Findings
Everything wrong with what you build, in an order you can work down.
The problem
A first scan produces hundreds of findings and no way to tell which of them matters. Most teams triage for a week, lose interest, and never open the tool again.
How it works
- Every finding is scored on what it would actually take to exploit — whether the vulnerable code is reachable, what the system holds, and how exposed it is — rather than on a severity a scanner assigned without knowing any of that.
- Duplicates across scanners are merged by fingerprint, so one problem found three ways is one row.
- Confidence is stated, and stated as low when it is low. A finding we are unsure about says so instead of being marked High to be safe.
- A rule you write once can triage the rest, and every automatic decision names the rule that made it.
What it does not do
It finds problems in code, dependencies, infrastructure definitions, running applications and cloud configuration. It does not watch your endpoints, your network or your email.