Veracode used Black Hat USA 2021 to push two stories into the spotlight: a healthcare customer's application security program and the messy state of Big Data stack defences. According to Veracode, the company ran a Lunch & Learn with Advantasure's CISO, Wallace Dalrymple, and its own founder, Chris Wysopal, then sat in on multiple research sessions covering Big Data infrastructure and open-source supply chain risk.
The wider message was that pandemic-driven digitisation has rewritten the threat landscape. Healthcare organisations in particular have leaned harder into remote workflows, and adversaries noticed.
- Advantasure's CISO discussed building an AppSec program that developers actually use.
- Veracode cited figures that the majority of healthcare applications contain flaws, and roughly a quarter are high-severity.
- A session from Dreamlab Technologies exposed attack paths into ZooKeeper-managed clusters.
- Intel and NCC researchers reviewed decade-old open-source bugs, with Heartbleed reportedly still affecting more than 90,000 devices as of mid-2019.
- Veracode claimed developers can repair a meaningful share of flawed libraries quickly when given scan results in-tool.
Background: Why healthcare AppSec is back on the agenda
Healthcare has spent the last decade as a perennial target, but the shift to telehealth, remote claims processing and cloud-hosted EHR has widened the blast radius. The pandemic compressed years of digital transformation into months, and security teams inherited codebases they barely knew existed. Veracode's framing matters less than the underlying point: when developers own security outcomes, fewer flaws reach production.
The "if you write it, you own it" line echoed by the Advantasure CISO is not new, but the operational lesson is. Developers using Security Labs got real-time feedback instead of a quarterly PDF. That shortens the loop between coding mistake and fix, which matters more than any framework checkbox.
Our analysis
The interesting bit is not the AppSec marketing; it is the parallel session on Big Data. Sheila A. Bertha from Dreamlab Technologies walked through attack paths against ZooKeeper-managed clusters. The takeaway for defenders is that data infrastructure ships with assumptions about trusted internal networks that no longer hold. If your Hadoop or Spark deployment relies on a central configuration service that anyone with cluster creds can talk to, you have a soft centre.
On open source, the Christopher Robinson and Jennifer Frankick talk doubled down on a theme security teams keep relearning: known flaws stay alive for years. Heartbleed hanging on past 2019 is embarrassing but unsurprising. What matters is whether your SCA tooling is wired into the developer workflow or parked in a quarterly report.
Say you run security for a mid-sized US health plan
You inherit a Laravel monolith and a dozen microservices, all pulling open-source packages. Before your next release:
- Confirm SCA scans run on every pull request, not just nightly.
- Check whether developers see results in their IDE or only in a portal nobody opens.
- Audit any Big Data or analytics cluster for ZooKeeper exposure to non-admins.
- Treat healthcare flaw rates as a floor, not a ceiling, for your own codebase.
- Look for vendors who push feedback into the editor rather than dumping reports into email.
Who should care
- Healthcare CISOs: regulator pressure plus pandemic-era sprawl has made AppSec maturity a board topic, not a tooling footnote.
- Platform engineers running Big Data stacks: ZooKeeper and similar config services are quietly powerful and quietly exposed.
- AppSec leads: the pitch is shifting from "more scanners" to "developer-facing feedback"; pick vendors accordingly.
- Procurement teams: if your supplier cannot show where their scan results surface, walk away.
What to watch next
Expect more vendor messaging tying AppSec maturity to regulatory pressure from the Biden executive order. The bigger signal sits in the Big Data sessions: data layer attacks are moving from theoretical to demonstrated, and most defenders have not caught up. If your team touches Hadoop, Spark or Kafka, put cluster config auditing on the Q3 plan.
Key takeaways
- Healthcare AppSec maturity is now being sold as a developer-experience problem, not a tooling problem.
- Big Data infrastructure has attack paths that defenders are not yet prioritising.
- Decade-old open-source bugs remain a measurable footprint, and SCA needs to live in the developer loop.
Frequently asked questions
What did Veracode announce at Black Hat USA 2021?
According to Veracode, the company used its Black Hat USA 2021 presence to host a Lunch & Learn with Advantasure's CISO on healthcare AppSec and to share findings on Big Data and open-source security.
Why is healthcare AppSec getting special attention now?
Veracode highlighted that the pandemic accelerated digital change across healthcare, and cited figures that the majority of healthcare applications contain flaws with roughly a quarter rated high-severity.
What is the Big Data security concern raised at the show?
A session from Dreamlab Technologies examined attack vectors against Big Data stacks, including remote attacks against ZooKeeper-managed central cluster configuration.
How long do old open-source bugs stick around?
Intel's Christopher Robinson noted that Heartbleed still affected more than 90,000 devices as of July 2019.
Does Veracode claim fast remediation when developers have the right tooling?
Yes, Veracode said developers can repair a notable share of flawed libraries within an hour of a scan and a larger share within seven days.