Sequoia, a prominent venture capital firm based in Silicon Valley, is throwing its support behind a Danish startup, Coana, to develop an advanced software composition analysis (SCA) tool. This tool aims to assist companies in identifying and prioritizing vulnerabilities effectively, amidst the complexity of modern software supply chains.
Addressing the Challenge
In today’s software landscape, numerous applications incorporate open-source components, often outdated and inadequately maintained. This reality has given rise to various security vulnerabilities, exemplified by incidents like Log4Shell, which exploited weaknesses in the Log4j Java logging framework. Consequently, regulators are tightening the reins on software supply chains, prompting businesses to enhance their security measures.
However, the sheer volume of components within the software supply chain poses a challenge. While existing SCA tools alert companies about known vulnerabilities, the abundance of alerts can overwhelm security teams, hindering their ability to prioritize critical issues effectively.
Coana’s Innovative Approach
Coana, a cybersecurity startup founded in Denmark in 2021, introduces a novel concept of “code aware” SCA to address this challenge. Leveraging this approach, Coana’s tool enables users to filter out irrelevant alerts, focusing solely on significant vulnerabilities.
The company’s founding team, comprising a computer science professor and two PhDs from Denmark’s Aarhus University, developed this groundbreaking technology. Their expertise in analyzing large JavaScript-based applications paved the way for Coana’s innovative solution. CEO Anders Søndergaard, joining the team in 2022, brings valuable experience from his previous venture, Resilio, a biometrics tech startup.
Funding and Growth
To propel Coana from its early-access stage to full commercialization, the company recently secured $1.6 million in a pre-seed funding round led by Sequoia Capital. Essence VC and several notable angels, including executives from Google, Red Hat, and GitHub, also participated in the funding round.
Coana’s tool provides a comprehensive analysis of software applications, spanning both application code and dependencies. By creating a “call graph” of the entire application, the tool identifies data flow paths, enabling the elimination of false positives. While Coana initially focused on JavaScript, it plans to expand its support to Java and Python, catering to a broader customer base.
As Coana continues to evolve its product and expand its language support, it aims to target large enterprises in the future. Despite the early stage of development, Coana’s innovative approach to SCA holds significant promise in enhancing software security and resilience.
Leave a Reply