SQL Injection Vulnerabilities and the new FBI and CISA alerts

What is SQL Injection?

A few days ago, the Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) issued a security alert regarding a continuous threat from SQL Injection (SQLi) software security vulnerabilities. This alert targets all software vendors and software development organizations, such as any enterprise that develops software for its clients’ needs.

The alert strongly encourages those organizations to minimize the spread of SQLi in the software they deliver to their customers. It also appeals to the customers of the software and urges them to hold software developers/vendors accountable for the harm inflicted by SQLi vulnerabilities in the vendors’ software.

SQLi is one of the most harmful security vulnerabilities. It enables hackers to manipulate with access to the databases and endanger the most sensitive data, e.g. retrieve it, and pass it to the hackers. The Open Worldwide Application Security Project (OWASP) – the guiding application security body – has included SQLi in its OWASP Top 10 list of the most severe vulnerabilities for the past fifteen years.

Finding SQLi (as well as other security vulnerabilities) in the software is a paramount, although not a trivial, task. TrustMe.ai will find SQLi vulnerabilities for you.

What can be done about SQL Injection?

TrustMe.ai offers a set of application security testing technologies: static application security testing (SAST), software composition analysis (SCA) and dynamic application security testing (DAST) that analyze different aspects of software and detect SQLi and other dangerous security vulnerabilities, such as cross-site scripting, cross-site request forgery, broken access control, etc.

TrustMe.ai testing technologies can run locally on client premises or test your application code residing in a cloud platform (such as GitHub). Those technologies are automated and thus require minimal client efforts. They serve the client with reports that outline detected vulnerabilities (e.g. SQLi), identify their location in the code, and provide remediation advice: how to fix the vulnerability. Upon remediation, security testing would run again to ensure that the vulnerability has been fixed. 

Additionally, TrustMe.ai provides DevSecOps Efficiency Management technology, which tracks developers’ activities and identifies teams and developers that make errors that allow security vulnerabilities. The technology also estimates DevOps project delays caused by the necessity to fix vulnerabilities and gives a complete insight into the efficiency of DevSecOps processes. It enables clients to effectively plan and manage secure software development and operations.

For more information on TrustMe.ai technologies/services reach out to contact@trustme.ai or visit our website at www.trustme.ai.

What is Trust in Business?

Trust has always been an invaluable currency, but particularly in today’s digital landscape and remote world as businesses strive to build trust with their customers, partners, and investors. It is crucial for businesses to demonstrate their dedication to security, reliability, and integrity. Trust serves as a vital foundation upon which business relationships are established, acting as an intangible form of currency that surpasses mere financial transactions. 

This article explores the significance of trust in business and explains why it is essential to invest in the identification and mitigation of digital risks. Doing so is key to safeguarding and elevating this invaluable asset.

Trust is Important to a Business. Why?

Customer Loyality

Trust is important in any ecosystem, whether B2B or B2C.  In a B2B ecosystem, given the intricacy of relationships, significant investments, and shared objectives that characterize this environment, nurturing loyalty becomes of utmost importance. Customer loyalty extends beyond mere repeat business opportunities; it encompasses elements such as trust, reliability, and a mutual commitment to growth. 

With mutual trust, a B2B relationship is often transformed into strategic partnerships that actively promote mutual growth for both the businesses, with invaluable feedback, and often collaborations on co-development initiatives. This loyalty not only enhances revenue but also establishes a solid foundation for enduring, mutually advantageous relationships, thus making Trust, an indispensable asset in the B2B world.

Thus Trust is a critical factor for the longevity of business relationships, and both sides generally have shared interests and values, including commercial interests, as long as trust and mutual respect are integral components.

In a B2C environment, Businesses rely on customer loyalty for sustained growth. Customer loyalty is built upon a firm foundation of trust. When customers have faith in a business, they are more inclined to come back, make multiple purchases, and even spread positive word-of-mouth as brand advocates. The process of gaining trust goes beyond securing a single sale; it involves nurturing long-lasting relationships.


Having a strong reputation is extremely important for every business. Building a strong reputation can be a time-consuming process, and it takes several years to establish. However, a single security breach or scandal can tarnish this hard-earned reputation in no time and may even lead to a shutdown. Therefore, responsible businesses that understand the value of trust, always invest in preserving their reputation, through well defined processes and check points.

