NetRise is making strides in the world of the Extended Internet of Things (XIoT) security with the launch of Trace. Introduced on the NetRise Platform on November 9, 2023, Trace is an innovative solution for identifying and verifying compromised and vulnerable assets across firmware and cyber-physical systems. Utilising AI-powered semantic search, this is the first time users can inspect their assets powered by an AI search.

Trace is set to enable improved vulnerability detection by allowing users to initiate intent-driven searches, the company. This differs from the traditional signature-based search approach where users hunt for specific code patterns or known vulnerabilities.

With intent-driven searches, users can now investigate the system based on the motives or purposes behind the code and configurations which lead to those vulnerabilities.

It captures a broader range of software packages, misconfigurations or unidentified flaws; highlighting the affected assets, files and packages using natural language, mapping their intricate relationships across the entire supply chain, hence removing the necessity for a scanning mechanism.

NetRise CTO Michael Scott said whilst identifying problems in XIoT devices and their components has been a particular challenge, the product release represented a "significant advancement in product security" and would "streamline the detection and resolution of issues in complex systems". Furthermore, it changes how NetRise customers discover and address issues, with AI playing a pivotal role in enhancing processes.

The use of AI-driven semantic search, supply chain impact analysis, and vulnerability validation with Large Language Model (LLM) capabilities are built into Trace. This forms a unified and potent solution to detect threats, whether known or hidden, in low-level firmware and other cyber-physical systems.

The features and capabilities of Trace include AI-powered search. This is a semantic search enabling users to uncover any vulnerabilities across all assets. Other enhancements include deep supply chain introspection and origin tracing to discover the origin of code and risk back to third-party or proprietary software packages, and LLM-based vulnerability discovery & validation.

This feature identifies vulnerabilities and assesses their impacts using code-based or natural language queries across an organization's firmware, software, and cyber-physical systems.

With an increase in supply chain compromises, industries across the board in both public and private sectors are striving to identify which assets, devices and software contain compromised software packages and vulnerabilities. This task is even further complicated when analysing device firmware and build artefacts.

By using Trace, NetRise enables organisations to trace all affected assets with a single query, which upon identifying a positive match, generates a detailed graph of the affected software supply chain components, the company. This eliminates the need for repeated scans or asset reprocessing, and is crucial in discerning the extent of threats - from nation-state actors to inherent vulnerabilities and poor development practices – across devices, firmware and software packages.