Phylum

Phylum is a software supply chain security company founded in 2020 by Aaron Bray, Louis Lang, and Peter Morgan. The company's platform aims to secure open-source software supply chains by automating the identification and analysis of risks across five domains: malicious code, software vulnerabilities, authorship risk, reputation, license misuse, and engineering risk. Phylum's approach involves ingesting and analyzing each package as it is published into a package registry, automating risk analysis and malware detection to identify malicious packages in an average of 11 minutes. The platform uses a combination of static application security testing (SAST), heuristics, and machine learning models to detect and report zero-day findings that may not be found on published, curated lists. Phylum's technology allows it to analyze more packages than other vendors and find the most threats to software supply chains. In December 2022, Phylum introduced Automated Vulnerability Reachability to its platform, which aims to reduce false positives in vulnerability detection by up to 90% by determining if vulnerable code is actually called within a project.