Capabilities

Everything apPosture does - in one platform

A complete application-security program, self-hosted: every discipline below ships in the same engine and rolls up into a single, deduplicated, risk-weighted posture. No bolt-ons, no per-tool bill.

Book a demo →How it fits together
One posture, every source

All of it correlates into one Unit of Work

Findings from each source deduplicate and correlate - so you triage a root cause once, not the same issue across five tools.

DAST SAST SCA Secrets Container IaC Cloud Kubernetes Imported reports
Full capability map

23 capability areas, native to the platform

Grounded in what the product actually does today - not a roadmap.

Authentication & access control

  • Email/password + JWT, session binding, idle/absolute timeout, token kill-switch
  • MFA (TOTP) with forced enrolment and backup codes
  • Password policy: complexity, reuse history, expiry, account lockout
  • RBAC roles + granular permissions, plus custom roles
  • Scoped, expiring API tokens for CI and service accounts
  • SSO: OIDC, SAML, LDAP, Entra ID; SCIM provisioning; group-to-role; JIT

Assets, targets & products

  • Applications across web, API, repo, image, K8s, cloud and host - with criticality and owner
  • Targets with auth (form/bearer/header/cookie/OAuth2/mTLS) and a 2nd user for IDOR/BOLA
  • Products group microservice repos into one rolled-up posture with bulk scan
  • Asset inventory: repo to image to workload to cluster correlation
  • Runs-on infrastructure links for blast-radius analysis

DAST scanning & pipeline

  • Lifecycle: queue, run, pause/resume, cancel, with live log, ETA and coverage %
  • Profiles Quick / Standard / Deep; spider to active to templates to AI analysis
  • Warm-pool active scanner, 9,000+ templates, multi-engine aggregator, deep crawler, browser SPA crawl
  • OAST out-of-band blind-vuln callbacks; DOM-XSS confirmed by real browser execution
  • Recurring scheduled scans, one-click scan of every target in an app

Gray-box exploitation

  • Three phases: app-model from source, per-endpoint OWASP plan, host-pinned bounded exploitation
  • OWASP A01-A10 modules: IDOR/BOLA, injection, crypto, business logic, misconfig, auth, deserialization, SSRF
  • Authorization differential matrix (multi-principal BOLA/IDOR)
  • API-abuse checks (mass assignment, rate-limit) and an agentic AI exploitation loop
  • SAFE by design: benign markers only, no destructive verbs

Hybrid AST (SAST-informed DAST)

  • SAST recon builds per-endpoint vulnerability hypotheses
  • A deterministic prober turns potential into confirmed-with-proof
  • Bridges static reachability and dynamic exploitation

API security

  • Endpoint inventory with one hero risk score + A-F grade
  • Code-to-runtime provenance: Code + Runtime / From source / Runtime-only
  • Toxic combinations (public + sensitive + unauthenticated), typed PII/PCI/PHI
  • Contract-as-truth (declared vs running OpenAPI), out-of-band runtime correlation
  • CI score-gate + SARIF export; API-scoped compliance across 7 frameworks

Code security - SAST / SCA / Secrets / IaC / Container

  • SAST: rules + taint engines (Python, JS/TS, PHP; AST-based Java/Go/C#/Ruby), reachability, baseline / PR-diff, optional deep semantic analysis
  • SCA: offline manifest + advisory, reachability, license policy, typosquat/supply-chain, OSV/NVD, auto-fix PR, SBOM
  • Secrets: entropy + pattern detection, git-history scan, masked samples
  • IaC: Terraform / K8s / CloudFormation / Dockerfile misconfig + drift
  • Container: OS packages + app deps + CIS config (built-in scanner)

Cloud & Kubernetes posture

  • CSPM: CIS AWS Foundational Security + OWASP Cloud-Native Top 10, agentless snapshot
  • KSPM: CIS-aligned workload-spec evaluation with drift check
  • K8s runtime: runtime security event ingest

AI security & AI-BOM

  • AI-BOM: an inventory of the models, agents, prompts and MCP tools your apps actually use
  • AI config scan: insecure model config, exposed keys and injected / malicious instructions in prompts and agent flows
  • AI supply chain: hallucinated-package and slopsquat detection (a model-suggested dependency that does not exist yet is a takeover waiting to happen)
  • MCP governance: which servers and tools an AI agent may reach, reviewed like any other access boundary

Breach & attack simulation

  • Safe, non-destructive attack scenarios that validate whether a control actually blocks - not whether it is merely configured
  • Chained to the attack-path graph: simulate the exact route from exposure to crown jewel
  • Every step is a benign marker; nothing runs a real destructive action

