Scandinavian software testing company Codenomicon has this month released its Fuzz-o-Matic cloud-based Testing-as-a-Service (TaaS) platform for applications running on Windows, Linux, Mac, and mobile operating systems. As a company that sells itself on a tagline of zero-day vulnerability discovery for software teams with limited budget for security auditing, Codenomicon's offering presents users with actual, repeatable test cases for software bugs that cause product crashes and security breaches.

Despite being somewhat scant on details of exactly how regularly updated or dynamic its test cases are, the company claims to provide software application developers with a means of uncovering previously-unknown vulnerabilities before hackers do, without false positives or false alarms.

For programmers who have already tested software with Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), vulnerability scanning, or hybrid analysis, Fuzz-o-Matic is lauded (by its makers) as the "next progression" in testing to find the bugs that other testing solutions have missed. For freshly baked code that has not been tested, but is at an executable stage, the TaaS platform claims to be able to provide users with longer lead-times to remedy bugs before software release.

In what is arguably a somewhat partisan comment, Frost & Sullivan's test and measurement practice spokesperson Olga Yashkova said that, "With Fuzz-o-Matic, Codenomicon is making available advanced methods of software security testing to a wide range of users who never before had access. Based on experience in identifying software security risk and Fuzz-o-Matic's user-friendly interface, Codenomicon is first-to-market in a new area with broad implications for third-party testing, security testing, staff augmentation, and serving organizations with limited software testing budgets."

Codenomicon's chief security strategist Ira Winkler says that while developers often think of software fuzzing as a security measure, fuzzing is really testing for all types of software bugs, of which security vulnerabilities are just one type of bug: "Fuzzing is perhaps the most effective measure of identifying any software reliability issues."

NOTE: Application "fuzzing" uses unexpected inputs to stress-test software far beyond normal operating conditions. Most software testing simulates normal operating conditions to determine if software does what it is designed to do. Black-hat hackers use application fuzzing to find exploitable security bugs in unused or rarely-used software functionality.