# SecurityVault

> SecurityVault is the enterprise security operating system: one graph of findings, policy and evidence from code to cloud. Its application security posture management (ASPM) platform correlates code, container images and cloud resources per commit into one finding graph, enforces fail-closed policy gates in CI/CD, and produces continuous compliance evidence.

- Launching in India, with US and EU hosting zones planned as customer demand grows. Contact us to discuss regional availability.
- Scanning: a native AppSec engine with 12 taint analysers plus 45 supported scanner adapters (SAST, SCA, SBOM, secrets, IaC, container images, cloud posture); scanners run as untrusted, ephemeral jobs.
- A shared evidence model connects available repository, commit, build, image, workload and cloud context, including missing links.
- 29 registered integration connectors; 6 compliance frameworks with seeded control catalogues, with selected mappings to further framework targets; coverage is not complete and human assessment remains necessary.
- Policy gates use Open Policy Agent (Rego) and fail closed: an evaluation error is a deny. Finding disposition (true positive, false positive and the other verdicts) is a human decision with a reason code.
- Company: SecurityVault Systems Private Limited, independent and privately held, incorporated in India on 14 October 2026 and headquartered in Agra, Uttar Pradesh, India. The public changelog (https://securityvault.io/changelog) records what shipped from April 2026. Pricing is to be announced; a design-partner programme is open (https://securityvault.io/customers) and customer names are not published. SecurityVault holds no third-party certification today; independent audits are planned (https://securityvault.io/trust).
- Not yet available (planned, no ship dates): SaaS security posture (SSPM); Data security posture (DSPM); Runtime testing (IAST); Breach & attack simulation; AI security posture (AI-SPM); AI governance; Detection & response; Threat intelligence. Their pages describe intended scope only.
- Name: SecurityVault, one word, at securityvault.io. It is application and cloud security software, unrelated to physical-security integrators, password managers, hardware 'secure vault' features, or other companies with 'SecVault' or 'Security Vault' in their names.
- Company facts for citation: /about (founding, headquarters, deployment), /press (fact sheet and boilerplate), /architecture (security design), /changelog (shipped releases by month).

