NetRise elevates their user experience with Google Cloud

Editor’s note: NetRise, a cybersecurity company, has developed a platform to address software supply chain vulnerabilities, especially within the Extended Internet of Things (XIoT) and Cyber Physical Systems (CPS). Its latest solution, Trace, utilizes large language models and Cloud SQL for PostgreSQL for efficient vulnerability detection and code-origin tracing. By integrating with Google Cloud’s fully managed services, NetRise has reduced processing times and strengthened scalability. The partnership between NetRise and Google Cloud not only offers improved security evaluation but also promises to shape future product security practices across the industry.

NetRise’s platform can empower users to identify risks in software components within embedded systems, which have historically been considered black boxes. In advancing this mission, we see that the vulnerabilities of third-party software, which is largely built on open-source software (OSS), are a critical blind spot for security operations teams.

Marked by their lack of standardization, open-source software makes global analysis particularly challenging, especially during supply chain attacks. This complexity is magnified within the Extended Internet of Things (XIoT) and cyber-physical systems (CPS). Here, embedded systems are often obscured due to distinct manufacturer standards and proprietary firmware packaging formats, making automated analysis technically demanding.

These challenges not only highlight the need for robust solutions, but also emphasize the value of scalability, user-friendliness, and precision in a realm clouded by complexity.

Addressing the unseen

Central to our approach in untangling supply chain vulnerability challenges is Trace, which combines large language models (LLM) with Cloud SQL for PostgreSQL. Using a fully managed relational database is pivotal to Trace, underpinning our data management and query capabilities while enabling efficient and accurate vulnerability detection and code-origin tracing.

Security teams can perform broad, scalable searches across all file assets without reprocessing the same NetRise asset images (the files within their embedded systems). Imagine malicious code infiltrating a Python package. Trace pinpoints the affected NetRise assets, files, or open-source packages, and provides a clear graph-based visualization of the impact.

Complementing Trace is a proprietary extraction engine, which dissects complex software file formats for things like firmware, standalone software packages, docker images, virtual machines, bootloaders, ISOs, and more. When an asset is fed into the NetRise system, it first travels through this cloud-based extraction engine, which reveals any nested file formats.

The extracted text files are then transformed into vectorized numerical representations using machine learning techniques. These embeddings are subsequently housed in Cloud SQL for PostgreSQL with pgvector, which enables semantic searches using natural language (such as for hard-coded credentials or keys), simplifying analysis. The implementation of pgvector within Cloud SQL lets us handle more complex queries and larger datasets, for a more robust and scalable product.

Day-long turnarounds now take minutes

Turning to Google Cloud’s managed services was a game-changer for us. Cloud SQL helped us scale our architecture and optimize queries, significantly reducing the time and resources we needed to perform data analysis. And with pgvector, we were able to halve our server resources and cut response times by 60%, which is crucial in maintaining a superior user experience.

Most notably, the combination of Cloud SQL with pgvector provides trace capabilities to our customers and internal researchers, saving them months of manpower that they would have traditionally spent on detection engineering. The impact is a remarkable 10 times improvement in threat research and security operations, enhancing Netrise’s research and advisory use cases and our customers’ ability to respond proactively and reactively to security challenges.

By utilizing Cloud SQL, we can concentrate on our core competency: creating outstanding security products for our clients. This allows us to reallocate funds traditionally earmarked for infrastructure engineering toward enhancing our team of security researchers and detection engineers.

To accelerate our data processing capabilities, we switched from Elasticsearch to BigQuery. Processes that previously occupied an entire day now conclude in minutes. For instance, in a recent benchmark where we handled 33,600 assets, a task that typically extended beyond 24 hours is now completed in just 47 minutes — over 30 times faster than their original speed.

BigQuery coupled with Cloud SQL, highlights the power of having a unified data cloud ecosystem. Together, BigQuery’s analytics and Cloud SQL’s operational database management have enhanced our ability to handle large-scale data quickly and accurately, boosting our analytical capabilities and decision-making processes.