Product/Platform

One graph from commit
to running workload.

SecurityVault scans code, dependencies, infrastructure, images, cloud accounts and clusters with a native engine plus the best open-source tools, launched automatically per language. Every finding lands in one ontology that links the repository, the commit, the build, the image, the registry and the workload, so you fix what is actually reachable in production.

Book a demo Read the architecture

Languages · native taint analysis

Python, JavaScript/TypeScript, Java, Go, C#, PHP, Ruby, Rust, Kotlin, Swift, C, C++.

45+

Scanner adapters

Semgrep, Trivy, Grype, Syft, Checkov, Gitleaks, Bandit, gosec, SpotBugs, Brakeman, ZAP, Nuclei, Prowler and more.

Ontology entity types

32 relationship verbs. Every edge carries provenance: observed, derived or inferred.

Credentials in a scanner pod

Scanners are hostile by design. No database, cache, vault or storage credentials ever reach one.

01 Overview 02 Auto-launched scanners 03 Native engine 04 Finding ontology 05 Code → runtime 06 Cloud & runtime 07 Policy & evidence 08 Remediation 09 Integrations 10 Deployment 11 FAQ

How it fits together

Scan band, control plane, one graph.

Untrusted tools run in a sealed scan band. Results enter the control plane through one authenticated callback. The ontology turns raw results into findings with lineage.

Scan band · untrusted

Native engineappsec-unified

Per-language toolsauto plan

Image scannerstrivy · grype · syft

Cloud collectorsAWS · Azure · GCP

Cluster sensoreBPF · K8s state

DASTpassive · active

→

Control plane · trusted

Callback ingestiontoken + HMAC

Finding ontology52 entity types

Lineage & blast radiuscode → runtime

Policy engineOPA · Rego

Governance ledgerHMAC chain · Ed25519

API planesread · write · stream

→

Outputs

PR gates & commentsGitHub · GitLab · ADO

TicketsJira · ServiceNow · Linear

Chat & on-callSlack · Teams · PagerDuty

SIEMSplunk · Sentinel · QRadar

Auditor portalsigned evidence

Live UISSE stream

Scan band

Scanners are treated as hostile. Each scan runs as an ephemeral Kubernetes Job in its own namespace with a shared fetcher and one container pair per tool. The pod receives acquisition credentials for the target only; the adapter receives a single-use scan token and a body-signing key, nothing else.

Control plane

One ingestion path. The callback handler is the only code that writes findings. It verifies the scan token, the HMAC body signature and a replay nonce, then resolves the result into ontology entities under the tenant the scan belongs to.

Graph

Findings are entities with edges, not rows in a list. A findingaffects a package, the package is contained in an image, the image is run by a workload, the workload is exposed by an ingress. That chain is what SecurityVault computes, stores and shows.

Scanner orchestration

Point it at a repo. The tool plan builds itself.

You do not configure scanners per repository. The orchestrator detects languages and launches the native engine, the baseline tools and the language-specific tools in one scan, then reconciles their results.

Detected	Tools launched	What they cover
Every repository	`appsec-unified` · `semgrep` · `gitleaks` · `architecture` · `checkov` · `syft` · `grype`	Native SAST/SCA/secrets/IaC/API/supply-chain, rule-based SAST, secret history, dependency architecture, IaC, SBOM and vulnerability match
Python	`bandit` · `pip-audit`	Python-specific SAST and PyPI advisories
Go	`gosec` · `govulncheck`	Go SAST and reachable Go module vulnerabilities
Java · Kotlin	`dependency-check` · `spotbugs`	Maven/Gradle CVEs and bytecode bug patterns
JavaScript · TypeScript	`dependency-check` · `njsscan`	npm advisories and Node.js security patterns
Ruby	`brakeman`	Rails-aware SAST
Rust	`clippy` · `cargo-audit`	Lints with security classes and RustSec advisories
C · C++	`cppcheck` · `flawfinder`	Memory-safety and dangerous-call analysis
Container image	`trivy` · `grype` · `syft`	OS and application packages, SBOM, misconfiguration, secrets in layers

Two-stage language detection

The worker plans from URL heuristics without cloning anything. The scan pod reports the languages it actually found, so the plan is refined on hostile code without the control plane ever touching it.