## Product

- [Platform](https://securityvault.io/platform): Code-to-runtime ASPM: SAST, SCA, SBOM, IaC, secrets, container images and cloud posture on one finding graph.
- [Architecture](https://securityvault.io/architecture): Security architecture principles: isolated scanning, signed ingestion, tenant-scoped access and automated isolation checks, signed decisions and fail-closed defaults.
- [Vulnerability management](https://securityvault.io/vulnerability-management): Findings traced from repo line to image to workload, ranked by reachability and routed to owners.
- [Deployment gates](https://securityvault.io/deployment-gates): Policy-as-code CI/CD gates using Open Policy Agent; fail-closed and recorded.
- [Cloud posture (CSPM)](https://securityvault.io/cloud-posture): CSPM, CIEM and Kubernetes posture on the same ontology as code findings.
- [Identity and entitlements (CIEM)](https://securityvault.io/identity-entitlements): Human, workload and cloud identities as ontology entities on the same attack paths.
- [Continuous compliance](https://securityvault.io/continuous-compliance): Control status re-evaluated from scan evidence, with a read-only auditor portal.
- [Frameworks](https://securityvault.io/frameworks): Compliance frameworks and their control mappings.
- [Integrations](https://securityvault.io/integrations): SCM, cloud, registry, ticketing, chat, SIEM and identity connectors.
- [Solutions](https://securityvault.io/solutions): AppSec, cloud posture and compliance use cases.
- [Industries](https://securityvault.io/industries): How the platform applies to financial services, healthcare, the public sector and SaaS.
- [Pricing](https://securityvault.io/pricing): Pricing to be announced.
- [SAST](https://securityvault.io/sast): Static analysis with native per-language taint engines plus the open-source tools for each language, launched automatically.
- [SCA & SBOM](https://securityvault.io/sca-sbom): Open-source dependencies, their known vulnerabilities and licences, and the bill of materials for what actually shipped.
- [Secrets detection](https://securityvault.io/secrets-detection): Credentials in git history and image layers, found, routed to an owner and tracked to rotation.
- [IaC security](https://securityvault.io/iac-security): Terraform, CloudFormation, Kubernetes and Helm checked before apply, paired with live cloud posture on the same graph.
- [DAST](https://securityvault.io/dast): Dynamic testing of running applications, with findings on the same graph as the code behind them.
- [API security](https://securityvault.io/api-security): API inventory from specifications and source routes, with OWASP API Top 10 analysis and drift tracking.
- [Threat modeling](https://securityvault.io/threat-modeling): Threat models kept next to the system they describe and linked to the findings that test them.
- [Container security](https://securityvault.io/container-security): Image layers and base images scanned, and each digest bound to the workloads that run it.
- [Kubernetes security (KSPM)](https://securityvault.io/kubernetes-security): Cluster inventory and topology, CIS Kubernetes benchmarks and fail-closed admission control for unsigned images.
- [Attack surface management](https://securityvault.io/attack-surface-management): Subdomains and certificates discovered from your domains, with DNS and TLS posture checks and change alerts.
- [Remediation SLAs](https://securityvault.io/remediation-sla): Remediation cases, tickets and fix pull requests, with SLA deadlines tracked per finding and owning team.
- [SecurityVault by role](https://securityvault.io/for): What the platform does for each security, engineering and audit role.
- [CISOs and security leaders](https://securityvault.io/for/ciso): One defensible view of application and cloud risk, with the evidence behind every number you take to the board.
- [Security engineering](https://securityvault.io/for/security-engineering): The highest-impact risk you can reduce today, ranked by reachability and exposure rather than by raw severity.
- [Application security](https://securityvault.io/for/appsec): Code findings with source context, remediation ownership and visible scan coverage.
- [Platform engineering](https://securityvault.io/for/platform-engineering): Release policies, Kubernetes posture and evidence linking image digests to workloads.
- [Developers and engineering managers](https://securityvault.io/for/developers): What to fix, why it matters and how to prove it is fixed, in the pull request where you already work.
- [GRC and audit](https://securityvault.io/for/grc-audit): Control evidence, framework mappings and signed decisions to support audit review.
- [SOC and incident response](https://securityvault.io/for/soc-incident-response): Exposure, attack-path and blast-radius context for the asset in front of you, traced back to the code that shipped it.
- [Self-hosted](https://securityvault.io/self-hosted): Run SecurityVault in your own Kubernetes cluster; available on request.

## Docs

- [Documentation](https://securityvault.io/docs): Docs home: quickstart, ontology, CLI, API, webhooks, policy.
- [Quickstart](https://securityvault.io/docs/quickstart): Install the esos CLI, connect a repository, run a scan and read the lineage view.
- [Core concepts](https://securityvault.io/docs/concepts): Scans and tool plans, the finding ontology, lineage and blast radius, policy evaluation, human-only disposition.
- [CLI reference](https://securityvault.io/docs/cli): The esos command line: scan, ci scan, findings, sbom, policy, config, auth.
- [API reference](https://securityvault.io/docs/api): REST API under /api/v2: auth, scans, findings, lineage, disposition, errors, pagination.
- [SDKs](https://securityvault.io/docs/sdk): IDE extensions and planned IAST runtime analysis; confirm package availability for your deployment.
- [Webhooks](https://securityvault.io/docs/webhooks): Signed outbound finding events and inbound provider webhook verification.
- [Policy authoring](https://securityvault.io/docs/policy-authoring): Open Policy Agent Rego and the visual builder; fail-closed evaluation.