Investor Confidence

Trust plays a crucial role in attracting investors as they require reassurance about the safety of their capital and the company’s commitment to integrity and strong governance. In the world of early-stage startups to small to medium-sized businesses (SMBs), Trust is absolutely essential when it comes to attracting investors. 

In early stage startups, Investors are not only looking for a strong commitment to integrity and solid governance, but also reassurance that their capital is in safe hands. This is particularly crucial when a business is in its nascent stages and may not have a large customer base or a fully functional product. In such cases, the founding team must not only demonstrate their ability to execute their vision but also establish themselves as a trustworthy entity. Building trust is a key factor that greatly increases the likelihood of securing the vital investments needed for growth and success.

When it comes to SMBs, Trust plays a critical role in attracting investors to SMBs because it lowers perceived risk, signals a long-term commitment to success, and fosters confidence among stakeholders. These factors make a business a more appealing and reliable investment opportunity, increasing the chances of securing the essential capital needed for growth and further expansion.

Stay Ahead of The Competition

Trust is a powerful attribute that can effectively distinguish a business from its competitors. When presented with a choice, prospective partners/customers often tend to favor a trusted company over an unproven one, overlooking the rest of the factors. Hence, trust becomes a highly valuable differentiating factor for businesses.

Regulatory Compliance

Trust is a powerful attribute that can effectively distinguish a business from its competitors. When presented with a choice, prospective partners/customers often tend to favor a trusted company over an unproven one, overlooking the rest of the factors. Hence, trust becomes a highly valuable differentiating factor for businesses.


It is important for businesses to know the hidden vulnerabilities and the risks thereof so that they can fix them upfront. Attempting to rectify a situation after the damage has been done is a less-than-ideal scenario. 

In conclusion, it is important that a business has to understand the importance of Trust and ensure that they have the right investment in the  identification and mitigation of digital risks.This investment decision is no more just strategic choice for a business anymore; it is an imperative step for safeguarding and elevating the invaluable asset of trust in business. In an era where trust forms the foundation of success, businesses that prioritize security, data privacy, and resilience are the ones that build enduring trust with their customers, partners, and stakeholders. By addressing digital risks, these businesses secure not only their digital ecosystems but also their reputation, customer loyalty, and competitive advantage, ensuring a future where trust remains the ultimate currency of prosperity.

Remember, In a business, Trust takes years to build, yet one small oversight of a digital vulnerability can bring it all crashing down.

A Practical Definition of “Holistic Approach and Assessment” 

“Holistic” is one of the most popular terms used across the IT industry. Almost every enterprise and every vendor claims their approach to problem-solving as being holistic. Yet in explaining it, they typically state that they either address the problem in its entirety, provide a complete solution, or have all products and components necessary to make their solution “holistic”.  In many or most cases, they simply rephrase some dictionary definition such as “relating to the whole of something or to the total system instead of just its parts” as defined by the Cambridge Dictionary.

Instead of debating whether such a liberal use of the term “holistic” is proper, we offer what we think is a reasonably formal and practical definition of a holistic approach and assessment.

Assessment of an enterprise posture is holistic when the following requirements have been satisfied: 

  1. Collection and aggregation of a variety of heterogeneous data classes. 
  2. Correlation of these heterogeneous data classes.
  3. Contextual assessment of the correlated data classes 
  4. Assignment of a single assessment score that defines the posture the enterprise.

A holistic approach is ensured by the above four principles:

