that increase the amount of daily toil, IT teams should be able to spend more time resolving more complex issues, noted Mansour.

    The cumulative effect of AI should result in a significant decrease in the backlog of tasks that many IT teams would otherwise have to manually perform, he noted.

    It’s not clear just yet how much generative AI will impact the way software is developed and how IT is managed, but it’s already apparent that fundamental change is on the way. The Atlassian Intelligence approach is intended to augment the capabilities of IT teams so they can do more with the same number of or fewer personnel.

    The challenge IT teams will face is identifying tasks they couldn’t previously accomplish simply because there wasn’t enough time available.

    Fundamentally, generative AI changes the way humans interact with machines. Instead of requiring a developer to create a level of abstraction to communicate with a machine, it’s now possible for machines to understand the language humans use to communicate with each other. That makes it possible for anyone to make use of large language models used to create generative AI platforms to, for example, automate a routine task or, one day soon, create code.

    At this point, like it or not, the generative AI genie is out of the proverbial bottle. Just about every job function imaginable will be impacted to varying degrees. In the case of IT organizations, the ultimate impact should involve less drudgery as many of the tasks that make managing IT tedious are eliminated.

    Hopefully, as IT continues to evolve, there will still be plenty of demand for human expertise. For better or worse, the nature of the expertise required, however, will undoubtedly be at a much higher level than it has been for the past four decades or more.

  • AI Chatbots: Game Changers for DevOps Transformations

    AI Chatbots: Game Changers for DevOps Transformations

    In today’s fast-paced digital world, organizations are constantly looking for ways to accelerate their software development processes and ensure the seamless integration of their development and operations teams. DevOps has emerged as a popular methodology to achieve this goal, but even with its adoption, many companies still face challenges in their transformation journey. AI chatbots can revolutionize DevOps transformations, making them more efficient and effective than ever before.

    How AI ChatBots Improve DevOps Transformations

    Enhance collaboration by automating routine tasks and facilitating communication between teams: AI chatbots can handle repetitive tasks, freeing up team members to focus on more critical issues while also providing a centralized communication hub for both development and operations teams.
    Expedite incident management by providing real-time alerts and smart recommendations: AI chatbots can analyze logs and system metrics to quickly identify issues and suggest the most appropriate resolution steps, reducing downtime and improving overall system performance.
    Streamline deployment and monitoring processes using AI-driven automation: AI chatbots can intelligently manage deployment pipelines, ensuring that the right code gets deployed to the right environments while also monitoring system health and performance in real-time.
    Offer real-time analytics and insights into the development pipeline for informed decision-making: AI chatbots can gather and analyze data from various sources, providing valuable insights that help teams make better decisions related to code quality, release schedules and resource allocation.
    Identify skill gaps and recommend targeted training resources for continuous improvement: AI chatbots can analyze team performance and individual skill sets, helping organizations identify areas for improvement and providing personalized learning resources to close those gaps.

    Roadmap to Implement AI Chatbots in DevOps Transformations

    Evaluate your organization’s current DevOps maturity and identify areas for improvement: By assessing your existing processes and infrastructure, you can better understand the gaps where AI chatbots can make the most significant impact.
    Select an AI chatbot platform that aligns with your organization’s technology stack and goals: Choose a platform that complements your existing tools and supports your specific DevOps objectives to ensure seamless integration and adoption.
    Define and prioritize use cases for AI chatbot implementation in your DevOps processes: Identify the key areas where AI chatbots can provide the most value, such as incident management or deployment automation and prioritize their implementation accordingly.
    Develop a phased implementation plan that includes integration, testing and deployment of AI chatbots: Create a step-by-step plan to integrate AI chatbots into your existing DevOps processes, ensuring proper testing and validation at each stage to minimize potential disruptions.
    Train your teams on how to leverage AI chatbots effectively and continually refine their usage based on feedback and performance metrics: Provide education and training resources to help your team members understand how to use AI chatbots to their full potential and foster a culture of continuous improvement.

