Vulnerability management provider once again invests in open source to maintain a leadership position
The driving force behind w3af, Andres Riancho joins the Rapid7 team as director of Web security and Rapid7 will be opening a Worldwide Center of Excellence for enhanced Web security in Buenos Aries, where Riancho resides.
This is the second significant move into open source security by Rapid7. Previously they acquired the Metasploit penetration testing project directed by renowned security researcher HD Moore. Unlike the Metasploit acquisition, Rapid 7 is not buying the IP of the w3af. They are just investing in the project as a sponsor. The licensing for the project, copyright holders and IP ownership will remain with w3af. Rapid7 will be contributing resources as well as cash.
Web application vulnerabilities are the front line in the vulnerability management war today. Over the past 3 to 5 years the action has moved away from OS and standard vulnerabilities towards web apps. A majority of vulnerabilities today are web app based. As a result most of the web vulnerability players like Qualys, nCircle, eEye and IBM have moved towards scanning and testing for web application vulnerabilities as well. In addition a whole cadre of stand alone web application vulnerability companies have arisen to help deal with this this threat. Companies like White Hat Security, NSpyder, etc.
What is interesting to me is that Rapid7, like Sourcefire before them, has deployed an open source acquisition/sponsor strategy to bolster their commercial product line. Speaking to Corey Thomas, their EVP of Operations at Rapid7, he says the company is a big believer in the quality of open source security projects. But the real driving force here was Riancho. Bringing someone of his caliber on board and getting the w3af with him was just too much goodness in one place to pass on. While Rapid7 does not have any other open source targets or plans for acquisitions or sponsorships, they are always on the look out. If you know of one that may be a fit, reach out to him.
You can read more about this sponsorship on the FAQ that Rapid7 set up here. Though there are no firm plans now, I am sure you will see some sort of commercially supported version of w3af available from Rapid 7 in the future. You will also see the w3af framework integrated into their flagship Nexpose product as well as with Metasploit.
When it comes to security, open source continues to lead the way!