Findings & vulnerability management

  • Raw findings collapse into deduplicated vulnerabilities via a source-aware fingerprint
  • Grouping + rich filters: reachable, exploitable, SLA-breached, new, production
  • Status workflow, owner assignment, bulk update, CSV export, evidence chain per finding
  • Import third-party scanner reports (SARIF and other common formats) into one unified posture

Risk scoring, prioritization & posture

  • Deterministic posture 0-100 + A-F grade + trend
  • Risk score: severity + exploitability + source count + business-criticality
  • Live threat intel alignment: CISA KEV, EPSS bands, CVSS
  • Posture dashboard: priorities funnel, exec summary, burndown, forecast, exploit radar, exposure matrix

Attack mapping & threat models

  • Attack-path graph: shadow-IT to app to vuln to exploit to crown jewel
  • Ranked attack chains / toxic combinations and choke-point analysis
  • STRIDE threat models, AI-generated or from questionnaire, versioned with approval, printable

Compliance, SLA & evidence

  • Mapping: OWASP Top 10, PCI-DSS v4, ISO 27001, SOC 2, NIST 800-53, HIPAA, GDPR
  • Manual attestation, DSOMM-style maturity, per-app benchmark
  • SLA: due-days per severity, KEV/exploit fast-track, attainment, overrides
  • Tamper-evident evidence hash chain, exportable packages, expiring auditor portals
  • Risk-acceptance workflow: request, approve, expire/revoke - fully audited

Reporting & analytics

  • Executive/board, technical, compliance (8-layer code-to-cloud), remediation/SLA, trend, register, attack-chains, scorecards, dossiers, delta, custom
  • Formats: HTML, PDF, JSON, CSV, XLSX with inline charts, English + Azerbaijani
  • Frozen metrics snapshot + tamper-evidence hash + verify, scheduled reports, expiring share links

AI assistant & copilot

  • Natural-language Q&A over the vuln universe via a deterministic SQL grammar (no LLM in the query path)
  • Special answers: attack chains, exposure, insurance posture, compliance briefing, blind spots, forecast
  • Per-vuln triage copilot: recommendation + rationale + code-fix diff, draft owner message
  • Actions from answers: create ticket, export evidence, notify owners, open PR, accept risk, mark FP

Remediation & ticketing

  • AI fix generation (verified unified diff) for SAST, SCA and DAST
  • Auto-fix pull requests, preview-first
  • Ticketing: Jira, Azure DevOps Boards, GitLab Issues, with status sync and inbound webhook

CI/CD & SCM integration

  • Checksum-pinned CI agent + SARIF ingest, per-run gate verdict and PR decoration
  • Quality gate: policy eval (pass/warn/fail), monitor vs block, dry-run
  • Signature-verified SCM webhooks: push to baseline scan, PR/MR to delta scan + gate comment
  • Pipeline snippets for GitHub Actions, GitLab CI, Jenkins, Bitbucket

Governance & policies

  • DevSecOps policies + a shared deterministic rule engine (condition tree, versioned, dry-run)
  • Org security policy (password/lockout/session) tunable at runtime
  • Data-retention policy with automatic pruning

Notifications & alerts

  • Channels: email, Slack, Teams, Telegram, generic webhook (encrypted, test send)
  • Preference matrix (team defaults + user overrides), digest modes, quiet hours
  • Versioned templates with approval, placeholders, preview, A/B metrics
  • Mutes/snooze, in-app center, smart root-cause bundling

Discovery & recon

  • External asset discovery: CT logs, DNS / reverse-DNS, subdomain brute-force, HTTP probe
  • Promote discovered assets into applications
  • Fail-closed domain-ownership gate: DNS TXT / HTTP well-known / admin attestation

Threat intelligence (CTI)

  • Live feed sync: CISA KEV, NVD, EPSS, GHSA, OSV
  • Relevance-flagged against the customer stack
  • Opt-in egress with configurable cadence, sources and proxy

Platform admin & operations

  • Backups: encrypted dumps, verify-restore drill, integrity check, off-site (SMB/NFS/S3/SFTP)
  • S3 Object Lock (WORM), GFS retention, schedules, pre-restore safety snapshot
  • Health monitor with per-service status and alerts
  • Ed25519-signed license with seat enforcement, white-label branding, onboarding wizard
  • Append-only audit log (actor/action/before/after) with CSV/HTML export

See the whole platform on one of your own apps

From discovery to a proven attack chain. A PoC in your own environment.

Book a PoC See the product Pricing