## Blog

Engineering writing on ASPM, SAST, SCA/SBOM, secrets, IaC, containers, CSPM, CIEM, KSPM, policy as code and compliance. Index: https://securityvault.io/blog

- [Cloud permission changes: prove access was reduced](https://securityvault.io/blog/cloud-permission-changes-prove-access-was-reduced): Verify cloud permission reductions with scoped access tests, session checks and fresh evidence, so an approved change becomes a defensible closure.
- [Scanner coverage: account for missing scan runs](https://securityvault.io/blog/scanner-coverage-account-for-missing-runs): Review scanner coverage against expected assets, completed runs and evidence freshness, so a quiet findings queue does not conceal missing assessments.
- [Vulnerability exceptions: review what changed](https://securityvault.io/blog/vulnerability-exceptions-review-what-changed): Review vulnerability exceptions against changed assets, exposure and evidence, so a temporary acceptance does not quietly become permanent closure.
- [Audit evidence sampling: account for the missing records](https://securityvault.io/blog/audit-evidence-sampling-account-for-missing-records): Build a reviewable audit evidence sample by defining its population, explaining exclusions and reconciling missing records before drawing conclusions.
- [Rollback security: reassess the release you restore](https://securityvault.io/blog/rollback-security-reassess-release-you-restore): Review rollback security with exact artefact identity, current evidence and dependency checks so an older release does not inherit an outdated approval.
- [Vulnerability ownership: make team handoffs explicit](https://securityvault.io/blog/vulnerability-ownership-make-team-handoffs-explicit): Make vulnerability ownership transfers explicit, with acceptance criteria, escalation and retained evidence so security work survives team changes.
- [ASPM vs CNAPP vs CSPM: what each covers and when to buy](https://securityvault.io/blog/aspm-vs-cnapp-vs-cspm): ASPM vs CNAPP vs CSPM explained: where each category starts, what it covers and misses, where they overlap, and how to choose which you need first.
- [Open-source container image scanners: Trivy, Grype, Syft](https://securityvault.io/blog/open-source-container-image-scanners): Open-source container image scanning tools compared: what Trivy, Grype, Syft and Dockle each find, where they disagree, and how to run them in CI.
- [Security logging: test what leaves your application](https://securityvault.io/blog/security-logging-test-what-leaves-application): Review security logging with synthetic secrets, export-path checks and failure tests while preserving useful evidence for incident investigation.
- [SSRF prevention: review a webhook delivery worker](https://securityvault.io/blog/ssrf-prevention-review-webhook-delivery-worker): Review SSRF prevention in webhook workers with destination controls, redirect handling, isolated tests and evidence for release decisions.
- [Kubernetes service accounts: audit workload access](https://securityvault.io/blog/kubernetes-service-accounts-audit-workload-access): Audit Kubernetes service accounts by tracing token mounts, effective permissions and workload ownership, then verify that access changes work.
- [API authorisation: test your tenant boundaries](https://securityvault.io/blog/api-authorization-test-tenant-boundaries): Build API authorisation tests around identity, tenant, object and action, using controlled fixtures to verify both allowed operations and denied access.
- [API inventory: find undocumented endpoints safely](https://securityvault.io/blog/api-inventory-find-undocumented-endpoints): Build an API inventory from specifications, source routes and deployment evidence, then assign ownership and review undocumented or retired endpoints.
- [Audit evidence freshness: review what still holds](https://securityvault.io/blog/audit-evidence-freshness-review-records): Assess audit evidence freshness using collection scope, change events and accountable review, so an old successful check does not imply current assurance.
- [Authenticated DAST: prove what your scan reached](https://securityvault.io/blog/authenticated-dast-scan-coverage): Check authenticated DAST coverage with session verification, role-specific routes and a reproducible test record before trusting a quiet scan report.
- [Build provenance: verify the image you deploy](https://securityvault.io/blog/build-provenance-verify-container-image): Verify container build provenance against the image digest, trusted builder and approved source, then retain the evidence behind deployment decisions.
- [Cloud access review: verify unused permissions](https://securityvault.io/blog/cloud-access-review-unused-permissions): Review unused cloud permissions using ownership, observation scope and tests, without confusing missing activity with proof of unnecessary access.
- [Code-to-runtime security: a coverage checklist](https://securityvault.io/blog/code-to-runtime-security-coverage-checklist): Map code-to-runtime security across source, builds, images, deployment and running workloads, with an evidence checklist for your evaluation.
