What is being presented
WithNetworks, a company active in artificial intelligence-based information technology and cybersecurity, illustrated a technology called "vulnerability combination correlation analysis." According to the source, the approach links services, the software bill of materials (SBOM), and application programming interfaces (API) to analyze composite security threats, that is, risks that arise from the overlap of multiple weaknesses.
The functionality is integrated into WithVTM, a platform for unified asset and vulnerability management. The company maintains that the system does not merely detect weaknesses in individual IT assets but allows assessment of the risk arising from their combination and prioritization of remediation. This is a company statement, not a result verified by third parties.
The problem: isolated assets and blind spots
The starting point indicated by the source is the gap between asset management and understanding of services. Even with lists of servers and software and vulnerability checks, if an individual asset is not linked to the service it helps compose, it becomes difficult to grasp the overall risk picture. The source specifically cites open-source libraries and packages and uncatalogued APIs as areas easily overlooked by traditional asset management systems.
WithVTM therefore extends the scope from management centered on servers and IP addresses to services, APIs, and software components. The system identifies the servers and applications that make up a service and links internal libraries, packages, and dependencies via SBOM. The platform states support for the international CycloneDX and SPDX standards and hash and signature verification for software supply chain integrity. Moreover, when a vulnerability is detected in a component, the system makes it possible to trace the assets and services that use it in order to delimit its impact.
Correlation, APIs, and priorities
The source links the proposal to a context of growing attention: in the face of repeated incidents in the financial sector, scrutiny increasingly concerns externally accessible systems, regardless of whether they provide services to customers, and the soundness of authentication and access control for internal data. In this context, WithVTM also includes API security functions: without installing agents, through network scanning, it identifies so-called shadow APIs—those that have escaped inventory—and verifies their external exposure, authentication and authorization methods, and data access paths.
The technical core is the ability to analyze relationships among vulnerabilities: according to the source, a single low-severity weakness can become an attack path toward sensitive data if combined with vulnerable libraries, inadequate configurations, and excessive permissions on an exposed API. Added to this is the AI-based risk scoring system (VRS), presented as patented technology, which considers asset importance, vulnerability score, real exploitation signals, and external exposure. The limitation is that all these elements are described by the company: independent data on effectiveness, false positives, or actual adoption are lacking, and the tool's ability to reduce real incidents remains to be verified. The quoted representative, CEO Ahn Jong-up, emphasizes the need to know which assets, software components, and APIs make up an exposed system and the goal of continuous protection for customers, starting with the financial sector.
