Las Vegas (BlackHat USA 2024 ), August 7, 2024 — Truffle Security, the open source company behind TruffleHog, today announces an industry first: the ability to analyze the permissions of discovered credentials. TruffleHog Analyze provides crucial insights into API keys, passwords, and other identities, helping security practitioners assess the impact of leaks and prioritize remediation. It automatically identifies the resources and permissions associated with sensitive credentials without requiring usernames, passwords, or MFA tokens. 

This tool enhances TruffleHog's secrets detection capabilities, addressing a critical gap in enterprise Identity and Access Management (IAM) by ensuring the rigorous security of non-human credentials and identities.

“Security teams receive many alerts about exposed API keys but struggle to gauge the potential impact on the organization,” said Dylan Ayrey, CEO and Co-Founder of Truffle Security. ”Some API keys may pose minimal risk while others could completely digitally destroy a company. TruffleHog Analyze provides security teams with the context they need to automatically distinguish between these scenarios and then   prioritize their response accordingly.”

Seamless Integration with TruffleHog

The more SaaS native & multi-cloud that companies become - the more places that secrets can leak. The growing number of code repositories on GitHub alone, with millions added over the past year, increases the risk of both accidental and deliberate exposure of sensitive information. By using TruffleHog and TruffleHog Analyze in combination, security practitioners can manage the impact of leaked secrets across a company's entire landscape of tools that can leak secrets.

TruffleHog works seamlessly with TruffleHog Analyze to provide a comprehensive solution for managing leaked credentials. TruffleHog initially detects and verifies live API keys or secrets, identifying potential vulnerabilities. Once these credentials are identified, TruffleHog Analyze steps in to assess the importance of these credentials by determining the owner, access level, and significance of each key. This integrated approach enables security teams to conduct a thorough analysis so that they can determine prioritization and next steps.

Key Benefits of TruffleHog Analyze

• Automatic Discovery: Effortlessly identifies the resources and permissions linked to API keys and secrets without requiring access to the provider’s UI, simplifying the detection process.

• Impact Assessment and Context: Delivers a thorough analysis of each key's capabilities, allowing security teams to understand the potential consequences of a credential leak.

• Prioritization for Remediation: Helps security practitioners prioritize their response to leaked credentials, ensuring immediate and effective mitigation actions are taken.

Availability and Pricing:

TruffleHog Analyze is available today in the open-source version of TruffleHog and for evaluation in TruffleHog Enterprise. Contact us to learn more about TruffleHog Analyze, request a demo, or learn more about pricing. 

Additional Resources

• Read the blog on TruffleHog Analyze

• See a demo of TruffleHog Analyze at Black Hat USA 2024 - Booth 3005

• Learn more about TruffleHog Enterprise

About Truffle Security

Truffle Security is a leading cybersecurity company dedicated to protecting sensitive information. Built on the TruffleHog™ open-source project, the company’s software protects developer and machine secrets like private keys and credentials, analyzes each key’s capabilities to determine impact, and tracks and manages them when they are exposed using an intuitive management interface. Through this interface and secure authentication workflows, Truffle Security prevents breaches by detecting and uniquely classifying 800+ machine identity credentials, validating which ones are active, analyzing their scope of access and escalating issues for remediation, helping customers safeguard critical information.

Media Contact Information:

For more information, reach out to [email protected]