Duplicates by tool
The same CVE in the same package shows up once per scanner and once per branch. Counting it is not triage.
From scanner output
to a fix that ships.
One issue, one logical finding, whatever produced it. Ranked by whether it is reachable and exposed, routed through the graph to the team that owns the code, and closed when a later scan no longer sees it.
1
Logical finding per issue
Corroborating tool results become edges, not duplicate rows.
12
Languages, native taint
Plus the per-language open-source tools, launched automatically.
3
Reachability verdicts
reachable · not_reachable · unknown, with the call path.
0
AI status writes
Disposition is human-only with a reason code.
The problem
Why vulnerability management stalls.
Five tools, five severities, five queues, and nobody can say which of the thousand criticals is on the internet.
01
02
Severity without context
CVSS says how bad in the abstract; it cannot say whether the function is called or the workload is exposed.
03
Ownership by spreadsheet
Routing depends on a mapping somebody maintains by hand, so findings wait in a shared queue.
04
Closure by status flip
Findings are closed because someone said so, not because a scan proved it.
05
Fixes with no lineage
The fix merges, but nobody knows which images still carry the old package or where they run.
06
AI that rewrites verdicts
Automated triage that changes status silently destroys the audit trail.
How SecurityVault does it
One queue with edges, not five lists.
Ingest
Native engine plus semgrep, gitleaks, checkov, syft, grype and the per-language tools run in one scan. Imported findings from Wiz, Prisma, Tenable and Rapid7 resolve into the same ontology.
Resolve
Observations match existing findings by alias with a fixed precedence; agreement becomes a
corroborates edge. One issue, one logical finding.Rank
Risk model v1 scores from severity, exploit likelihood, reachability hint, exposure and business context, with an explanation object per score. Blast radius counts workloads and ingresses, not sibling findings.
Route
The owning team comes from
owns edges on the repository or resource. PR comments and tickets carry the evidence, the reachability path and the remediation template.Fix
Advisory fix pull requests from deterministic templates; remediation cases with rollout stages and simulation for larger changes.
Close
A finding closes when a later scan no longer observes it. Human verdicts carry forward verbatim to successor findings. Nobody, and no model, flips status by hand.
What it rests on
The platform underneath.
Orchestration
Auto tool plan
Point at a repository; the plan builds itself from detected languages.
Native engine
appsec-unified
Taint analysis, SCA with reachability, IaC, secrets, API, DAST, supply chain.
Ontology
Lineage and blast radius
Repository → Commit → Build → Image → Registry → Workload → Ingress.
Governance
Human-only disposition
Reason codes, ORM guard, database trigger.
Integrations
Tickets and PRs
Jira, ServiceNow, Linear, GitHub, GitLab, Azure DevOps.
Trust band
Hostile scanners
No platform credentials in a scan pod.
See it on your stack
Bring one repository. Leave with a ranked queue.
A 30-minute session: one scan, one logical finding per issue, one lineage view, on your code.