Azul Intelligence Cloud detects known vulnerabilities down to the class-level, eliminating up to 99% of false positives and boosting DevOps capacity and productivity
Azul, the only company 100% focused on Java, today announced an enhancement to Azul Intelligence Cloud, a breakthrough capability in Azul Vulnerability Detection that brings unprecedented precision to detection of Java application security vulnerabilities. Unlike traditional AppSec or APM tools that flag vulnerabilities by matching component file names or SBOM information — often leading to an overwhelming number of security false positives — Azul Vulnerability Detection uses class-level production runtime data to detect vulnerabilities. This enables organizations to focus only on the code paths that are actually used, delivering 100x to 1,000x reduction in false positives compared to other tools, empowering DevOps teams to prioritize and remediate real risks faster, improve security posture and dramatically boost developer productivity.
DevOps Teams Need Precision, Not Noise, in Java Vulnerability Detection
Enterprises are drowning in Java security noise. According to Azul’s 2025 State of Java Survey & Report, 33% of organizations say that more than half of their DevOps teams’ time is wasted chasing false positives from Java-related Common Vulnerabilities and Exposures (CVEs) alerts. Traditional AppSec tools flag CVEs in third-party Java components bundled in an application — regardless of whether the vulnerable component is used in production or simply present. This broad-brush approach overwhelms teams with irrelevant alerts, cripples prioritization and drains productivity. Java components like Log4j comprise JAR (Java ARchive) files, and each JAR file typically contains many classes. This means it’s entirely possible for a flagged component to be present or even used by the application but the code from a vulnerable class is never invoked — meaning the application isn’t truly at risk. To recover DevOps capacity and increase productivity, Java teams need a solution that can accurately detect vulnerable code used in production, down to the class level, to prioritize components for security patching based on real risk and eliminate the time chasing false positives.
Azul Intelligence Cloud Pinpoints Only the Java Code That’s Actually at Risk, Eliminating up to 99% of False Positives
Azul Intelligence Cloud is a cloud analytics solution that provides actionable intelligence from production Java runtime data to dramatically boost developer productivity. Its Vulnerability Detection capability identifies and prioritizes known security vulnerabilities in Java applications in production with 100-1000x greater accuracy than traditional AppSec or APM tools. It uses a curated knowledge base mapping CVEs to classes used at runtime to pinpoint vulnerable components for prioritization and remediation, eliminating up to 99% of false positives and dramatically boosting DevOps productivity. As an example, a recent ‘Critical’ severity vulnerability, CVE-2024-1597, in specific 42.x versions of the pgjdbc PostgreSQL Java Database Connectivity (JDBC) driver allows attackers to perform a SQL injection attack. This CVE scores 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS) and applies in the relatively uncommon case when the driver is used in a specific non-default mode. Traditional AppSec tools issue a security alert when the component is present even if it’s unused or used in the (safe) default mode, resulting in false positive alerts and precious developer hours being spent remediating code unnecessarily. Vulnerability Detection is orders of magnitude more accurate because it detects at runtime if one or more of the 11 vulnerable classes associated with the CVE out of the 470 total classes in the component are actually used in production.
“The improved Vulnerability Detection features strengthen the proposition of Azul’s Intelligence Cloud analytics SaaS offering as a way to increase DevOps productivity and recover developer capacity by reducing the need for full-time employee time spent wasted on security false positives and inefficient triage,” said William Fellows, research director at 451 Research, part of S&P Global Market Intelligence.[1]
Azul Vulnerability Detection delivers additional key benefits across an enterprise’s entire Java estate:
- Efficiently triages new vulnerabilities – delivers continuous, real-time detection of Java vulnerabilities in production, enabling DevOps teams to quickly triage and prioritize critical issues, especially during high-impact events like Log4j. This reduces time spent on false positives and minimizes disruption, allowing teams to stay focused on higher-value work.
- Real-time and historical analysis, accelerated by AI – retains component and code-use history, focusing forensic efforts to determine if vulnerable code was actually exploited prior to it being known as vulnerable. It continuously detects known vulnerabilities and precisely catalogs code in production to focus scarce human effort. Azul’s vulnerability team uses AI to quickly identify Java-specific CVEs from the NVD (National Vulnerabilities Database) and other sources and updates the Azul Vulnerability Detection Knowledge Base with newly published vulnerabilities.
- Production monitoring for Oracle JDK and any OpenJDK-based JVM – takes advantage of production runtime data from Oracle JDK and any OpenJDK-based JVM, independent of vendor or distribution – including Azul, Amazon, Temurin, Microsoft, Red Hat and more – to improve overall DevOps productivity.
- No performance impact in production – leverages Java runtime data that exists within a JVM when running the application, resulting in no performance impact, something not possible using any other tool.
“Our mission is to help enterprises focus their security efforts on what matters — real risk, not noise,” said Scott Sellers, co-founder and CEO of Azul. “By eliminating up to 99% of false positives and pinpointing vulnerabilities in Java applications with 100x – 1000x greater accuracy than traditional tools, Azul Intelligence Cloud enables capacity recovery across DevOps and security teams. As a result, teams can dramatically reduce noise, prioritize real risk and accelerate remediation — all with zero impact to performance and without slowing innovation.”
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream formerly known as CIO News LinkedIn Account | The Mainstream formerly known as CIO News Facebook | The Mainstream formerly known as CIO News Youtube | The Mainstream formerly known as CIO News Twitter |The Mainstream formerly known as CIO News Whatsapp Channel | The Mainstream formerly known as CIO News Instagram
About us:
The Mainstream formerly known as CIO News is a premier platform dedicated to delivering latest news, updates, and insights from the tech industry. With its strong foundation of intellectual property and thought leadership, the platform is well-positioned to stay ahead of the curve and lead conversations about how technology shapes our world. From its early days as CIO News to its rebranding as The Mainstream on November 28, 2024, it has been expanding its global reach, targeting key markets in the Middle East & Africa, ASEAN, the USA, and the UK. The Mainstream is a vision to put technology at the center of every conversation, inspiring professionals and organizations to embrace the future of tech.
