TRUSTIVAN AppSec
Four parts, one record
TRUSTIVAN scans container images, then keeps everything that happens to what it finds. Each part below is built so the next one can be trusted.
This is TRUSTIVAN AppSec. The second part of TRUSTIVAN, for service accounts, workload identities and AI agents' actions, isTRUSTIVAN NHI Security.
Platform capabilities
Container scanning
Images pulled from public registries, or from private ones with a stored credential, and analysed for known vulnerabilities — a durable job that survives a worker restart. No Docker socket, no agent installed on your hosts, no access to your build host.
Finding lifecycle
Five states, an exhaustively tested transition table, and an append-only timeline that records whether a person, a scan or a credential caused each change.
Policy and verdicts
A declarative rule set — not a language — evaluated as a pure function, producing a recorded verdict that explains itself rule by rule.
Machine API
Scoped, expiring credentials; signed cursors with a stated traversal guarantee; durable idempotency; bulk triage; signed and retried webhooks.
Scope, stated plainly
What TRUSTIVAN scans — and what it does not
A security tool that is vague about its coverage is worse than one with narrow coverage. This is the whole of it.
Supported today
- Container images, for known vulnerabilities
- Public registries, pulled remotely — and private ones, with a stored credential (Pro and Enterprise)
- Git repositories, named by URL, against an allow-listed host
- Filesystem paths and SBOM documents, inside directories the operator permits
- Scheduled rescans — hourly, daily or weekly
- Policy evaluation and recorded verdicts
- SBOM export and import, in CycloneDX 1.5 and SPDX 2.3
- Licence inventory across the estate, derived from what the scan already found
- Compliance evidence mapping — SOC 2, ISO 27001, PCI DSS 4.0, NIST SSDF, EU CRA
- Audit export, hash-chained so an auditor can verify it without trusting us
- Known-exploited enrichment and risk-ordered findings, where a KEV catalogue is configured
- An agent control plane — declared tools, bounded sessions, per-action authorization and reversible quarantine
- Webhooks for scans, verdicts and finding state changes
- SAML and OIDC single sign-on, and SCIM directory provisioning
- Plan limits the software enforces, on three real tiers
Several of these are API surfaces before they are screens. Where that is so, the API reference says which, rather than the capability going unmentioned.
Not available
- Infrastructure-as-code and Kubernetes scanning
- Reachability analysis — no determination of whether vulnerable code is reachable
- Third-party attestation — evidence is mapped to controls, but TRUSTIVAN holds no SOC 2 report or ISO certificate
- Pull-request scanning and push-triggered scans
- Mail delivery — an invitation issues a token, and sending it is yours to do
- Self-serve checkout — plans are enforced, but nothing can charge you
Listed because an evaluation that discovers these later has wasted your time. See the FAQ for the current boundary.
Start with one image
The quickstart ends with a verdict your pipeline can branch on.