Live · Application Security Add-on

Scanner noise in. The findings that matter out.

V/ergent AppSec ingests findings from every scanner you already run — Semgrep, Trivy, CodeQL, Gitleaks, Checkov, ZAP — enriches them with live exploit intelligence, auto-triages the false positives, and surfaces the handful that genuinely matter. One audit trail, one policy engine, one pull-request workflow.

6+ Scanner formats
EPSS + KEV Live exploit intel
194 SoD rules inside V/ergent
appsec.vergent.co.ke — findings
100
Log4Shell RCE via JNDI lookup KEV TP
trivy · CVE-2021-44228 · pom.xml:47
90
subprocess with shell=True on user input TP
semgrep · python.command-injection · app/runner.py:42
70
SQL injection via f-string in text()
semgrep · sqlalchemy.raw-sql · app/db.py:57
40
certifi vulnerable root CA bundle
trivy · CVE-2023-37920 · requirements.txt:12
6
Imported module unused (unreachable)
semgrep · unused-import · tests/fixtures.py:3

The bit between scanner output and a reviewer’s attention.

Commercial ASPM platforms charge six figures for this plumbing. V/ergent bundles it with the rest of your audit — one contract, one login, one source of truth.

One ingest for every scanner

SARIF in — Semgrep, Trivy, CodeQL, Gitleaks, Checkov, ZAP, anything that speaks the spec. Findings are normalised into a single schema and deduped across runs.

Live exploit intelligence

Every finding gets scored against CISA’s Known Exploited Vulnerabilities list and first.org’s EPSS exploit probability feed. Unreachable code drops down the priority list automatically.

Automated triage

Each finding is classified as a true positive, false positive, or needs-review, with reasoning and a concrete fix suggestion. Verdicts are cached across tenants on the code pattern — the same rule never gets re-triaged from scratch.

Risk-scored prioritisation

Severity, exploit probability, KEV status and reachability combine into one 0–100 score. Ten thousand raw findings become the thirty-seven that genuinely matter this sprint.

Pull-request comments

When a scan is tied to a pull request, the real findings land as inline review comments via a GitHub App. Confident false positives are filtered out so reviewers aren’t spammed.

Merge-gate policy

Declarative rules block KEV-listed true positives, cap the number of highs, require sign-off on anything critical. Failing closed on unknown conditions — a typo in the policy never silently green-lights a finding.

Point your pipeline at us. That’s the whole integration.

Every data endpoint accepts the same V/ergent single sign-on token used by CyberCore. No second identity plane, no duplicate user management.

POST /ingest/sarif — SARIF + repo + optional PR → queued for triage GET /findings — org-scoped list, sorted by risk score POST /policy/evaluate — YAML/JSON rules → allow/deny decision GET /health — liveness (unauthenticated)
🧭
Looking for the findings dashboard? AppSec lives behind V/ergent’s auth — open V/ergent or CyberCore first and follow the AppSec link from there. Direct access with a V/ergent token also works.
Open V/ergent