Per-tool deadlines

Every tool carries its own deadline, persisted on the scan. A slow tool produces aPARTIAL scan with the other results intact; an infrastructure timeout producesFAILED_TIMEOUT. The state is never ambiguous.

Explicit state machine

PENDING → QUEUED → RUNNING → COMPLETED | PARTIAL | FAILED_*. Every transition is audited with the job name, the tokens minted and the reason recorded.

Also available as adapters: OWASP ZAP, Nuclei, Schemathesis, Prowler, ScoutSuite, Cloudsplaining, kube-bench, kube-hunter, Kubescape, Polaris, kube-score, KICS, Terrascan, tfsec, Dockle, TruffleHog, OSV-Scanner, Safety, Cosign, ESLint security, FindSecBugs, graudit, SonarQube import, Rapid7 InsightVM import.

Native engine · appsec-unified

Seven kernels. Evidence on every finding.

The native engine runs in the same untrusted band as any other tool. Its kernels are network-free and database-free, and every finding they emit carries typed evidence, never just a label.

SAST

Taint analysis in 12 languages

Tree-sitter based source → propagator → sanitizer → sink dataflow for Python, JavaScript/TypeScript, Java, Go, C#, PHP, Ruby, Rust, Kotlin, Swift, C and C++. Interprocedural call graphs for Go, Java, JavaScript, Python and Rust. Constant propagation, framework models, custom rules, CWE coverage map.

SCA

Reachability, not just versions

OSV-backed vulnerability database, SBOM generation, license detection and a reachability hint on each dependency finding: reachable,not_reachable or unknown with the call path. Reachable requires a path; a missing analyser never silently demotes a finding.

IaC

Terraform, Kubernetes, Helm, CI

HCL resolver with variable and module resolution, Helm and Kustomize rendering, Dockerfile, CloudFormation and CI workflow security (untrusted checkout, script injection, permission scope).

Secrets

Fingerprints plus history

Provider fingerprints for AWS, GitHub, Slack, Stripe, Google, JWT and private keys with entropy fallback, a git history walker, last-4 truncation in every report and live verification switched off by default.

API

Discovery and probing

API surface built from OpenAPI, GraphQL and AsyncAPI documents, source routes and runtime observation, de-duplicated across sources and scored for authentication, rate limiting and schema maturity.

DAST

Three modes, gated

Passive, authenticated active and destructive. Destructive scans are refused unless the target attestation is present. Injection detectors run against a browser pool for authenticated flows.

Supply chain

Typosquat, confusion, provenance

Levenshtein typosquat checks against curated PyPI and npm popularity sets, dependency-confusion detection, package age and maintainer risk, malicious-package feed sync and SLSA provenance attestations as first-class artifacts.

Evidence

Closed evidence taxonomy

Seven evidence kinds — code span, dataflow path, dependency path, config path, request trace, exploit proof, artifact hash — each with a required carrier. Consumers can render every finding; nothing arrives as free text.

Fix

Deterministic remediation first

A remediation template registry covers SQL and command injection, unsafe eval, outdated dependencies, public buckets, privileged containers, exposed credentials, typosquats and missing API auth. AI suggestions are opt-in and advisory.

Finding ontology · what makes us different

A finding is a node in your security graph.

Most tools stop at a list of results per scanner. SecurityVault resolves every result into a frozen, versioned vocabulary of entities and relationships, then keeps that graph current as code, images and clusters change.

