Application security for source code
Aegis
The code that builds the estate.
It finds defects in the code that builds your estate: static analysis, dependency vulnerabilities, secrets, infrastructure-as-code misconfigurations, and container images, normalized into one finding model with a software bill of materials, and joined to the running resources they become.
What it does
How it works.
Runs proven open-source engines.
Semgrep and Bandit for code, pip-audit and Safety for dependencies, detect-secrets for secrets, Checkov for infrastructure as code, and Trivy for containers and file systems.
Normalizes every finding.
One schema with severity, CWE, location, fix guidance, and a deduplication hash, whichever engine found it, plus a CycloneDX SBOM.
Joins code to cloud.
A finding in an IaC file joins to the running resource that file declares, and a container finding joins to the workload running that image digest, so one report shows the code and the resource together.
Counts each control once.
Where the survey already judges a piece of infrastructure, the code finding on the same file is cross-linked to it, never counted twice toward a score.
By design
What it never does.
- Connects to a cloud account.
- Writes to your repository except through a pull request a person opens.
- Ships a rule set whose license does not allow commercial use.
Footprint
What it touches in your organization.
- Your accounts
- None. It never connects to a cloud account.
- Your code
- Read access to the repositories you grant, scanned from Vantalect's environment, or a signed runner you place in your own CI.
- Where the data lives
- With the engagement, held by Vantalect under the engagement terms. Acumen Defensive holds none of it.
In Vantalect’s engagements
Where it fits.
- AWS Security, Compliance & Governance Audit: Aegis is the companion tool. The application-security tool joins when the statement of work includes your IaC and pipeline code; continuous assessment keeps the gate measured afterward, and external testing proves what the audit found.
- AWS Well-Architected Framework Review: Aegis is the companion tool. The application-security tool reads the reviewed workload's code.
Put the tools to work
Engagements run through Vantalect.
Acumen Defensive builds the tools and runs no engagements of its own. Vantalect delivers every engagement that uses them, with the scope and price of each published at vantalect.com.
Vantalect, LLC is a separate company that licenses and operates these tools.