The Unified Prompt to Runtime Security Platform

I worked with Ox Security  as a service provider, not as a representative, but as a user. I use it in my employee capacity, providing services to companies in Israel, and one of them is an insurance company where we use this product to improve its security posture.

Ox Security  use cases include vulnerability management and understanding the company's security posture, as well as addressing the security state of our customer's cloud-native pipelines.

As a service provider, I believe the biggest advantage of Ox Security is its simplicity and the clarity of the issues, along with a very good dashboard showing the state of the company. I see degradation in critical issues and high issues over time when using the product for a prolonged period, so the dashboard is very inclusive and clear about the state of security.

Automated vulnerability management in Ox Security makes our security posture much better.

I'm not sure about flexibility because I didn't try it, so I can't comment on that, but as far as I understand, most of Ox Security is not personalized. I think that most of the tool is quite deterministic and cannot be personalized if you ask about customization.

Personalization and customization should be tackled as improvements that could be made.

Regarding missing features, I think that customization should be addressed, and it would also help if disputable issues could be shown rather than simply dismissing them or not displaying them at all.

I do not have extensive experience with Ox Security, as I started working with it approximately six months ago.

I would say Ox Security is about ninety-nine percent stable. We had some issues on one occasion where we saw a huge jump in the graph due to a bad deployment, but that happened just once in the past six months, so it is not representative.

Ox Security is highly scalable without limitations in this regard.

I find the customer service from Ox Security to be very helpful and attentive. If I had to rate the customer service from zero to ten, I would give it a ten.

As for return on investment, I don't know the pricing of the product, but based on what I understand from the customer, it seems quite honest. I work mostly on the technical side and the security posture rather than the pricing, so I won't be very conclusive regarding ROI itself.

Regarding threat detection capability, I think that Ox Security is not used for that matter. The CISO mainly focuses on dev sec ops rather than runtime security or real-time security.

I figure that the most important metrics for the analytics feature are the critical issues dashboard, which helps understand whether there is a leak of a secret or a very critical vulnerability that is not being used. Another important aspect is the integration with other products like JFrog and X-ray, which shows not all the findings but mostly focuses on what Ox Security considers the most important issues. For instance, we found some issues that were flagged by JFrog, but Ox Security dismissed them, leading to discussions about whether those issues are real, as there are often false positives in the security world, as well as considerations about the attack surface for each vulnerability and whether these are truly critical issues or not.

I work extensively with JFrog X-ray, which is my major tool for another customer. I believe that JFrog is more pinpointing, and I have some integration with JFrog with the build system, the CI/CD and X-ray vulnerabilities meter. It's quite useful, but I think that they serve different purposes; JFrog comes mostly from the artifact management side and less from security. Ox Security is mostly focused on the DevSecOps  and areas that cannot be detected. In terms of vulnerability management, Ox Security has strong integration, but sometimes there are vulnerabilities that are disputed or dismissed, which creates an interesting intersection between the two products.

From what I talked about with the DevOps team, deployment is quite straightforward.

My overall review rating for Ox Security is zero.

My main use for Ox Security  is having a centralized way of aggregating all of the vulnerabilities that I may encounter within different applications and different stages of the software life cycle we use, and to provide context to those vulnerabilities.

Ox Security  helps me daily in my workflow since it raises vulnerabilities found in our repositories, in our generated images, and in our cloud environments. An example of usage would be the integration we have into our CI/CD pipelines to help us with SAST  and SCA  vulnerabilities along with other scanners.

We use Ox Security as a main hub for our vulnerabilities, in the same way that AWS Security Hub  would behave.

The best features Ox Security offers in my experience are its ability to provide context to a vulnerability and determine if a vulnerability is likely to be exploited or not.

Ox Security delivers context through a mix of several things, including dashboards and its prioritization scoring system. Basically, if you have some configuration and your software is vulnerable to some kind of vulnerability, but that exact code doesn't execute the vulnerable code itself, it determines that the risk is unlikely to be exploited, for example.

Ox Security has positively impacted my organization by helping to reduce the amount of noise we received from vulnerabilities because of the prioritization scoring it has and all of the context it provides.

Regarding measurable outcomes, I would say that it has reduced the amount of noise by about forty percent. We didn't have that much noise before, so around a forty percent decrease in noise has helped us reduce the amount of hours we have to spend reviewing each vulnerability.

The main pain point I have with Ox Security as a tool is the user interface, which can feel quite complex when navigating large datasets. It's not as developer-focused as other tools.

More customization options for dashboards would be a nice to have regarding the needed improvements.

I have used Ox Security for about six months.

Ox Security is stable.

Regarding scalability, we didn't face any issue when deploying Ox Security in all of our clouds and repositories and CI/CD pipelines. I would say its scalability is good enough.

Customer support for Ox Security is generally good, but they may take a few days to answer sometimes.

I would rate the customer support a seven on a scale of one to ten.

Positive

We didn't use anything before Ox Security.

My experience with pricing, setup cost, and licensing was quite straightforward. Ox Security does not have a public pricing tier, and I had to contact them through sales, but they were really helpful with setting everything up and providing an amount.

I do not have a specific metric, but we have saved a lot of time while using Ox Security because our time to respond to vulnerabilities has decreased significantly and also because of the reduced noise received.

Before choosing Ox Security, we evaluated Aikido as well.

My advice to others looking into using Ox Security is that its strength relies on the aggregation of several tools. If a company is struggling with managing several tools just to get a better understanding of how their security posture is, tools like Ox Security are a must. I would rate this product an eight overall.