Entity types · 52

Org & topology Organization · BusinessUnit · Team · User · BusinessService · Application

Source to production Repository · Commit · Build · Artifact · ContainerImage · Package · SBOMComponent · Registry

Cloud & infra CloudAccount · CloudResource · Cluster · Namespace · Workload · KubeService · KubeIngress · Endpoint · NetworkZone

Identity & access HumanIdentity · WorkloadIdentity · CloudPrincipal · IdentityGroup · IAMRole · AccessPolicy · AccessEntitlement · Credential · Secret

API & data API · APIRoute · DataStore · DataAsset · DataClassification

Security objects Vulnerability · Weakness · Misconfiguration · Control · Threat · Technique · Indicator

Findings & response Finding · Exposure · SecurityCase · Incident · Remediation · Exception · Ticket · Decision

Relationship verbs · 32

ownsmember_ofsupportscontainsdepends_onbuildstriggeredproducesstored_indeploys_toruns_onruns_imagehosted_inroutes_toreachable_toexposesauthenticates_asassumescan_accessstoresprocessesaffectsaffected_byviolates_controlmaps_tocorroboratescontradictsduplicate_ofderived_fromremediated_byverified_byfixes

Provenance on every edge

observed Reported by telemetry, a provider API or a verified attestation: SCM webhook, CI ledger, cluster state, SLSA provenance.

derived Deterministic join over immutable identifiers: image digest, full commit SHA, ARN, Kubernetes UID. No heuristics.

inferred Heuristic candidate: tag match, name similarity, uncorroborated OCI label. Shown, but excluded from every strict lineage path.

Vocabulary freeze

Entity and relationship sets are versioned constants. Adding a type creates a new version; a shipped vocabulary is never mutated, so a persisted edge means the same thing on the day it was written and the day an auditor reads it.

Resolution

Source observations are accepted or quarantined, matched to aliases by a fixed precedence order, and folded into one logical finding across scanners. Corroborating results become corroborates edges, not duplicate rows.

Events

Every change emits a versioned event — ontology.entity.changed@v1,finding.logical.changed@v1, attack_path.changed@v1,risk.assessment.changed@v1 — feeding projections, dashboards and the live UI stream.

Code → runtime lineage

Which commit put this CVE on the internet?

The lineage view walks an expected-hop template from repository to running workload. Every hop is either satisfied with its provenance, missing with a reason, or in conflict. It never fabricates an edge to make the picture look complete.

Repository

contains

Commit

triggered

Build

produces

ContainerImage

stored_in

Registry

runs_image

Workload

routes_to · exposes

KubeService → Ingress

Lineage

Honest gaps

A missing hop is reported as no_producer_data (no source connected),source_gap (source connected, edge never observed) orunbound_endpoint. Missing hops are read-time states and are never stored as edges.

Blast radius

Bounded downstream walk

From any vulnerable package, image or repository, a bounded breadth-first walk follows creation and deployment edges to every workload, service and ingress that carries it. Sibling findings are deliberately excluded so the count means impact, not noise.

Exploit path

Exposure to asset

Attack paths are computed from exposure edges through identities, roles and data stores, with chokepoints and candidate interventions ranked. An empty result says why: no_exposure_edges or no_attack_paths_computed.

Repo ↔ image

Repository-to-image links use an evidence ladder: verified attestation and OIDC subject count as observed, CI cross-reference as derived, OCI label and tag heuristics as inferred. The UI shows the channel that established each link.

Risk

A versioned risk model scores each logical finding from severity, exploit likelihood, reachability, exposure and business context, with an explanation object for every score and incremental recomputation when the graph changes.

Cloud & runtime

The same graph, extended into your accounts.

Cloud, Kubernetes and image findings are not a separate product. They are more edges on the same entities, so a misconfigured role and a vulnerable container show up on the same attack path.

CSPM

Posture

Native checks and benchmark rules across AWS, Azure and GCP with drift detection, posture SLAs and compliance mapping into the same control library.

CIEM

Identity & entitlements

Cloud principals, roles and access policies as graph entities; assumes andcan_access edges feed attack paths and least-privilege recommendations.

K8s

Cluster inventory & runtime

Inventory and topology ingest, admission checks, an eBPF sensor for runtime signals and workload-to-image binding by digest.