  • Collection and aggregation of heterogeneous data-classes and subclasses creates a source of data that enables analysis of all or most aspects of the enterprise. (e.g., not only application security, or not only developer effectiveness, or not only asset utilization, or not only third-party vendor reputation, etc., but all of them).
  • Correlation: Just collecting and aggregating various data classes is not enough: they should be correlated. Correlation means establishing relationships between different data classes (e.g., security and reputation), which enables bridging different aspects of an enterprise, thus expanding the range of visibility (observability)). Correlation serves as a preliminary step to Contextual Assessment.
  • Contextual Assessment means taking under consideration not just an isolated event or a data-element, but also the circumstances that made it happen. Context makes assessment credible and justifiable, as it enables analysis from the various angles/aspects. Contextual assessment enables prioritization (e.g., contextual assessment will enable prioritizing remediation efforts: out of two equally severe vulnerabilities, the higher remediation priority gets the vulnerability discovered in the application with a higher business-criticality). Correlation and contextual assessment enable optimal decision-making by bridging different aspects of the enterprise (e.g., security, assets utilization, developer efficiency, third-party risk) thus enabling to make decisions that are best for the entire enterprise, not just for one of its divisions/aspects (possibly harming other divisions/aspects).
  • Assignment of a single assessment score (or a minimal number of scores) to the enterprise’s posture.
    • Collecting and aggregating various data classes, along with the benefits, also poses a risk of being lost in the ocean of data. Unable to handle such a variety and volume, enterprise decision-makers often use a few out of many data classes, limiting the number of data classes, thus making arbitrary decisions that often prove to be suboptimal. The solution is the following: enterprises should be collecting a massive variety of data classes covering all enterprises’ aspects yet assessing the posture with a single score. 
    • The single score will enable an easy grasp of the enterprise’s posture. At the same time, the score should be composite, allowing decision makers to drill into specific aspects of the enterprise posture. The score will indicate the trends: whether the enterprise’s posture (security, risk, asset utilization, employee efficiency, etc.) is improving or declining. That approach would enable enterprise decision-makers to make accurate, optimal, justified decisions regarding the enterprise’s transactions and operations, such as M&A, cost reduction, asset acquisition, and DevSecOps.

Applying the above four principles does ensure a holistic approach, enables most-complete visibility across all aspects of the enterprise, and enables optimal decision-making.

For more details on the subject, please refer to our previous blog posts on “Assessing Enterprise’s Posture: Not-Enough Data or Too-Much Data?” and “Correlation and Context: A Must for Assessing Enterprise’s Risk and Security Posture.”

Correlation and Context: A Must for Assessing Enterprise’s Risk and Security Posture 

In my previous blog post: “Assessing Enterprise’s Posture: Not-Enough Data or Too-Much Data?” we debated what volume of data classes is necessary for assessing an enterprise’s risk and security posture. In this post, we will discuss the need for data correlation and context.

Correlation and Context are Mandatory for Enterprise Assessment 

The number of data classes – too few or too many – is not the only issue that enterprise assessment and modeling should address. To ensure an accurate assessment and model, those data classes should be respectively correlated, and assessment should be contextual.

Correlation is about establishing relationships between different data types. For example, relationships between 1) the severity of a vulnerability and 2) the ease for a hacker to detect this vulnerability. 

Contextual Assessment takes under consideration not just an event itself but also the circumstances that made that event happen or circumstances that influenced that event. 

Correlation and contextual assessment carry out a critical practical value: they enable optimal decisions. 

For example, contextual assessment of the above example will enable prioritizing remediation efforts: out of two equally severe vulnerabilities, the higher remediation priority gets the vulnerability which is easier to detect. The remediation decision will be done by placing the severity of the data type into the context of the ease-of-vulnerability discovery context. Please notice that this is an example when both data types are from the same space, i.e. Security. 

Another example where correlation between data classes that belong to different spaces is the following: finding a relationship between 1) severity of vulnerability (Security) and 2) a developer who made this vulnerability possible (Developer Efficiency). Contextual assessment of such a correlation will enable taking steps to improve that developer’s security skills, provide training, or remove him/her from security-sensitive projects. Here, the severity of the vulnerability is placed in the context of the developer’s efficiency.

Unfortunately too often, different data types are treated in isolation, out of context. That establishes a siloed approach to enterprise assessment, where each area gets assessed separately, without considerations of other areas. That results in siloed decisions, which might be good for a particular task/transaction/department, but not for an overall benefit of the entire enterprise. Thus, a win in one place can result in an overall loss.

Correlation and contextual assessment increase the accuracy of the assessment/model, enable multi-factor analysis, and allow replacing the siloed approach with a holistic approach by bridging a variety of data types from all corners and aspects of the enterprise.

