XSCAN Server Runtime
Supply chain security, now evolving into operations
Trust What Runs! - XSCAN Server Runtime
- Ultra-lightweight C/C++ agent: Uses less than one core and keeps server overhead near zero
- Runtime SBOM: Analysis of actual artifacts loaded in memory and history management
- Backport patch precise detection: OS version and binary cross-verification to prevent false positives
Server
- Package
- Service
- Process
- Auto-detect all installed software packages
- Include both package manager and manual installs
- Continuous tracking of asset change history
- Identify all running services and processes
- Track execution history of terminated programs
- Collect data for custom developed app execution
+
Configuration Assessment Repository
Deployed SBOM
Potential Attack Surface
Even inactive services may still be abused through advanced techniques
such as privilege escalation or DLL hijacking.
Asset Management Perspective
Identify and remove unnecessary (abandoned)
SW unused in the operation environment to eliminate potential risks and ensure compliance.
Runtime SBOM
Actual Attack Surface
As the primary attack surface, running components can be exploited
directly through network and local vulnerabilities.
Security Ops Response Perspective
Prioritize these assets first in vulnerability operations,
then apply patches and updates for critical KEV/EPSS findings.
Agent Stability
• Lightweight C-based agent with periodic snapshot technology
• Controls CPU usage with up to one core utilization (including automatic agent process priority adjustment)
Backport Patch Detection
• In Linux environments such as RHEL, only patches are often backported while versions remain unchanged for stability and related reasons
• Improves verification accuracy by combining multiple data sources, with real-time patch reflection through log analysis
Custom Software Vulnerability Support
• Supports analysis of all custom-developed software running on servers (.jar, .war, containers, etc.)
• Provides open-source extraction/analysis engines and large-scale databases with on-premise deployment and periodic updates
Commercial SW Vulnerability Mapping Expansion
• Supports vulnerability discovery for ORACLE commercial products (Oracle Database, WebLogic Server, Oracle Java, etc.)
• Supports Windows Server in addition to Linux
Standard-Compliant 5-Type SBOM Coverage
Providing CISA SBOM type coverage optimized for runtime environments.
Source
Component and dependency analysis at the source code level
Build
SW specification including build environment and 3rd party information
Analyzed
Precise component specification extracted through binary analysis
Deployed
Specification of SW assets installed after deployment
Runtime
SW composition specification based on running processes
Actual Attack Surface
Comparison & Management
Compare SBOMs across versions. Manage artifacts in a unified repository with historical tracking.