Capabilities

Everything apPosture does - in one platform

A complete application-security program, self-hosted: every discipline below ships in the same engine and rolls up into a single, deduplicated, risk-weighted posture. No bolt-ons, no per-tool bill.

Book a demo →How it fits together
One posture, every source

All of it correlates into one Unit of Work

Findings from each source deduplicate and correlate - so you triage a root cause once, not the same issue across five tools.

DAST SAST SCA Secrets Container IaC Cloud Kubernetes Imported reports
Full capability map

23 capability areas, native to the platform

Grounded in what the product actually does today - not a roadmap.

Authentication & access control

  • JWT sessions with idle/absolute timeout and a token kill-switch
  • MFA (TOTP, forced enrolment, backup codes) + password policy (complexity, reuse, expiry, lockout)
  • RBAC with custom roles, plus scoped expiring API tokens for CI
  • SSO: OIDC, SAML, LDAP, Entra ID; SCIM provisioning; group-to-role; JIT

Assets, targets & products

  • Applications across web, API, repo, image, K8s, cloud and host - with criticality and owner
  • Targets with auth (form/bearer/header/cookie/OAuth2/mTLS) and a 2nd user for IDOR/BOLA
  • Products group microservice repos into one rolled-up posture with bulk scan
  • Asset inventory (repo → image → workload → cluster) and runs-on links for blast-radius

DAST scanning & pipeline

  • Lifecycle: queue, run, pause/resume, cancel, with live log, ETA and coverage %
  • Profiles Quick / Standard / Deep; spider → active → templates → AI analysis
  • Warm-pool scanner, 9,000+ templates, multi-engine aggregator, browser SPA crawl
  • OAST blind-vuln callbacks; DOM-XSS confirmed by real browser execution

Gray-box exploitation

  • Three phases: app-model from source, per-endpoint OWASP plan, bounded exploitation
  • OWASP A01-A10 modules: IDOR/BOLA, injection, crypto, business logic, deserialization, SSRF
  • Authorization differential matrix (multi-principal BOLA/IDOR) + agentic AI exploitation loop
  • SAFE by design: benign markers only, no destructive verbs

Hybrid AST (SAST-informed DAST)

  • SAST recon builds per-endpoint vulnerability hypotheses
  • A deterministic prober turns potential into confirmed-with-proof
  • Bridges static reachability and dynamic exploitation

API security

  • Endpoint inventory with one hero risk score + A-F grade
  • Code-to-runtime provenance; toxic combinations (public + sensitive + unauthenticated), typed PII/PCI/PHI
  • Contract-as-truth (declared vs running OpenAPI), out-of-band runtime correlation
  • CI score-gate + SARIF export; API-scoped compliance across 7 frameworks

Code security - SAST / SCA / Secrets / IaC / Container

  • SAST: rules + taint engines (Python, JS/TS, PHP; AST-based Java/Go/C#/Ruby), reachability, baseline / PR-diff, optional deep semantic analysis
  • SCA: offline manifest + advisory, reachability, license policy, typosquat/supply-chain, OSV/NVD, auto-fix PR, SBOM
  • Secrets: entropy + pattern detection, git-history scan, masked samples
  • IaC: Terraform / K8s / CloudFormation / Dockerfile misconfig + drift
  • Container: OS packages + app deps + CIS config (built-in scanner)

Cloud & Kubernetes posture

  • CSPM: CIS AWS Foundational Security + OWASP Cloud-Native Top 10, agentless snapshot
  • KSPM: CIS-aligned workload-spec evaluation with drift check
  • K8s runtime: runtime security event ingest

AI security & AI-BOM

  • AI-BOM: an inventory of the models, agents, prompts and MCP tools your apps actually use
  • AI config scan: insecure model config, exposed keys and injected / malicious instructions in prompts and agent flows
  • AI supply chain: hallucinated-package and slopsquat detection (a model-suggested dependency that does not exist yet is a takeover waiting to happen)
  • MCP governance: which servers and tools an AI agent may reach, reviewed like any other access boundary

Breach & attack simulation

  • Safe, non-destructive attack scenarios that validate whether a control actually blocks - not whether it is merely configured
  • Chained to the attack-path graph: simulate the exact route from exposure to crown jewel
  • Every step is a benign marker; nothing runs a real destructive action