Correlation and contextual assessment unlock insight into hidden issues such as insider threats, unnoticed vulnerabilities, and about-to-be-lost productivity, which might result in security and risk exposures, and eventually – in business failures. Far too often, inability to correlate and contextualize stems from the enterprise’s reliance on multiple siloed tools and platforms,which makes correlation and contextualization difficult or even practically-impossible, leaving the decision-makers in the dark.

Assessing Enterprise Posture: Not Enough Data or Too Much Data?

Before making any decision that affects an enterprise, its decision-makers should assess the enterprise’s posture: posture of its security, risk exposure, third-party products’ and services’ risk and efficiency, employee efficiency, asset utilization efficiency, vendor and product reputation, etc. Accurate assessment is mandatory for making optimal decisions and avoiding failures.

And yet, the assessors should realize that every assessment of an enterprise’s posture is modeling. It is a modeling because the assessment is NEVER fully realistic, but always an approximation, i.e., an assessment is a model of a real enterprise. Such an approximation can be quite far away from reality, causing enterprise leaders to make wrong decisions, which lead to monetary losses, reputational damages, and security breaches.  It is critical for an assessment/modeling to be as close to reality as possible.

Assessment/Modeling Problem: Not Enough Data or Too Much Data?

Why is every assessment an approximation? At least, for these two main reasons: 1) There are not enough assessment points or 2) There are too many assessment points. This is not a joke or exaggeration, but the truth.

Not Enough Data: There are never enough assessment data classes and data points to assess the enterprise fully. Let us look at these examples: a comprehensive assessment of a security posture requires assessing application security posture, network security posture, data security posture, etc. Detailed assessment of each of those postures brings in more details: For example, assessing application security posture requires conducting application security code analysis, runtime application security analysis, software composition analysis (discovering malicious open-source components), etc. The same is true with other security postures. A deep dive into each posture requires additional analysis, which exponentially increases data classes (i.e., types of the analyzed data, e.g., code security vulnerabilities, OSS component vulnerabilities, runtime configuration vulnerabilities, etc.), which decision makers should consider. Needless to say, the number of data-points (collected instances of each data class) is also increasing exponentially.

The task of collecting data classes is expensive and complex. Practically, the number of data classes collected by the enterprise is not fully sufficient to cover all aspects of an enterprise. Thus, some aspects of the enterprise’s posture are not covered at all or not covered sufficiently. How many data types do we need for the posture analysis? Practically, fewer than we can get!  That makes the assessment an approximation of reality, and often, a quite distant one at that.

Too Much Data: There are too many assessment points that are necessary to capture an enterprise’s posture, therefore enterprise decision makers are lost in the ocean of data classes and data points. Unable to handle such a variety and volume, they use a few out of many, limiting the number of data classes and data points within data classes, thus making arbitrary decisions that often prove to be suboptimal. How many data classes and data points do we need? Ideally one. At most, just a few!

Solving the Dilemma: Too Much Data or Too Little Data?

Finding the balance between these two diametrically opposed approaches – Too Much vs Too Little – is a problem that should be resolved. We argue that the balance could be found if the massive variety of data classes and data points is balanced by a single assessment score, like a FICO score in finance. We mean that enterprises should be collecting a massive variety of data classes covering all enterprises’ aspects yet assessing the posture with a single score. The single score will enable an easy grasp of the enterprise’s posture. At the same time, the score should be composite, allowing decision makers to drill into specific aspects of the enterprise posture.

The score will indicate the trends whether the enterprise’s posture (security, risk, asset utilization, employee efficiency, etc.) is improving or declining. That approach would enable enterprise decision makers to make accurate, optimal, justified decisions regarding the enterprise’s transactions and operations, such as M&A, cost reduction, asset acquisition, and DevSecOps.

Are Leaders Taking Too Narrow a View of the Risks they Face?

Of course, they are! You might find your own explanations for that narrowness of a view, but I will offer you mine.

It is not surprising that the view is narrow.

