Security Scanning
Scanning that survives the audit
Every result is measured against your own policy, sealed as evidence the moment it lands, and verifiable by your auditor without our credentials. When something drifts, the fix is checked by an independent rescan, not taken on faith. Bring our scanners, bring your own, or run both. Same audit-ready record either way.
The obvious question
“How is this different from Vanta or Wiz?”
Vanta-class platforms detect and file a ticket. Cloud posture platforms detect and auto-fix at runtime. Neither ships an evidence trail your auditor can verify offline. We sit at the intersection.
- When a scan finds MFA disabled
- MFA disabled on 3 users
- What happens next
- Jira ticket queued for the admin to fix
- At audit time
- Auditor still asks for screenshots at audit time
- When a scan finds MFA disabled
- Public S3 bucket + attack-path graph
- What happens next
- One-click remediation via API
- At audit time
- Evidence trail is your problem at audit time
- When a scan finds MFA disabled
- MFA disabled + mapped to every framework your org is measured against
- What happens next
- One-click fix across the cloud, identity, and productivity platforms your business runs on
- At audit time
- The finding IS the evidence row — chain-anchored, verifiable offline by any auditor
Your policy, not a checklist
Every result says what your policy expects, what we saw, and the gap
A check doesn’t pass or fail against a generic baseline. It’s measured against the clause in your own policy, at the revision in force when we looked. Tighten the clause and the results change with it.
- Four honest outcomes: pass, fail, not evidenced, scope blocked. If a platform refuses us, that never becomes a pass
- Failures broken down per user or resource, so you can see whether the cause is a real gap, an exception that lapsed, or a known exception you already declared
- Exceptions come from the register you keep on each policy clause. They’re shown to your auditor as declared, never as passing
- Every result says where it came from: a live reading, a report you imported, or a point-in-time security test
- d.kim · super adminTechnical failure
- t.lund · exception expired 30 SepException lapsed
- r.osei · field phone, until 31 DecKnown exception
Cross-framework yield
Scan once, satisfy every framework it maps to
Every scanner check is pre-mapped through the Secure Controls Framework crosswalk. When a scan passes, the satisfaction chip lights up on every framework panel that mapped control belongs to: SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP, NIST CSF, CMMC, CSA CCM, GDPR, and more. If SCF can see it, we scan aligned to it.
- Coverage tracks your organization’s framework mix. Whatever you’re measured against, that is what your scans satisfy
- Hundreds of controls mapped across every major framework via the Secure Controls Framework crosswalk
- Same source of truth as your compliance evidence graph. No re-mapping, no per-framework spreadsheets
- When SCF adds a new framework, your scanners inherit the mapping automatically
- SOC 2CC6.1
- SOC 2CC6.2
- ISO 27001A.8.5
- PCI DSS8.3.1
- PCI DSS8.3.6
- HIPAA164.312.d
- FedRAMPIA-2(1)
- FedRAMPIA-2(2)
- NIST CSFPR.IA-03
- CMMCIA.L2-3.5.3
- CSA CCMIAM-02
- GDPRArt. 32
- CIPAISP-3
SCF crosswalk propagates the pass across every framework the same underlying control belongs to. Whatever compliance mix your organization is measured against, one scan check satisfies every related requirement in one pass.
Signal source flexibility
Bring our scanners. Bring your own. Bring both.
Seven native scanners on the platforms you actually run, plus import adapters for the tools you already trust: Prowler, Checkov, Trivy, Snyk, Wiz, OSV-Scanner and CISA’s ScubaGear. Security-test findings from Red Claw land in the same results. Every result keeps its origin. An imported report is labelled as imported, and a pentest finding as point in time. Neither is ever dressed up as a live reading.
- AWS18
- GitHub16
- GCP13
- Google Workspace13
- Azure7
- Okta6
- Slack3
- ProwlerJSON
- CheckovJSON
- TrivyJSON
- SnykJSON
- WizJSON
- OSV-ScannerJSON
- ScubaGearJSON
Whichever lane the signal comes from, it lands as the same object, labelled with where it came from.
Finding lifecycle
Findings move the way your VM policy says they should
Every finding is a first-class object routed through your organization’s vulnerability management policy. The SLA on a finding is whatever your policy calls for. Findings arrive continuously, instant via webhook where change happens fast, on your chosen schedule where it doesn’t, and can be sent to any work management platform.
- SLA per severity, aligned to your VM policy. The thresholds you set
- Auto-escalation when the SLA slips, up your escalation chain
- Two-way sync with Jira, Linear, Asana and GitHub Issues. A ticket marked Done starts the rescan; the rescan resolves it
- Exceptions and risk acceptances expire on the date you set. When one lapses, the finding comes back on its own
- Every transition writes to an immutable activity log
- Slack and email alerts on new findings and SLA warnings, routed per your policy
- Critical1 day
- High7 days
- Medium30 days
- Low90 days
- InfoNone
Escalations route up your chain. Bidirectional sync with Jira, Linear, Asana, and GitHub Issues — resolve once, resolve everywhere.
Chain of custody
Sealed is not the same as sound
Every finding lands on a SHA-256 hash chain, anchored by outside timestamp authorities, so your auditor can prove nothing changed after it was written. That’s the seal. The evidence graph answers the harder question: was the record right when it was written?
Each record has to agree with four neighbours: the grant that allowed the read, the policy revision it was measured against, the record it replaced, and the collector’s own history. A reading taken with a token revoked six hours earlier seals perfectly. The graph still catches it, withdraws it, and re-collects.
Policy drift
Findings cluster into drift, against your policies, not a generic checklist
When a scanner catches an MFA policy going down, the platform doesn’t just log the config change. It clusters the finding with related events, matches it against your published policy library, and surfaces the drift alert with the specific policy it contradicts and the fix path to resolve it, in one place, already routed.
- AI-mapped against your policy corpus, not a generic template
- Drift alerts group related findings into one actionable object
- Fix path attached where the write path is proven
- Full attribution of which policy, which control, which framework
Drift alerts cluster scanner findings, name the policy they contradict, and route the fix. AI-mapped against your policy library, not a Rego evaluation.
Fix path
Approve it once. A rescan decides whether it worked.
Every drift alert arrives with the fix wired to the system it belongs to: an API change, a pull request against your infrastructure code, guided steps, or a ticket for a code change. You approve it, and it’s applied. The finding only closes when an independent rescan confirms the change held. If it didn’t, it’s rolled back and you’re told why.
- Read-only by default. Write access is a separate grant an admin issues, scoped to what the fix needs, with an expiry
- Every fix shows its blast radius and rollback before you approve it
- No change verifies itself. The rescan does. Run by an independent scanner, not by whatever applied the fix
- Need it ticketed? Create the Jira or Linear issue from the fix. The ticket key goes on the pull request, and marking it Done still waits for the rescan
- 09:41Approved by Maria Chen. Reason: CC8.1 audit sample next week
- 09:41Applied as PR #412 · ENG-2291 on the PR
- 09:58Rescan passed by an independent scanner, not by whatever applied the fix
- 09:58Resolved and sealed on the audit trail
A category of fix can act on its own only after its fixes have held on independent rescan: 98% of at least 30 by default. Your org can set its own bar, never below 90% of 10. Business and Ultra build that record now; Trustworthy Autonomy on Enterprise lets it act.
Common questions
The questions buyers actually ask
Ready for scanning that survives the audit?
Get your first scan running in minutes. Turn every finding into evidence.