Findings & vulnerability management

  • Raw findings collapse into deduplicated vulnerabilities via a source-aware fingerprint
  • Grouping + rich filters: reachable, exploitable, SLA-breached, new, production
  • Status workflow, owner assignment, bulk update, CSV export, evidence chain per finding
  • Import third-party scanner reports (SARIF and other common formats) into one unified posture

Risk scoring, prioritization & posture

  • Deterministic posture 0-100 + A-F grade + trend
  • Risk score: severity + exploitability + source count + business-criticality
  • Live threat intel alignment: CISA KEV, EPSS bands, CVSS
  • Posture dashboard: priorities funnel, exec summary, burndown, forecast, exploit radar, exposure matrix

Attack mapping & threat models

  • Attack-path graph: shadow-IT to app to vuln to exploit to crown jewel
  • Ranked attack chains / toxic combinations and choke-point analysis
  • STRIDE threat models, AI-generated or from questionnaire, versioned with approval, printable

Compliance, SLA & evidence

  • Mapping: OWASP Top 10, PCI-DSS v4, ISO 27001, SOC 2, NIST 800-53, HIPAA, GDPR
  • SLA: due-days per severity, KEV/exploit fast-track, attainment, overrides
  • Tamper-evident evidence hash chain, exportable packages, expiring auditor portals
  • Risk-acceptance workflow: request, approve, expire/revoke - fully audited

Reporting & analytics

  • Executive/board, technical, compliance (8-layer code-to-cloud), remediation/SLA, trend, register, attack-chains, scorecards, dossiers, delta, custom
  • Formats: HTML, PDF, JSON, CSV, XLSX with inline charts, English + Azerbaijani
  • Frozen metrics snapshot + tamper-evidence hash + verify, scheduled reports, expiring share links

AI assistant & copilot

  • Natural-language Q&A over the vuln universe via a deterministic SQL grammar (no LLM in the query path)
  • Special answers: attack chains, exposure, insurance posture, compliance briefing, blind spots, forecast
  • Per-vuln triage copilot: recommendation + rationale + code-fix diff, draft owner message
  • Actions from answers: create ticket, export evidence, notify owners, open PR, accept risk, mark FP

Remediation & ticketing

  • AI fix generation (verified unified diff) for SAST, SCA and DAST
  • Auto-fix pull requests, preview-first
  • Ticketing: Jira, Azure DevOps Boards, GitLab Issues, with status sync and inbound webhook

CI/CD & SCM integration

  • Checksum-pinned CI agent + SARIF ingest, per-run gate verdict and PR decoration
  • Quality gate: policy eval (pass/warn/fail), monitor vs block, dry-run
  • Signature-verified SCM webhooks: push to baseline scan, PR/MR to delta scan + gate comment
  • Pipeline snippets for GitHub Actions, GitLab CI, Jenkins, Bitbucket

Governance & policies

  • DevSecOps policies + a shared deterministic rule engine (condition tree, versioned, dry-run)
  • Org security policy (password/lockout/session) tunable at runtime
  • Data-retention policy with automatic pruning

Notifications & alerts

  • Channels: email, Slack, Teams, Telegram, generic webhook (encrypted, test send)
  • Preference matrix (team defaults + user overrides), digest modes, quiet hours
  • Mutes/snooze, in-app center, smart root-cause bundling

Discovery & recon

  • External asset discovery: CT logs, DNS / reverse-DNS, subdomain brute-force, HTTP probe
  • Promote discovered assets into applications
  • Fail-closed domain-ownership gate: DNS TXT / HTTP well-known / admin attestation

Threat intelligence (CTI)

  • Live feed sync: CISA KEV, NVD, EPSS, GHSA, OSV
  • Relevance-flagged against the customer stack
  • Opt-in egress with configurable cadence, sources and proxy

Platform admin & operations

  • Backups: encrypted, verify-restore drill, off-site (SMB/NFS/S3/SFTP), S3 Object Lock (WORM)
  • Health monitor with per-service status and alerts
  • Ed25519-signed license, white-label branding, onboarding wizard
  • Append-only audit log (actor/action/before/after) with CSV/HTML export
apPosture

See the whole platform on one of your own apps

From discovery to a proven attack chain. A PoC in your own environment.

Book a demo → Take the product tour → Pricing