Breaking Down Barriers: How LLMs Enable Software Analysis in Classified Environments

A recently published blog post, which we will link to in our transcript, begins with an exploration of the issues with static analysis tools and the software development lifecycle and how they fit into the software development lifecycle.

Let's begin, I guess, by discussing some of those issues.

Sure.

That sounds great.

So to set the stage, static analysis tools have been a huge help to software developers for about 30 years plus now.

They are really great at finding patterns in software that are indicative of poor quality code or even security vulnerabilities.

Now, those are great for a lot of scenarios, but for some very specific government requirements, they may not be enough.

A lot of static analysis tools typically have a lot of false positives, so it can be very tedious for a software developer to have to manually verify, is this a real problem or is it a false positive? But also, a lot of these tools come preloaded with checks that are geared towards industry standards.

Think MISRA, which is a very important standard, but maybe not the best fit for a DOW platform.

That's where our work comes in.

Yes, that sounds great.

Yes, because some of these static analysis tools can be open source, some can be commercial.

But what you're saying is they have an important role in the software development lifecycle, but it's not just up to them.

You need to use those in concert with other types of tools as well.

Right.

They're not a magic bullet, but they are a very powerful bullet.

You shouldn't just ignore them.

Absolutely.

Absolutely.

So how do these issues differ in classified environments versus unclassified environments? Sure.

Great question.

So a lot of classified environments typically have software that is a little bit behind state-of-the-art leading technologies from the private industry.

This is because when you take software and move it into the classified space, it takes a long time to do the hardcore security analysis to make sure we're not introducing vulnerabilities into a classified environment.

Now, what happens in times like today where we have AI transforming how we do our work, right, is these models are evolving rapidly, and they're rapidly developing new capabilities that are super important for the warfighter to utilize in their day-to-day work.

So, what we need to do is we need to find a way to compromise between the constraints of a classified environment so that we can yield the benefits of these leading industry technologies and move them to the classified space

A recently published blog post, which we will link to in our transcript, begins with an exploration of the issues with static analysis tools and the software development lifecycle and how they fit into the software development lifecycle.

Let's begin, I guess, by discussing some of those issues.

Sure.

That sounds great.

So to set the stage, static analysis tools have been a huge help to software developers for about 30 years plus now.

They are really great at finding patterns in software that are indicative of poor quality code or even security vulnerabilities.

Now, those are great for a lot of scenarios, but for some very specific government requirements, they may not be enough.

A lot of static analysis tools typically have a lot of false positives, so it can be very tedious for a software developer to have to manually verify, is this a real problem or is it a false positive? But also, a lot of these tools come preloaded with checks that are geared towards industry standards.

Think MISRA, which is a very important standard, but maybe not the best fit for a DOW platform.

That's where our work comes in.

Yes, that sounds great.

Yes, because some of these static analysis tools can be open source, some can be commercial.

But what you're saying is they have an important role in the software development lifecycle, but it's not just up to them.

You need to use those in concert with other types of tools as well.

Right.

They're not a magic bullet, but they are a very powerful bullet.

You shouldn't just ignore them.

Absolutely.

Absolutely.

So how do these issues differ in classified environments versus unclassified environments? Sure.

Great question.

So a lot of classified environments typically have software that is a little bit behind state-of-the-art leading technologies from the private industry.

This is because when you take software and move it into the classified space, it takes a long time to do the hardcore security analysis to make sure we're not introducing vulnerabilities into a classified environment.

Now, what happens in times like today where we have AI transforming how we do our work, right, is these models are evolving rapidly, and they're rapidly developing new capabilities that are super important for the warfighter to utilize in their day-to-day work.

So, what we need to do is we need to find a way to compromise between the constraints of a classified environment so that we can yield the benefits of these leading industry technologies and move them to the classified space