Case Studies - Glog.AI

Case Study: AMD (Advanced Micro Devices)

Securing the Future of High-Performance Computing: Glog.AI & AMD ROCm™

The Partner AMD is a global leader in high-performance computing, graphics, and visualization technologies. Their ROCm™ (Radeon Open Compute) platform is a pivotal open-source stack for GPU computing, powering some of the world’s most advanced AI and research workloads.

The Challenge Open-source ecosystems of this scale present a massive attack surface. AMD required a way to systematically evaluate the security posture of the entire ROCm™ organization on GitHub comprising hundreds of individual repositories as well as the critical AMDGPU Linux driver integrated into the Linux kernel (v6.16).

The Solution: Automated Intelligence at Scale Glog.AI deployed its automated security scanning engine to provide deep visibility into these mission-critical projects.

Massive Scale Scanning: Automated security configurations were established for all 343 repositories within the AMD ROCm™ organization.
Kernel-Level Analysis: Targeted analysis of the AMDGPU driver within the 6.16 kernel, ensuring the foundation of GPU-OS interaction remains resilient.
Software Product Inventory (SPI): All data was funneled into Glog.AI’s centralized dashboard, a “single pane of glass” that provides real-time inventory, security data, and vulnerability analysis.

The Results By transitioning from manual oversight to an automated, centralized model, Glog.AI provided AMD with:

Comprehensive Visibility: A complete security map of 343 repositories.
Centralized Management: The ability to track vulnerabilities across disparate projects through the Glog.AI SPI dashboard.
Proactive Remediation: Faster identification of potential risks within the ROCm™ stack and Linux kernel drivers.

Key Highlights

Massive Scale: Scanned 343 repositories and provided comprehensive, actionable remediation advice.
Centralized Management: Established a centralized inventory and management system for all software products.
Seamless Integration: Automated security processes through direct GitHub workflow integration.
Actionable Insights: Delivered highly accurate, context-specific remediation advice directly to developers.
Enhanced Accuracy: Significantly reduced false positives, filtering out the noise to focus exclusively on true vulnerabilities.
Drastic Time Savings: Eliminated thousands of hours typically spent manually analyzing and triaging security findings.
Operational Efficiency: Streamlined the vulnerability resolution process without slowing down agile delivery schedules.
Proactive Security: Empowered the team to adopt a “security by design” approach right at the source code level.

Articles

Discover how Glog.AI enhances cybersecurity and software security. Our articles delve into real-world examples and explain the ‘how’ behind our solutions.

Glog.AI Products & Services Matrix

Product/Service Name	Core Functionality	Key AI/ML Differentiators	Target Use Case
Glog.AI – Software Security	Automated code vulnerability identification and remediation during development	AI-powered contextual analysis, automated fixing, false positive reduction	DevSecOps, Application Security
NetEcho – Network Security	Predictive network and endpoint threat detection, anomaly identification	AI-driven behavioral analysis, threat forecasting	Network Security Monitoring, Endpoint Protection
Security Predictions	Anticipation of emerging attack patterns and potential targets	Advanced AI analysis of diverse threat intelligence feeds, proprietary prediction algorithms	Proactive Threat Intelligence, Strategic Security Planning
vSOC	Virtual Security Operations Center services	Leverages NetEcho & Security Predictions, AI-assisted analysis by human experts	Continuous Security Monitoring, Incident Response
Penetration Testing	AI-enhanced vulnerability identification and assessment	More efficient, comprehensive, and insightful analysis through AI assistance	Security Audits, Vulnerability Management
Trainings	Secure software development education	Practical, up-to-date secure coding practices	Developer Upskilling, Building Security Culture

This matrix provides a structured overview of Glog.AI’s portfolio, highlighting the AI-centric nature and specific value proposition of each offering.

Case Study: EuroICC

EUROICC is hardware and software manufacturer, R&D outsourcing partner and system integrator in automation. Smart Hotel Control products enable our business partners to work more efficiently, safely and cost effectively. Its ToCCata guest room management system incorporates room monitoring and hotel management.

Business Challenge

Guest Room Management System based on C series of micro-controllers is a flexible solution applicable for different size hotels – from small inns to luxurious hotels. Main functionalities are access control, power saving, staff monitoring and more effective processing of different alarms, requiring EuroICC to consistently meet the highest levels of data security and safety. The main challenge is to reduce risk and secure EuroICC’s software products throughout the Software Development Lifecycle (SDLC) without slowing down delivery schedules. It is also required from EuroICC to meet business needs to deliver new, updated, or customized products to market as quickly as possible. EuroICC’s goal was to make software secure at the source code level and incorporate security focused culture into SDLC from the ground as a single security breach could seriously harm the company and its customers. EuroICC team lead said: “Our software operates on the hotel network and also communicates with different internal and external software and services such as BMS, PMS, CMS and ACS. Software works in an environment which can be threatened and attacked from different points and, as part of the hotel network, it must fulfill the highest security standards in order to be a reliable part of the whole system. Thus, we came up with the idea of using Glog which should help us find real security threats potentially missed in development and remediate them efficiently. Same time, an important outcome is increasing the ability of our engineers to improve software architecture in terms of security.”

