One platform for the whole assessment, from raw scanner output to the signed report.
It reads five tool output formats, gives a finding an identity that a reformat does not break, suggests each finding to a control in three loaded catalogues, and drafts the executive report. Every count on this page was read in the engine source, and every one of them arrives with its boundary.
Five engines, and the edge of each one
Read item by item in the engine source. No count here was rounded.
Your tools stay. The platform reads them.
Five readers, and everything they produce lands in the same findings table as what our own engines found.
SARIF 2.1.0
CodeQL, Semgrep, SonarQube, Fortify, and anything else that emits SARIF. On the way back, it exports SARIF.
CycloneDX
Trivy natively, and Grype.
Nessus XML
Nessus and OpenVAS.
DAST output
ZAP, Burp and Nuclei.
Vendor CSV
Qualys, Rapid7 and Tenable.
Import ships behind a feature flag that is off by default. Until it is switched on in the environment, those endpoints answer 404. It is on the configuration list, and it is the kind of thing you would find out on day one.
A finding you accepted stays accepted
This is the part that decides whether a retest costs you an afternoon or a week.
Identity ignores line numbers
It is the rule, the relative path, the normalised snippet and an index. Reformatting a file does not invent a new finding.
The same flaw from two scanners is one finding
A vendor-independent fingerprint joins them, so you get one finding with two sources instead of two findings to reconcile by hand.
Bulk marking refuses to close a critical
Mass triage will not close a critical or high finding. The one action that would quietly hide the thing you are paid to find is blocked in code.
Three catalogues loaded — which is not the same as three certifications
The distinction matters more than the number, and it is the first thing an auditor asks. These are catalogues inside the product. We hold no certification.
It suggests. You classify.
A finding is matched to a control by keyword, and the confidence of that guess is recorded on the record. You confirm or reject it. The platform does not certify anything.
Evidence expires
Evidence carries a date. Expired evidence stops supporting its control instead of sitting in a spreadsheet as if it still counted.
Compliant and assessed are two different numbers
The screen keeps them apart. Merging them is how a coverage figure lies, and this house has paid for that lesson.
The last mile, which is what you actually sell
Finding the flaw was never the bottleneck. Writing the document was.
The questionnaire adapts to the client profile
A different profile gets a different set of questions, so you are not deleting irrelevant sections by hand.
The score is computed in code
Not assembled in a spreadsheet, and not different depending on who filled it in.
The executive report comes out drafted
Six fixed sections: summary, risks by impact, what is in good shape, and a 90-day plan. You review, correct and sign.
It exports as PDF
And only as PDF. Not Word, not Excel.
One record per client company, with its own history
Each client keeps its own assessments, scores and reports, under your account.
Where each engine ends
| Engine | Reads | Stops at |
|---|---|---|
| Code | 198 rules across 14 languages | Taint on JS and TS only, inside one function, off by default |
| Dependencies | 8 ecosystems, lock files, transitive tree | No operating-system packages |
| Containers | 100 rules, dpkg and apk packages | RPM and RedHat are out of scope, stated in the source |
| Infrastructure as code | 183 rules | 111 AWS, 16 Azure, no Google Cloud |
| Web scanning | The anonymous surface | No login, no certificate, cipher or TLS version inspection |
| Compliance | 93 ISO/IEC 27001:2022, 47 SOC 2, 90 OWASP SAMM v2 | Keyword suggestion with recorded confidence, not classification |
What we do not do
A security vendor that claims to do everything is selling, not assessing. Every limit below was read in the code before it was written here, and it is in writing before the proposal, not after it.
Data-flow tracking is narrow
From input to dangerous sink, it exists in JavaScript and TypeScript only, inside a single function, and it ships off. In other languages it is pattern matching, line by line, and one line cannot see the previous one.
The web scanner sees the anonymous surface
It does not log in to your client system, and it does not inspect certificate, cipher or TLS version. When it confirms a flaw it stops there: it does not escalate privilege, run commands or extract data.
OS packages and cloud coverage are uneven
RedHat and RPM packages generate no CVE. Debian, Ubuntu and Alpine do, and only from inside a container image. In infrastructure as code: 111 AWS rules, 16 Azure, none for Google Cloud.
Three repository providers, in the cloud
GitHub, GitLab and Azure DevOps. Not Bitbucket, not self-hosted GitLab, not GitHub Enterprise Server. There is no pipeline Action and no command-line program: wiring it in is an HTTP call you write.
White label does not exist
The report carries our brand in the header and footer of every page. There is no tenant field for a logo, a colour or a name — changing it takes a code change and a rebuild. It is first in the queue.
PDF only, and no portal for your client
No Word, no Excel. And the company you assess does not log in to see its own risk — what it gets is the document you send.
The platform is not live yet
Infrastructure is being rebuilt. There is no signup, no trial and no billing, and you pay for nothing before it exists.
Tell us which scanners you run and we will tell you what lands in the table.
A technical conversation with the person who wrote the code. No slide deck, and no proposal attached.