- [Kubernetes NetworkPolicy: test workload isolation](https://securityvault.io/blog/kubernetes-networkpolicy-test-isolation): Verify Kubernetes NetworkPolicy with an explicit traffic matrix, allowed and denied probes, and evidence that distinguishes policy from network failure.
- [Policy-as-code testing: verify release decisions](https://securityvault.io/blog/policy-as-code-test-release-decisions): Test policy-as-code release decisions with explicit inputs, negative fixtures and failure cases before promoting a gate into the delivery workflow.
- [SAST remediation: write tests that protect the fix](https://securityvault.io/blog/sast-remediation-write-regression-tests): Turn a SAST finding into a focused remediation test that checks the dangerous data flow, preserves valid behaviour and catches future regressions.
- [SBOM diff: review what changed before a release](https://securityvault.io/blog/sbom-diff-review-release-changes): Use an SBOM diff to review added, removed and changed dependencies, preserve component identity and distinguish inventory gaps from release changes.
- [Secret rotation: verify every consumer switched](https://securityvault.io/blog/secret-rotation-verify-every-consumer): Plan secret rotation around consumer inventory, controlled cutover and revocation evidence so an updated secret does not leave old credentials usable.
- [Terraform drift: reconcile an emergency change](https://securityvault.io/blog/terraform-drift-reconcile-emergency-changes): Review Terraform drift after an emergency change by comparing configuration, state and live resources before choosing a controlled reconciliation.
- [Vulnerability remediation: prove the fix is live](https://securityvault.io/blog/vulnerability-remediation-verify-closure): Verify vulnerability remediation from source change to deployed artefact, with clear closure criteria for rescans, rollout gaps and temporary mitigation.
- [How to automate SOC 2 evidence collection from your pipeline](https://securityvault.io/blog/automate-soc-2-evidence-collection): Automate SOC 2 evidence collection from CI pipelines, cloud accounts and triage decisions, so Type II sampling becomes a query instead of a hunt.
- [How to evaluate ASPM tools: a buyer's criteria checklist](https://securityvault.io/blog/how-to-evaluate-aspm-tools): How to evaluate ASPM tools on correlation, reachability, deduplication, gates, evidence and deployment model, with tests for your own proof of concept.
- [Open-source CSPM tools: Prowler, ScoutSuite and beyond](https://securityvault.io/blog/open-source-cspm-tools): An honest guide to open-source CSPM tools: what Prowler, ScoutSuite, Cloud Custodian, Steampipe and Trivy each do, and where a correlation layer fits.
- [How to prioritise container vulnerabilities: KEV, EPSS, reach](https://securityvault.io/blog/prioritize-container-vulnerabilities): Prioritise container vulnerabilities with CISA KEV, FIRST EPSS, reachability and image-to-workload exposure, so the short list is what attackers would use.
- [SAST vs SCA vs secrets scanning: what each one catches](https://securityvault.io/blog/sast-vs-sca-vs-secrets-scanning): SAST vs SCA vs secrets scanning compared: what each inspects, what it misses, when it should run and who fixes its findings, with one shared example.
- [What is an SBOM? Formats, generation and VEX explained](https://securityvault.io/blog/what-is-an-sbom): Learn what an SBOM contains, how CycloneDX and SPDX differ, where to generate one, and how VEX communicates product-specific vulnerability assessments.
- [What is CIEM? Cloud infrastructure entitlement management](https://securityvault.io/blog/what-is-ciem): What is CIEM? How cloud infrastructure entitlement management finds excess permissions across human and machine identities, and how it differs from IAM.
- [Security finding correlation: one graph, not five queues](https://securityvault.io/blog/aspm-one-finding-graph-instead-of-five-queues): Correlate security findings from SAST, SCA, container, IaC and cloud scanners on one graph, so each vulnerability becomes one ranked, routed finding.
- [Excess privilege in the cloud: model it as graph edges](https://securityvault.io/blog/ciem-excess-privilege-as-graph-edges): Find excess cloud privilege by modelling identities, roles and trust policies as graph edges you can walk, rank and cut, not rows in an access review.
- [Cloud attack paths: chaining posture, workload and identity](https://securityvault.io/blog/cloud-attack-paths-posture-plus-workloads): Learn how cloud attack paths chain posture, workload and identity findings into one route, so you can close the link that matters first.
- [Container image scanning: layers, base images and real fixes](https://securityvault.io/blog/container-image-scanning-layers-and-base-images): Container image scanning that separates base-image, OS package and application dependency findings, so each goes to the team that can fix it.
- [Continuous compliance: live evidence, not screenshot folders](https://securityvault.io/blog/continuous-compliance-evidence-not-screenshots): Continuous compliance re-evaluates control status from scan evidence, so audit preparation becomes a review of signed records, not a screenshot hunt.