Results

Glog team provided services to secure software on source code level, saved scanning time and improved scan coverage of source code providing only relevant scan results to EuroICC developers. Trustworthy scan results without false positive findings and in-context remediation advice, helped developers in their effort to increase software’s security. Glog provided the possibility to detect potential security vulnerabilities, remediate within required timeframes and deliver more secure software products. It saves days of developers’ work usually needed to scan, triage and fix findings in their source code. Glog solution helped EuroICC to be proactive in discovering and fixing security issues. Additionally, EuroICC was able to implement security by design approach to make software more secure. EuroICC team lead continued: “Firstly, we got clear analysis about security weaknesses of our software product. With detailed explanation of the nature of the issues and clear remediation advice by Glog, our developers are able to fix the code with vulnerabilities and make it more secure. Overall, we saved a tremendous amount of time and energy on finding and analyzing the threats, triaging it including prioritization, and then remediation and fixing the security vulnerabilities. Finally, the experience working with the Glog team is valuable for our future development and maintenance of our software.”

About Glog

Glog project is focused on research and development of a solution which gives remediation advice for security vulnerabilities in software code based on context. Moreover, it is capable of automatically fixing those vulnerabilities. We are developing such a solution based on machine learning and AI. Agility in software security is becoming a reality! More info at www.glog.ai.

False Positives Challenge

Leading provider of SAST tools on the market asked us to analyze their scan results and security vulnerabilities findings in two popular projects. Here are results (names and results redacted due to confidentiality and sensitivity). Here are results of Glog solution work on it:

Applications AH and OAM scanned by leading SAST tool on the marked and 12,494 security findings reported in total by that tool. Based on experience, the average time to analyze and resolve totaled 2 hours per finding (Note: it can vary from a couple of minutes to even weeks per security finding). Estimated total time to resolve these findings using standard methods: ~ 24,988 hours i.e. ~ 164 man-months (effective 152 hours per month), ~ 13.7 man-years Glog did it in less than 4 man-days for these big projects, together with remediation advice! Glog confirmed a total of 49 true positive (TP) findings and offered very precise remediation advice. Work in progress with a couple of popular tools including messengers and similar.

General use cases

Select your scenario to see how we can help:

Software Development Company

You are a software development company and you haven’t implemented software/application security practice and process as part of your SDLC – Software Development Lifecycle. Your product is deployed in a production environment. Hackers quickly spot vulnerable product, exploit vulnerabilities. Data are stolen, altered or damaged by unauthorized parties – malicious actors. You face liability toward customers and regulators. Your reputation is ruined or damaged. What to do? You need to implement software security practice and process as soon as possible. We can help. Feel free to contact us. Glog solution helps you to reduce or eliminate security debt. Otherwise, it will grow and can reach a level which you might not be able to resolve in future.

Startup

Let’s say you are the founder of a startup. With your co-founders and development team you rush to create your MVP – Minimum Viable Product and to put it live. Hackers spot that your MVP is live. For them it is also MVP but they see it as the Most Vulnerable Product! Regulators see it as an MLP – Massive Liability Product.What to do? You need to implement software security practice and process as soon as possible. It should be part of the process from the beginning!Contact us to help you.

Software User

You are a company or individual using software from a vendor and want to make sure software is as secure as possible as well as to be compliant with relevant security and privacy standards and regulations.

Ask your software provider or vendor if they have security as part of their SDLC – Software Development Lifecycle. Have they performed necessary security testing and remediated vulnerabilities? What to do if they haven’t done it? Direct them to us to help them to secure their software and software supply chain. Contact us to help you.

Regulatory Body

You are a regulatory body and want to make sure software is as secure according to standards and regulations.

Ask your software provider or vendor if he has security as part of their SDLC – Software Development Lifecycle. Have they performed necessary security testing and remediated vulnerabilities? Can they prove it? What to do if they haven’t done it? Direct them to us to help them to secure their software and software supply chain. Contact us to help you.

Compliance

You have to be compliant with various security and privacy standards and regulations (e.g. ISO/IEC 27001, ISO/IEC 27034, ISO/IEC 5055, ISO/IEC 27701, NIS2, DORA, EU CRA, NIST SSDF, PA DSS / PCI DSS, WLA SCS, HIPPA, GDPR etc.)

With proper software and security processes and practices in place, as part of your SDLC – Software Development Lifecycle, you are much better positioned to be compliant.Contact us to help you.