As companies demand ever faster innovation and productivity from their development teams, security has become the bottleneck impeding progress.

Shift-left has thrown everything on the developers’ plate, and the load is requiring trade-offs. Sacrificing quality for speed is never a good trade-off, but then neither is losing competitive advantage because another company got market share first.

Flipping the paradigm so that developers can go fast and stay secure is a new tool from Snyk Ltd.

“We really focus on making sure that we help developers build better products,” said Adi Sharabani (pictured, left), chief technology officer of Snyk. “So our core focus is to identify areas where the product is not built in a good way and then suggest the corrective action that is required to make that happen.”

Sharabani and Peter McKay (pictured, right), chief executive officer of Snyk, spoke with theCUBE industry analyst Dave Vellante at AWS re:Inforce, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how Snyk Cloud fits into Snyk’s product portfolio and the problems it was built to solve. (* Disclosure below.)

Snyk Cloud enables secure development at speed

Snyk has come a long way since 2017, when co-founder Guy Podjarny told theCUBE how the company was keeping Node.js packages free from security flaws.

“We’ve been growing at 170% year-over-year growth in our customers added … we have five products that we’ve added to the mix. We’ve tripled the size of the company. So quite a bit in a very short period of time,” McKay said. 

This week’s announcement of the Snyk Cloud during Amazon Web Services Inc.’s re:Inforce event came after a year that saw a $530 million venture capital round that boosted Snyk’s valuation to $8.5 billion and the acquisition of cloud security and compliance company Fugue Inc.

“What we loved about the Fugue team is that they were building their product with a dev-first approach,” Sharabani said. While the company cultures were a match, Snyk was also attracted to Fugue for its cloud expertise.

The concept behind building Snyk Cloud was to extend beyond just monitoring cloud environments and detecting problems. Snyk Infrastructure-as-Code will detect problems like misconfigured S3 buckets, and from a security perspective, it might be OKto stop there, Sharabani explained. However, there are a lot more questions if you look at the situation from a DevOps perspective.

“You need to know who needs to fix it. How do they need to fix it? Where do they need to fix it? What will the impact be if they would fix it?” Sharabani asked. “So, what we do is we are connecting all the dots of the platform.”

A solution such as Snyk Cloud empowers the developers to bake security as part of their cycle, flipping the paradigm so security can work at DevOps speed. Chief security officers can now set policies and compliance requirements and then oversee the process rather than having to own it.

“The entire discussion now changes into an enablement discussion,” McKay said. “It’s code to cloud back to code in a very automated fashion. So it doesn’t slow developers down.”

The addition of a cloud security tool means that Snyk’s developer security platform provides developers with a consistent, language-agnostic environment for all their security tools.

“What we have done is consolidated all that spend for open-source security, container security infrastructure [and] now cloud security … all under one platform. So it’s one company that brings all those pieces together,” McKay stated.

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the AWS re:Inforce event:

(* Disclosure: Snyk Ltd. sponsored this segment of theCUBE. Neither Snyk nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE