The terms behind modern AppSec and ASPM - what each means, and how proof-based, self-hosted apPosture treats it. Short definitions, honestly scoped.
ASOC is the correlation-and-workflow layer that normalizes and deduplicates findings across tools. ASPM is the broader discipline that adds risk weighting, reachability, posture scoring and SLA on top of that correlation.
ASPM aggregates findings from every AppSec source - DAST, SAST, SCA, container, IaC, secrets - correlates them into one deduplicated view per root cause, weights them by risk and reachability, and tracks them against an SLA. It turns a pile of scanners into a managed program.
An attack path is the multi-step route an attacker takes - internet to API to database to data - with each hop backed by a proven finding. Chaining findings this way reveals the choke point where one fix breaks the whole chain.
A CI gate evaluates a build against a policy and can fail it before risky code ships. A fail-closed gate blocks on breach; many gates fail open. Rolling it out in Monitor mode first, then flipping to Block, avoids surprising developers.
CSPM continuously checks cloud infrastructure - accounts, IAM, storage, network - against configuration best practice and compliance baselines. It governs the cloud the app runs on; ASPM governs the application itself. The two are complementary, not substitutes.
DAST tests a running application from the outside, the way an attacker would. A proof-based DAST confirms each issue with a real, safe exploit - a differential SQLi response, a DOM-XSS execution - rather than inferring it from a pattern.
The share of raised findings that are not real. A high rate destroys a security tool's credibility and buries the true positives. Evidence-based detection and reachability are how a modern engine keeps it near zero.
IAST instruments a running application with a sensor that watches tainted data reach a sink during real traffic. It confirms exploitability from inside the process, correlating runtime evidence with static findings.
The KEV catalog lists vulnerabilities with confirmed real-world exploitation. Funneling findings through KEV and exploit-maturity data pushes the genuinely dangerous ones to the top of the queue.
The OWASP Benchmark is a public, ground-truth test suite for measuring a scanner's true and false positives across categories. apPosture scores 100% precision and 99.4% recall on it - an externally verifiable accuracy claim.
Reachability asks whether vulnerable code is actually on a path that runtime input can reach. A finding that is reachable and proven is prioritized; one that is unreachable is de-emphasized. It is the single biggest lever for noise reduction.
SAST analyzes source code without running it, tracing tainted input from a source to a dangerous sink. Its quality is measured by false-positive discrimination - flagging the real flaw without drowning teams in noise.
An SBOM is a machine-readable inventory of every component in a piece of software, commonly CycloneDX or SPDX. It underpins dependency scanning, supply-chain response and vendor review.
SCA finds known-vulnerable dependencies by matching your components against CVE data. Reachability then separates a CVE that your code actually calls from one that merely sits in the lockfile, which is what cuts dependency noise.
From discovery to a proven attack chain. A PoC in your own environment.