- [CSPM beyond misconfiguration lists: rank by exposure](https://securityvault.io/blog/cspm-beyond-misconfiguration-lists): CSPM finds misconfigurations; this guide shows how ownership, exposure ranking and drift SLAs turn that list into fixes teams actually ship.
- [Fail-closed deployment gates: why severity counts fail](https://securityvault.io/blog/fail-closed-gates-why-severity-counts-fail): Fail-closed gates built on severity counts get routed around. Use reachability, exposure, ownership and recorded overrides to keep them trusted.
- [Framework cross-walks: one evidence chain for every audit](https://securityvault.io/blog/framework-crosswalks-one-evidence-chain): Framework cross-walks help teams reuse audit evidence across shared controls while checking differences in scope, coverage and assessment requirements.
- [IaC drift: close findings on live evidence, not on merge](https://securityvault.io/blog/iac-findings-to-running-resources): IaC drift means a merged fix is not a deployed one. Link each IaC finding to the cloud resource it created and close it on evidence from the account.
- [IaC scanning before apply: catch misconfigurations in the PR](https://securityvault.io/blog/iac-scanning-before-apply): IaC scanning catches Terraform, Kubernetes and CloudFormation misconfigurations at pull-request time, while the fix is still a one-line change.
- [Identity attack paths: from assumable role to data store](https://securityvault.io/blog/identity-attack-paths-assumable-roles-to-data): Trace identity attack paths from a workload identity through assumable roles and trust policies to the data store it can reach, then cut one edge.
- [Container images to workloads: bind by digest, not by tag](https://securityvault.io/blog/image-to-workload-binding): Bind container images to workloads by digest, so vulnerabilities are prioritised by what is deployed and reachable, not by what sits in a registry.
- [KSPM: why Kubernetes posture starts with inventory](https://securityvault.io/blog/kspm-kubernetes-posture-inventory-admission): KSPM starts with a live inventory of clusters, workloads and RBAC. Learn how inventory, topology and admission control turn posture into enforcement.
- [Kubernetes admission gates and the cluster drift problem](https://securityvault.io/blog/kubernetes-admission-gates-and-cluster-drift): Kubernetes admission gates decide what runs, but drift undoes them. Learn what to gate on and how to keep the live cluster matching git.
- [New CVE response: use SBOMs to find which images shipped it](https://securityvault.io/blog/new-cve-which-images-shipped-it): Use retained SBOMs and workload links to investigate which images contain a newly disclosed vulnerability, then identify gaps that need further scanning.
- [Policy as code for deployment gates with OPA and Rego](https://securityvault.io/blog/policy-as-code-deployment-gates-with-opa): Policy as code with OPA and Rego turns deployment gates into testable rules that explain every decision at pull request, pipeline and admission.
- [Reducing SAST false positives without hiding real bugs](https://securityvault.io/blog/reducing-sast-noise-without-hiding-real-bugs): Reduce SAST review noise with better rules, reachability context and reason-coded triage, while keeping real weaknesses visible for reassessment.
- [Risk-based vulnerability management: rank by reachability](https://securityvault.io/blog/risk-based-vulnerability-management-reachability): Risk-based vulnerability management ranks findings by reachability and exposure, turning a thousand CVSS criticals into a short list worth fixing now.
- [SAST taint analysis explained: sources, sinks, sanitisers](https://securityvault.io/blog/sast-taint-analysis-explained): Learn how SAST taint analysis traces untrusted input from source to sink, why it beats pattern matching on noise, and where its blind spots are.
- [SCA vs SBOM: what each answers and why you need both](https://securityvault.io/blog/sca-vs-sbom-what-each-answers): SCA tells you which components are vulnerable today; an SBOM records what shipped. Learn how SCA and SBOM work together to answer advisory questions.
- [Leaked secret response: rotate, trace, then prevent repeats](https://securityvault.io/blog/secret-found-now-what): Deleting a leaked secret from HEAD is not remediation. The response that works: rotate first, trace affected images, keep evidence and gate repeats.
- [Secrets detection beyond HEAD: git history, CI logs, images](https://securityvault.io/blog/secrets-detection-in-git-history-and-images): Secrets detection that only scans HEAD misses real leaks. Where credentials hide in git history, CI logs and image layers, and how to verify them safely.
- [Vulnerability ownership: route findings by the graph](https://securityvault.io/blog/vulnerability-ownership-routing-by-graph): Vulnerability ownership belongs in the graph, not a spreadsheet. Route each finding to the team that can fix it and close it on scan evidence.
- [What is ASPM? Application security posture management](https://securityvault.io/blog/what-is-aspm-application-security-posture-management): ASPM connects scanner findings with code and deployment context, helping engineering, security and compliance teams prioritise and review remediation.

