About
Built by security engineers.
Sentrasec started from a specific frustration: the tools were finding plenty, and the humans were still doing all the understanding.
The position
Application security has no shortage of detection. Between static analysis, dependency scanning, secrets detection, infrastructure checks and cloud posture tools, most organisations have more findings than they can process.
What they do not have is a way to understand them together. Each tool reports in its own format, on its own severity scale, with no knowledge of the others and no model of the environment the code runs in. Reconciling that is manual work, and it consumes the people who should be making judgement calls.
We think the answer is a reasoning layer: Sentrasec's own scans and imported findings in one consistent model, triage that decides from evidence in your project, and a knowledge graph that holds the relationships between rules, weaknesses, vulnerabilities and remediations.
Detection is a solved problem. Understanding is the one worth working on.
Why now
Teams now build products at the speed of their coding agents. What has not sped up is the answer to the question every buyer eventually asks: is this product secure, and is it compliant?
That question is usually answered at the end, by a scan or an audit that arrives when the product is already built. Sentrasec answers it during development instead, at every commit, for new products and for the legacy applications they sit beside, and keeps answering it after release as the world around them changes.
Who is building it
Chetan Dhandal
Co-founder
AI architect specialising in production AI systems, LLM infrastructure and engineering leadership. He builds and advises engineering teams on shipping AI systems that hold up in production, and started Sentrasec to give teams moving at that speed a way to know their product is secure and compliant before it reaches the market.
How we build
The finding is not the product
Producing a list of issues is the easy part, and the industry has been good at it for twenty years. What is missing is everything that turns a list into a decision: context, reachability, evidence and the reasoning that connects them.
One finding model
Sentrasec runs its own scans and imports findings from the scanners teams already own. Both land in one model, on one severity scale, with one deduplication pass, so nobody has to reconcile formats by hand.
Open where it counts
The open-source deployment is public, so you can read the code and check what it does with your source. Trust in a security tool should be checkable rather than asserted.
Self-hosting is a real option
Plenty of organisations cannot send code or findings anywhere. Sentrasec can run inside your own environment, so your code and findings stay there.
Decisions keep their evidence
Triage is deterministic: each remediate-or-defer decision is made from evidence in your project and keeps that evidence. A language model writes only the explanation. Sentrasec writes the remediation plan and test plan; your coding agent makes the change and a person reviews it.
Read the code
The open-source Sentrasec deployment is on GitHub.