  1. First of all, it is not one risk area, but many risk areas that should be viewed / observed / analyzed / strengthened.
  2. Moreover, the view should encompass not only risk areas, but security areas as well, thus increasing the range of a view and requiring additional efforts/skills/tools/resources/analytics.
  3. These numerous responsibilities to view-analyze-detect-act are spread across a broad variety of executives and their respective organizations.
    • Security Issues (such as Network Security, Application Security, Data Security, Cloud Security, Identity and Access Management) are the responsibilities of a Chief Information Security Officer (CISO).
    • Compliance risks are under the auspices of a Chief Risk Officer (e.g., issues of the company’s compliance with HIPAA, PCI, GDPR, etc. regulations).
    • Risk (Legal, Auditing, Ethics, Contract, Privacy, etc.) issues are under Chief Risk Officer.
    • Operational Risks are under Chief Operating Officer. 
    • Financial – under Chief Financial Officer.
  4. Those areas of risk, security and productivity do not have a single, generally adopted, well-defined scoring/measurement mechanism.
    • Having a view on a subject (e.g., a view on Application Security or Compliance Risk) means having a measuring/scoring mechanism that informs and indicates whether the security/risk values are within acceptable limits. Unfortunately, such measuring/scoring mechanisms are either vague, proprietary, or absent at all.
    • Let us take Application Security as an example. There is a well-developed mechanism for rating severity of vulnerabilities per OWASP guidelines (the so-called OWASP Top 10). Yet, severity alone is not sufficient for providing a CISO and his/her employees with an actional view. They must also know the probability/ease of detecting those vulnerabilities by hackers; mission-criticality of the vulnerable application; ease of fixing, etc. In other words, a complete assessment mechanism is proprietary and underdeveloped (or not developed at all).
    • Those mechanisms are not universally applicable either. For example, PCI Compliance Risk guidelines are quite-well defined, yet they are not applicable to Legal and Ethics Risks.
  5. Those security and risk areas are not correlated with each other. Neither are they correlated with a variety of parameters that define an enterprise’s IT ecosystem.
    • Using our Application Security example, the vulnerability severity should be correlated with the ease of vulnerability detection by hackers, as well as mission-criticality of a vulnerable application. Such correlation makes analytics actionable, setting priorities for remediation (the highest remediation priority should have a mission-critical application where vulnerability-detection is easiest for hackers).
    • Correlation between risk, security, and IT ecosystem characteristics enables contextual assessments, which, in its turn, enables actionable advice and remediation efforts.
  6. Shall we be surprised that so many executives do not have a comprehensive view of many areas of risk, security and productivity, but rather a siloed view into each area of ownership?
    • Shall we be surprised that not having a generally acceptable scoring/assessment mechanism for risk, security and productivity makes it challenging for those executives and experts to talk to each other and have meaningful exchange on the enterprise’s state of risk, security and productivity?
    • As a result of those deficiencies, executives see their own particular trees, but cannot see the forest for the trees. Should it be surprising then, that hackers find pathways between those trees to breach into the enterprise’s forest?

We are concluding that absence of a comprehensive measure/scoring mechanism weakens an enterprise’s defenses and its ability to withstand attacks and cataclysms.

There is a clear practical need for an introduction of a new, comprehensive category that:

  • Will serve as a composite characteristic for a variety of risk, security and productivity categories
  • Will give CxOs an instant, easy-to-comprehend indicator of the state of risk, security and productivity
  • Enable drilling down into each subcategory
  • Enable practical remediation/improvement actions

That category should ensure trust into the enterprise’s operational environment that supports all business operations and transactions.

What is the Difference between Risk and Security?

Is risk part of security? Is security part of risk? Those two terms are often confused one for another, used together and interchangeably in the same context. And yet, they are not the same. Not at all.


A good starting point in our discussion is defining the terms.

  • Security is a concept that aims to protect against actions/situations that will cause failure or deviation from the intended functioning.
  • Risk is a concept that aims to avoid exposure to harm.

For example, to be secure at a personal level, you should learn self-defense techniques and wear body armor. To be risk-conscious at a personal level, you should avoid walking in the dangerous areas of the city. To be secure at an enterprise level you should learn application security testing techniques and install firewalls. To be risk conscious at an enterprise level, you should follow regulations to avoid paying penalties for compliance-violation.

Those differences in definitions between risk and security have practical consequences. One of them is:

Risk and Security Organizational Structures

Who handles risk and Security in the enterprises? Well – two different organizations, different reporting structures. At an enterprise, security issues are managed by the Chief Information Security Officer (CISO). Typically, CISO reports to a Chief Information Officer (CIO).

