Utilizing orchestration and augmented vulnerability triage for software security testing

A device, comprising:

• one or more memories;
• and
• one or more processors, communicatively coupled to the one or more memories, configured to:
• receive contextual data, computational data, experiential data, and industry data associated with software code,
• wherein the industry data includes one or more of:
• industrial vulnerability indexes,
• data identifying laws and regulations,
• threat and vulnerability intelligence data, or
• infrastructure data;
• receive detected vulnerabilities data identified by a scanning model based on the software code and software code metadata of the computational data;
• validate the contextual data, the computational data, and the experiential data, with a machine learning model, to generate validated data;
• aggregate the contextual data, the computational data, the experiential data, and the validated data to determine candidate rules;
• enhance the candidate rules to remove inconsistent candidate rules from the candidate rules and to generate a set of candidate rules;
• determine a set of actions based on a set of rules selected from the set of candidate rules,
• wherein the set of rules are associated with security testing of the software code;
• enrich, via an enrichment model, the industry data with the experiential data to generate enriched industry data;
• process the software code metadata, the detected vulnerabilities data, and the enriched industry data, with a correlation model, to generate analysis data;
• process the analysis data and the set of rules, with a security model, to confirm one or more security issues associated with the software code;
• and
• perform one or more actions, from the set of actions, based on the one or more security issues.

A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• receive contextual data, computational data, experiential data, and industry data associated with software code,
• wherein the contextual data includes one or more of:
• the software code, or
• data identifying an infrastructure to which the software code is to be deployed,
• wherein the experiential data includes data provided by a plurality of experts associated with security testing of the software code;
• receive detected vulnerabilities data identified by a scanning model based on the software code and software code metadata of the computational data;
• validate the contextual data, the computational data, and the experiential data, with a machine learning model, to generate validated data;
• aggregate the contextual data, the computational data, the experiential data, and the validated data to determine candidate rules;
• enhance the candidate rules to remove inconsistent candidate rules from the candidate rules and to generate a set of candidate rules;
• determine a set of actions based on a set of rules selected from the set of candidate rules,
• wherein the set of rules are associated with security testing of the software code;
• enrich, via an enrichment model, the industry data with the experiential data to generate enriched industry data;
• process the software code metadata, the detected vulnerabilities data, and the enriched industry data, with a correlation model, to generate analysis data;
• process the analysis data and the set of rules, with a security model, to confirm one or more security issues associated with the software code;
• and
• perform one or more actions, from the set of actions, based on the one or more security issues.