Business Requirements

As a pioneer in the digital transformation of the automotive industry, a well-known domestic joint-venture brand boasts a large-scale and complex software supply chain. The enterprise operates nearly hundreds of existing IT systems, which are continuously iterated, expanded, and deployed across private and public cloud environments. Open-source components are widely adopted, with 78% to 90% of applications containing open-source code. However, industry data indicates that 47% of new versions of these components have vulnerabilities, and only a small number of them are effectively notified and remediated, resulting in extremely high security risks from third-party components. During the development process, developers fail to systematically document the list of used components, making it impossible to quickly locate and fix vulnerabilities when they occur. Moreover, the cost of vulnerability remediation surges to 30 times higher after deployment than before.
In addition, regarding the R&D and operations security system, although the enterprise has established a DevOps R&D process and toolchain, security tools are managed in a fragmented manner, lacking a unified platform to integrate SAST/IAST/SCA and other tools. Developers and security personnel need to frequently switch between tools to view reports, leading to unordered retesting scheduling. Detection results rely on manual collection and judgment, with no ability to automatically block the R&D pipeline. There is a lack of security situation analysis, insufficient key data such as TOP vulnerabilities and project security comparisons, and security reviews lack informationized records and knowledge base support. These issues have severely restricted the efficiency of software supply chain security governance and become a bottleneck for the rapid advancement of business under the agile development model.