Risk issues are managed by Chief Risk Officer (CRO) and Chief Compliance Officer (CCO), which might be a combined position or two separate ones. Typically, CRO/CCO report to the Chief Operating Officer. This is not a bureaucratic whim, but a reflection of differences. And that list of differences continues.

Variety of the Markets

There is a stunning difference between the number of markets in risk and security spaces.

The security space consists of several mega-markets, such as: Identity and Access Management, Network Security, Data Security, End-Point Security, Application Security, Cloud security.

Each mega-market consists of numerous technology markets, e.g.:

Application Security includes markets such as: SAST, DAST, SCA, WAF, ASPM, ASRTM, Application Shielding, etc.

Data Security includes markets such as: CASB, Cloud Data Protection Gateways, TLS Decryption Platform, FP-Encryption, DLP, Data Discovery and Management., etc.

Network Security includes markets such as: Network Firewalls, Secure Web Gateways, Network Access Control, SASE, NSPM, ZTNA, NDR, etc.

Cloud Security includes markets such as: CWPP, CSPM, Serverless Function Security, Container and Kubernetes Security, etc.

The total number of security markets is measured in dozens. It makes the number of participating vendors measured in many hundreds, if not in thousands.

The risk space is much less populous: few markets, fewer vendors. We can point to markets such as: Integrated Risk Management Solutions, Enterprise Environmental, Social and Governance Software, IT Vendor Risk Management Solutions, Regulatory Change Management Solutions, Third-Party Risk Management Solutions, Ethics and Compliance Management, Enterprise Legal Management, Contract LifeCycle Management. All together – they represent just a fraction of the variety of security markets.

Growth Rates

The security space enjoys higher growth rates than the risk space. Leading market-analyst firms estimated that Application Security and Cloud Security will grow at a rate between 22% and 25%, Data Security: 13% -18%, Identity and Access Management: at around 12%, while Integrated Risk Management – at a rate slightly above 8%. In absolute numbers, within the next several years, the Integrated Risk Management market will reach a size of around $9B, while security markets – above $160B. Such differences deserve special attention and a separate conversation.


It is evident that risk and security expose very different characteristics across many dimensions, which raises questions, such as:

  • Why are they so different? Why is security so much more diverse and rapidly growing compared to risk?
  • Is there a need to bring them (e.g., their diversity and growth indicators) closer? Is it possible? Does it make sense, and if so, by what means?

Introduction of trustme.ai

As the industry embraces digital transformation to be innovative, productive, and more efficient, it creates challenges to keep up with business risks. Many executives come to realize that business risk may become more complex in the future, and it comes from anywhere. As enterprises deal with their customers, partners, and ecosystem, Trust becomes an important factor to build a successful business. As a business leader, you may always think about how to boost teams’ productivity and efficiency; make sure your software is secured from any vulnerabilities; how to enhance the company’s reputation; and cost optimization based on the risks.

As you embark on digital transformation to deliver value to your customers, you may have to worry about government and regulators’ compliance requirements besides security. There are many vendors that focus on risk whether Third-party Risk Management or Rating services, however, they lack Security insights and the same thing goes to security vendors who may lack business risk context. On top of that, these tools are complex and difficult to manage.

What enterprises need is a simple platform that provides insights into risk, security and productivity with continuous monitoring to improve agility and efficiency which yield trust among customers and partners.

This is why we are excited to announce our trustme.ai solution which is AI-driven, simple, intuitive, and comprehensive Risk, Security and Productivity Posture Management Platform that empowers business executives with visibility into the risks, security, and inefficiencies impacting their business. This platform offers an easy-to-understand TrustMe score (like the FICO credit score) that defines risk, security and productivity posture and provides actionable insights.

TrustMe closes the gap between security and risk management with complete observability and continuous monitoring of Products, Perimeter, Processes, and People. TrustMe platform continuously discovers and monitors security, licensing, and dependency vulnerabilities in your software, including open-source libraries and operational efficiency to accelerate innovation and growth for the organization and its customers. Our preemptive analytics enable executives with the capability to model actions and foresee their repercussions before the actions take place, thus avoiding any risks.

Please visit trustme.ai to learn more about how you can build Trust for your ecosystem with TrustMe.ai Risk, Security and Productivity Posture Management platform.