Brazilian Nalbatech, a company in the Nfq group, bought bugScout, a Spanish platform for analyzing source code of mobile apps and other software. The solution can analyze and identify in a few minutes if there are vulnerabilities in the source code of 34 different programming languages. Sabesp and El Corte Inglés are among bugScout’s customers. The purchase price was not disclosed, but NalbaTech informs that it will invest 1.5 million euros in three years to reinforce the operation of bugScout, whose development team will continue in Spain. A curious fact about the business: NalbaTech was, until then, a sales channel for bugScout. It is, therefore, a rare case in the business world where the sales channel buys the manufacturer.
BugScout performs two types of source code analysis: static and dynamic. In the static, it is verified if the programming met all the different international security standards and protocols. The dynamics, in turn, consists of “stressing” the software in an attempt to reveal some vulnerability that has not been pointed out by static analysis. On average, 94% of the vulnerabilities are pointed out in the static analysis.
“The vulnerabilities are global. When a new one is identified, we update the platform. It is a living world that evolves every day. Our update is constant, done daily. We have engineers dedicated solely to this ”, reports Francisco Bernabeu, director of Nalbatech. “Data exposure is the main vulnerability that has the greatest impact on mobile apps and applications in general,” he comments.
Each vulnerability found is classified according to its severity: high, medium, low or merely informative. Each vulnerability found is classified according to its severity: high, medium, low or merely informative. The bugScout report estimates how many hours of work it will take for each fix.
The analyzes are made through a virtual application with access controlled by the client, for the protection of its source code. The process is quick and takes just a few minutes. Bernabeu cites a recent example of a 1.8 million line source code that was analyzed in 20 minutes.
Billing is done by application, as a managed service. It is worth remembering that apps and other software from large companies usually undergo frequent updates, which requires new tests to analyze parts of their source code.