Market Overview

Tripwire for DevOps SaaS Debuts – The First Dynamic Container Vulnerability Assessment Service for the DevOps Pipeline


Now generally available, Tripwire's DevOps SaaS provides security
assessments as part of the continuous integration/continuous deployment
(CI/CD) pipeline

, a leading global provider of security and compliance solutions
for enterprises and industrial organizations, today announced the debut
of Tripwire®
for DevOps
. After pre-releasing DevOps capabilities in an early
access program earlier this year, Tripwire has launched Tripwire for
DevOps as a generally available software-as-a-service (SaaS) solution.
Tripwire for DevOps integrates security assessments into the DevOps life
cycle and toolchain, providing visibility into the security state of
underlying application infrastructure throughout the pipeline.

Complementing application and source code analysis tools, Tripwire for
DevOps assesses container images and container registries for
vulnerabilities, with additional features, such as the ability to assess
configurations for compliance with security policies, in near-term
release. It integrates with the CI/CD pipeline to ensure components meet
security standards as they move through build and deploy DevOps stages.

"As organizations move their application and service deployment to a
DevOps model, it's vital that they integrate security into the actual
process," said Tim Erlin, vice president of product management and
strategy at Tripwire. "In addition to securing custom code, businesses
need to ensure that the application infrastructure and inherited code
remain secure throughout the life cycle. We're excited to introduce a
solution that embodies what's been referred to as 'DevSecOps,' true
integration of security into the DevOps workflow."

Tripwire for DevOps fully automates the assessment of container images
in the CI/CD pipeline and can dynamically test live instances of
application containers in an isolated, cloud-based sandbox. It can be
used to establish quality gates at each stage to fail builds that don't
meet defined security standards. It can also be used to simply monitor
and assess repositories, providing visibility of potential risk without
interfering with the roll-out process.

In a report, Gartner analysts said, "Traditional application security
testing relies on heavyweight, one-time gating inspections, typically
performed during testing, taking days if not weeks and requiring
security professionals to perform them. This won't work and it won't
scale for DevSecOps. DevOps emphasizes continuous feedback and improved
automation. Security needs to adopt and support a mindset where security
starts at the very beginning of the service creation, throughout the
DevOps processes, and is continuous, automated and improves with each
subsequent iteration."1

Simplifying deployment and set-up, Tripwire for DevOps is a fully
self-contained SaaS solution that features:

  • Integration with popular DevOps CI/CD build tools, including Jenkins,
    & TeamCity, with additional tools coming soon.
  • Compatibility with all Docker v2 repositories for container assessment.
  • A complete REST API and command line interface for DevOps engineers to
    write custom integrations.

For more information please visit:

About Tripwire

Tripwire is a leading provider of integrity assurance solutions that
improve security, compliance and IT operations in enterprises,
industrial organizations, service providers and government agencies.
Tripwire solutions are based on high-fidelity asset visibility and deep
endpoint intelligence combined with business context; together, these
solutions integrate and automate security and IT operations. Tripwire's
enterprise-class portfolio includes file integrity monitoring,
configuration management, asset discovery, vulnerability management and
log collection that supports all widely used industry-standard

Learn more at,
get security news, trends and insights at,
or follow us on Twitter @TripwireInc.

1 Gartner "Integrating Security Into the DevSecOps Toolchain"
by Mark Horvath, Neil MacDonald, Ayal Tirosh, November 16, 2017

View Comments and Join the Discussion!