Image 360

Images end to end

Registry watchers for ECR, ACR, GAR, Artifactory, Harbor and Nexus, per-digest scan results, base-image recommendations and the workloads running each digest.

DSPM · EASM

Data and external surface

Data stores and classifications as entities; external attack-surface discovery adds Endpoint and Exposure edges to internet-facing assets.

Agentless

No agents required

Agentless collectors and serverless coverage; optional sensors only where runtime depth is wanted.

Policy & evidence

Deterministic decisions. Human-only dispositions.

Policy is Open Policy Agent Rego, authored directly or through a visual builder that compiles to Rego. Evaluation fails closed. Decisions are signed. The audit log is hash-chained.

Engine

OPA · Rego. Structured input, subprocess evaluation, parsed result. Any evaluator error is a DENY with reason OPA_EVALUATION_FAILED, never an allow.

Visual builder

Rules, AND/OR groups and actions compiled to valid Rego from an allow-listed field model, so GRC owners author policy and engineers review the generated diff.

Signing

Ed25519. Each control decision signs a canonical payload — control, decision, input hash, organization, key fingerprint, schema version, timestamp — with a key held only by the evaluation service. Auditors verify with the public half.

Audit log

Append-only, each record carrying the HMAC of its predecessor. Tampering breaks the chain; the platform can prove continuity for any window.

Disposition

Human only. True positive, false positive and by-design verdicts require a signed-in principal and a reason code. A guard at the ORM layer and a database trigger both refuse machine or AI writes.

Local-model triage and natural-language filters are advisory and one-shot: model output is validated against a strict schema and rejected on any failure, and every prompt is audited.

Exceptions

Owner, expiry, approver chain and dual control. Expiry is a tracked state on the exception, not a calendar reminder.

Frameworks

SOC 2, ISO 27001, NIST 800-53 r5, NIST CSF, PCI DSS v4, HIPAA, GDPR, CCPA, CIS, NIS2, DORA, SOX and US federal baselines as control mappings, plus custom frameworks with a cross-mapper. SecurityVault holds no certification of its own.

Remediation

From finding to merged fix.

Findings route to the owning team through the graph, land in the tools engineers already use and come back as verified edges when the fix ships.

PR gating

Pull-request scans with supersede logic, SARIF upload, gate evaluation and annotated comments. Comment posting is rate-limited per organization and every attempt is recorded, posted or not.

Tickets, two-way

Jira Cloud and Server, ServiceNow, Linear, Zendesk, Azure DevOps and generic webhooks. Inbound webhooks are HMAC-verified with a replay guard.

Remediation cases

Group findings into cases with owners, rollout stages and simulation of the change before it lands. Aborted rollouts are reported as aborted.

Verified closure

A finding closes when a later scan no longer observes it; prior human verdicts carry forward verbatim onto the successor finding. Status is never flipped by hand or by AI.

SLA & escalation

Severity and asset-tier SLAs with escalation through Slack, Teams and PagerDuty, and posture SLAs for cloud drift.

Persona home

Eight role-based home views — developer, AppSec, cloud, SOC, GRC, executive and more — each reading the same entity projection with RBAC as the only access authority.

Integrations

Built into the code base, not a marketplace promise.

Every connector below ships in the platform today. Connector health is itself an ontology event, so a silent integration is a visible one.

Category	Connectors
Source control & CI/CD	GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, AWS CodePipeline; CI OIDC principals, pipeline templates, result snapshots
Cloud	AWS, Azure, GCP (agentless), Kubernetes clusters with onboarding, health and routing
Registries	Amazon ECR, Azure ACR, Google Artifact Registry, JFrog Artifactory, Harbor, Sonatype Nexus, any OCI registry
Ticketing	Jira Cloud, Jira Server, ServiceNow, Linear, Zendesk, Azure DevOps Boards, generic webhook
Chat & on-call	Slack (bot and commands), Microsoft Teams (bot and events), PagerDuty schedules and escalation
SIEM	Splunk HEC, Microsoft Sentinel, Google Chronicle, IBM QRadar, Elasticsearch, syslog
Identity	Okta, Microsoft Entra ID, Google Workspace, CyberArk, SCIM 2.0 provisioning
Security platforms	CrowdStrike Falcon, Microsoft Defender, SentinelOne, Wiz, Prisma Cloud, Tenable, Rapid7 InsightVM import
OT	Claroty, Nozomi, Tenable OT
Developer platforms	Argo CD, Backstage, status page feed

Deployment · where scanners run

Scan where your code lives.

