Why We Founded Heeler

In today’s rapidly evolving threat landscape, a massive gap exists in application security. This gap stems from the lack of a unified data layer that integrates code, runtime, and business context, making current security efforts labor-intensive and difficult to scale. Without this context, prioritizing security becomes impossible, and crucial activities like impact analysis, threat modeling, and developer guidance are only performed in an ad hoc manner.

June 6, 2024

In today’s rapidly evolving threat landscape, a massive gap exists in application security. This gap stems from the lack of a unified data layer that integrates code, runtime, and business context, making current security efforts labor-intensive and difficult to scale. Without this context, prioritizing security becomes impossible, and crucial activities like impact analysis, threat modeling, and developer guidance are only performed in an ad hoc manner.

As a result, application security teams are overwhelmed, struggling to keep up with engineering demands while maintaining customer trust. This challenge will only grow until every company hits a tipping point where security debt becomes a significant obstacle. To overcome this, a paradigm shift is necessary. Companies must transform their culture, people, and processes to focus on security resilience. This means not only addressing critical issues but reducing security debt and limiting new risks to withstand present and future threats.

We launched Heeler to bridge this context gap and drive the transformation needed in application security. Our mission is to amplify developers' security impact tenfold without requiring additional time. By unifying application, runtime, and business context, seamlessly integrating into existing workflows, and automating high-friction, repetitive tasks between security and development teams, we make security a proactive part of the development process.

To achieve this, we developed ProductDNA—a groundbreaking real-time data model that bridges developers and security, delivering the necessary context directly into existing workflows. Heeler builds a mapping of every running service back to the changeset from which it was built, by analyzing your source code and runtime environment in real-time, fingerprinting each changeset. In parallel, it identifies all forms of compute, creating equivalent fingerprints for binaries on containers, functions, and virtual machines. This establishes application lineage, allowing you to track exactly which changeset is deployed on any running instance. From runtime, you can link back to the code in the repository, and from the IDE, you can link directly to the running application.

This innovative approach enables the automatic creation of the atomic unit of the application, which we call a service. We use this service to bind and maintain ephemeral context on one side with fluid context on the other. Services are then automatically collected into applications, with assigned business context and security rules—all done without an agent, build modification, or pipeline awareness.

Heeler’s platform combines foundational AppSec capabilities with deep runtime context and response orchestration, providing transformational impact that is unattainable with today’s solutions.

Heeler is here to transform application security, ensuring your applications are secure, resilient, and ready for the future.

Related resources

See All Resources

September 12, 2024

The Need for Continuous and Agile Threat Modeling

In today’s agile development landscape, where cloud-based software is constantly evolving and deployed at unprecedented speed, traditional, manual threat modeling is no longer enough. As development teams iterate quickly and deploy in real-time, requirements and architecture changes rapidly, creating potential gaps in security that static threat models simply cannot keep up with. This has paved the way for continuous and agile threat modeling—a real-time approach to identifying, assessing, and mitigating risks early in the software lifecycle.

September 10, 2024

Revolutionizing Application Security: The Heeler Story

At Heeler, we’re not just building a product; we’re reshaping the future of application security. In today’s rapidly evolving digital landscape, the traditional approach to security has reached its limits. As applications grow more complex and threats become more sophisticated, the need for a unified security approach that integrates code, runtime, and business context is more critical than ever.

September 3, 2024

The Challenges of Decomposing Cloud-Based Applications (and How to Implement Agile and Continuous Threat Modeling)

In the fast-paced world of software development, the adoption of agile methodologies and continuous delivery practices has revolutionized how applications are built, deployed, and maintained. In an agile environment, where code and cloud are constantly changing and new features are continuously being integrated, threat modeling needs to be just as agile and continuous. The idea is to ensure that security is built into the development process rather than bolted on as an afterthought.

August 27, 2024

Solving Prioritization for Application Security

Security prioritization has become an overwhelming challenge for organizations, as they try to manage an ever-expanding application footprint alongside an increasingly sophisticated threat landscape. In 2024 alone, we've seen a 30% year-over-year increase in reported CVEs through July, according to the Qualys Threat Research Unit. The rise of AI-assisted coding—often trained on the same vulnerable code we're trying to defend against—likely exacerbates this issue even further.

August 21, 2024

Unifying Threat Modeling, Lifecycle Management, and Response Orchestration: How Heeler Redefines Application Security

In today’s complex digital landscape, application security can no longer be handled with a siloed approach. Modern applications require a comprehensive strategy that integrates multiple security disciplines into a seamless process. At Heeler, we understand that to effectively manage and mitigate risks, security needs to be woven into every stage of the software development lifecycle (SDLC). This is why we've built a platform that unifies threat modeling, lifecycle management, and response orchestration into a cohesive system.

August 20, 2024

How Customer Feedback Shapes What We Build at Heeler

At Heeler, we believe that the best products are built in collaboration with those who will use them. From day one, our mission has been to create a transformative application security platform, and we knew that achieving this would require more than just innovative ideas and advanced technology. It would require deep, ongoing engagement with the very people who face the challenges we aim to solve: our customers.

Black Hat USA 2024 Recap: What We Heard from AppSec Leaders

At Heeler, we had the privilege of connecting with many AppSec leaders at Black Hat USA 2024. It was clear that despite advancements, significant pain points remain.

Announcing the Launch of Heeler's Advisory Board

These industry veterans bring diverse perspectives and deep insights into application security, and we're excited to collaborate with them as we continue to innovate and transform the field. Their guidance will be invaluable as we strive to maximize the impact of application security teams and developers with unified code, runtime, business, and security context.

Heeler: Loyalty, Resilience, and a Commitment to Excellence

The name "Heeler" was inspired by the remarkable traits of the Blue Heeler dog, a breed known for its intelligence, loyalty, and tenacity. Two of our co-founders, James Green and Trever McKee, both own Blue Heelers and have long admired these dogs for their unwavering dedication and keen problem-solving abilities.

The AppSec Context Gap - Code, Runtime, and Business

The Heeler team dedicated several months collaborating with research partners from various organizations to identify the most significant gaps in application security. A recurring theme emerged: the absence of context was a major issue, and obtaining this context was costly, often necessitating the involvement of key personnel from both security and development teams. Furthermore, this substantial time investment did not yield lasting value due to the dynamic nature of applications in cloud and agile environments, rendering these context investigations transient and expensive.

See All Resources