Application Security Portal
Collect the findings of all your security scanners in one place, triage them and track the risk they leave.
Updated
Application Security Portal collects the results of your security scanners, removes duplicates and false positives, and shows what is left to fix, in which product and by when.
How it fits together
- Products are what your teams build and own: an application, a service, a website. Each product has a business criticality, which weighs its findings in the risk metrics.
- Assets are the parts of a product that get scanned: a repository, a Docker image, a domain, a host or a cloud account.
- Findings are the vulnerabilities that scanners report on assets. Most come from audits: Auditor runs the scanners on your assets and sends the results back. Reports from your own pipelines and uploaded files come in too.
- Triage moves each finding through its statuses: it arrives Unverified, a security engineer verifies or rejects it, and it ends Resolved or with its risk accepted. Rules can do most of this automatically.
- Metrics show the risk that remains per product and over time, and whether findings are fixed within their SLA.
Where to start
| If you want to | Read |
|---|---|
| Install AppSec Portal | Install |
| Set it up after installing | First steps |
| Scan for vulnerabilities | Find vulnerabilities |
| Work through findings | Triage findings |
| Report on risk | Track risk |