Same Helm charts, same signed images, same trust boundaries. Choose where the scan band runs; the platform can be hosted by us or by you.

Option A

SecurityVault Cloud

Sign in at app.securityvault.io
Scans run in our isolated scan band
Row-level tenant isolation with Postgres policies proven in CI
Credentials encrypted at rest; secrets in Vault
SSO (OIDC, SAML), SCIM provisioning, MFA

Fastest path to first scan

Option B

Your cluster, our control plane

Register your own Kubernetes cluster (EKS, GKE, AKS or generic) as an execution cluster
Approve its CA fingerprint; untrusted clusters never receive a job
Scanners launch inside your network, clone and analyse there
Only signed results leave, over outbound HTTPS to the callback plane
Per-cluster network zone, parallelism cap and routing policy; fail-closed fallback

Source code and images never leave your environment

Option C

Fully self-hosted

Helm charts: platform, infrastructure, k8s sensor, image sensor, agentless scanner, DAST browser pool, connectors, SIEM
Cosign-signed images from your own registry mirror
Cilium network policies and a Cosign admission webhook
PostgreSQL 16, Redis, ClickHouse lake, S3-compatible object storage
Nothing leaves your environment

For regulated and sovereign environments

Sensors

Optional in-cluster components ship as their own charts and speak only to the ingest endpoints: the Kubernetes sensor (inventory, topology, eBPF runtime signals), the Image 360 sensor (workload-to-digest binding) and the agentless cloud scanner. Each is registered, health-tracked and revocable per organization.

Questions we get

Frequently asked.

Do I have to choose between your native engine and open-source scanners?: No. Both run in the same scan, in the same untrusted band, and their results are reconciled into one logical finding per issue. Multi-tool agreement becomes a corroborates edge and raises confidence; it never creates a duplicate.
What does “tracking a finding from code to runtime” actually mean?: Each finding is attached to a subject entity — a package, a file span, a resource. The lineage view then walks Repository → Commit → Build → ContainerImage → Registry → Workload → Service → Ingress using only observed or derived edges. You see which commit introduced the issue, which digest carries it, and which workloads and ingresses expose it right now.
Can a compromised scanner reach my data?: No. Scanner pods get acquisition credentials for the target and nothing else. The result adapter gets a single-use, scan-scoped token and a body-signing key. There are no database, cache, vault or object-storage credentials in the pod, and the adapter refuses to start if it finds any.
Can AI change the status of a finding?: No. Disposition is a human-only write path with a mandatory reason code, enforced at the ORM layer and again by a database trigger. AI triage is advisory and every prompt is audited.
Which languages get the deepest analysis?: Native taint analysis covers twelve languages; interprocedural call graphs exist for Go, Java, JavaScript/TypeScript, Python and Rust. Framework models continue to expand, and the language-specific open-source tools fill in alongside.
Can scanners run in our own environment with only results sent to you?: Yes. Register your Kubernetes cluster as an execution cluster, approve its fingerprint and mark it as a scan target. Scan Jobs are then created in your cluster: the repository is cloned there, the tools run there, and only the signed result payload is posted back to the callback plane. Routing is explicit, hashed or round-robin across your trusted clusters and fails closed if none is healthy.
Are you certified?: Not yet. SecurityVault holds no third-party certification today; the platform maps your controls to frameworks, it does not attest to ours. Our security architecture, DPA and questionnaire answers are available on request.

See it on your own repository

Bring a repo and a cluster.
Watch the graph connect.

A 30-minute session with a SecurityVault engineer: one scan, one lineage view, one attack path, on your code.