    Benefits of AI Chatbots in DevOps Transformations

    AI chatbots offer several benefits that can significantly improve DevOps transformations, including:

    Increased efficiency by automating manual tasks and streamlining processes: This leads to faster development cycles, quicker releases and a more agile response to changing business requirements.
    Enhanced collaboration and communication among development and operations teams: AI chatbots can break down silos between teams, fostering a more collaborative and unified approach to software development and delivery.
    Faster incident resolution and reduced downtime: With AI chatbots’ help, issues can be identified and resolved more quickly, minimizing the impact on end users and maintaining a high level of service quality.
    Real-time insights into the development pipeline for more informed decision-making: AI chatbots enable teams to make data-driven decisions by providing real-time analytics and insights into various aspects of the development process, such as code quality, resource allocation and release timelines.
    Continuous learning and improvement through AI-driven recommendations: By identifying skill gaps and suggesting targeted training resources, AI chatbots can help teams continuously improve their knowledge and expertise, ultimately leading to better performance and more successful DevOps transformations.

    Summary

    In conclusion, AI chatbots are poised to revolutionize DevOps transformations by addressing common challenges, enhancing efficiency and fostering a culture of continuous improvement. By automating routine tasks, facilitating communication and providing valuable insights into the development pipeline, they can significantly improve the effectiveness of DevOps processes. As organizations continue to adopt and refine their DevOps strategies, incorporating AI chatbots into their workflows will become increasingly essential to remain competitive in the ever-evolving digital landscape.

  • Endor Labs Taps ChatGPT to Identify Secure Open Source Software

    Endor Labs Taps ChatGPT to Identify Secure Open Source Software

    Endor Labs has launched DroidGPT, an extension of its software for assessing risks in open source code. DroidGPT integrates the ChatGPT generative artificial intelligence (AI) platform to make it simpler to discover the most secure version of an open source package.

    That capability makes it possible for developers to launch a natural language query from within the Endor Labs platform that asks ChatGPT to identify, for example, the most secure logging modules of Java applications.

    Endor Labs CEO Varun Badhwar said the goal is to make it simpler to apply guardrails to application development processes that today rely heavily on reusing open source packages. Developers often wind up using an older version of those packages that are not as secure because a known vulnerability has not been remediated.

    Endor Labs’ Dependency Lifecycle Management platform applies graph analysis to identify the depth of dependencies that exist within an application. That capability makes it simpler to identify where vulnerable components have actually been employed within an application. DroidGPT extends that capability to identify the most secure versions of those components that developers should be using, said Badhwar.

    Having a full understanding of their dependency graph also lets customers generate and analyze accurate software bills of materials (SBOMs) as applications are dynamically updated, noted Badhwar.

    The level of dependency on open source software packages to create applications has risen sharply over the years. An analysis of nearly 2,000 software packages published by Endor Labs found 95% of all application vulnerabilities can be traced back to a transitive dependency created when a developer used an open source component. Functional dependencies are created whenever developers download a third-party component, so it is crucial to assess the risk levels created by those dependencies.

    Fortunately, in the wake of a series of high-profile breaches, there has been increased focus on securing software supply chains. The ongoing challenge is most developers don’t have a lot of cybersecurity expertise, so as contributions are made to open source projects it’s relatively easy for mistakes to be made. The simple truth is many applications deployed in production environments are riddled with known vulnerabilities that have yet to be addressed. DroidGPT is designed to make it simpler to begin the process of remediating software vulnerabilities in applications as they are built and after they are deployed.

    There is no doubt that it will take years before organizations are able to implement a set of truly mature DevSecOps best practices to teach developers how to build more secure applications. That journey, however, needs to begin with tools that enable them to address fundamental issues that dependencies inevitably create. After all, the best way to combat application vulnerabilities is to make sure they don’t manifest themselves in code in the first place. Making it easier to update applications using older versions of open source modules is nothing less than critical at a time when cybercriminals are getting more adept at exploiting them.