## Glossary

- [Glossary](https://securityvault.io/glossary): Definitions of ASPM, SAST, SCA, SBOM, CSPM, CIEM, KSPM, policy as code and shared evidence concepts.

## Company

- [About](https://securityvault.io/about): SecurityVault Systems Private Limited (India) and what it builds.
- [Trust](https://securityvault.io/trust): What is true right now: hosting, subprocessors, DPA.
- [Security](https://securityvault.io/security): How the platform is secured: scanner isolation, tenancy, cryptography, disclosure.
- [Responsible disclosure](https://securityvault.io/disclosure): Coordinated vulnerability disclosure programme.
- [Contact](https://securityvault.io/contact): Request a demo with a solutions engineer.
- [Design partners](https://securityvault.io/customers): The design-partner programme: engineering access, priorities and commercial discussions.
- [Partners](https://securityvault.io/partners): Technology, delivery and reseller partner tracks.
- [Careers](https://securityvault.io/careers): Mission, the work and how we hire.
- [Press](https://securityvault.io/press): Fact sheet, boilerplate and media kit.
- [Status](https://securityvault.io/status): Browser-based checks of the website, console and API; unavailable checks remain unknown.

## Product screenshots

- [Screenshot: Security entity graph](https://securityvault.io/assets/product/securityvault-console-security-entity-graph.png): Projected entities and their relationships, coloured by toxic-combination score. Any node opens its Entity360 profile. Console screenshot from SecurityVault's development tenant, 2026-11-01, 1280×720 PNG; counts are development data.
- [Screenshot: Findings](https://securityvault.io/assets/product/securityvault-console-findings.png): Correlated risk stories across every scanner, with deduplicated critical and high counts and a plain-English filter. Console screenshot from SecurityVault's development tenant, 2026-11-01, 1280×720 PNG; counts are development data.
- [Screenshot: Image Security](https://securityvault.io/assets/product/securityvault-console-image-security.png): Container inventory with signature, attestation and scan status, and the verified, untrusted and awaiting-verification trust bands. Console screenshot from SecurityVault's development tenant, 2026-11-01, 1280×720 PNG; counts are development data.

## Optional

- [Resources](https://securityvault.io/resources): Docs, architecture, guides, comparisons and the glossary in one place.
- [Changelog](https://securityvault.io/changelog): What shipped, by month.
- [Roadmap](https://securityvault.io/roadmap): Themes we are building next; no ship dates.
- [Field notes](https://securityvault.io/field-notes): Engineering decisions and why.
- [Subprocessors](https://securityvault.io/subprocessors): Canonical subprocessor list.
- [Privacy](https://securityvault.io/privacy): Privacy notice.
- [Privacy request](https://securityvault.io/privacy-request): Exercise data-protection rights or raise a grievance.
- [Terms](https://securityvault.io/terms): Terms of service.
- [Blog RSS feed](https://securityvault.io/rss.xml): Feed of all blog posts.
- [llms-full.txt](https://securityvault.io/llms-full.txt): Full text of the blog posts and docs summaries in one file.