About
Built by security engineers.
Sentrasec started from a specific frustration: the tools were finding plenty, and the humans were still doing all the understanding.
The position
Application security has no shortage of detection. Between static analysis, dependency scanning, secrets detection, infrastructure checks and cloud posture tools, most organisations have more findings than they can process.
What they do not have is a way to understand them together. Each tool reports in its own format, on its own severity scale, with no knowledge of the others and no model of the environment the code runs in. Reconciling that is manual work, and it consumes the people who should be making judgement calls.
We think the answer is a reasoning layer: native scanners producing one consistent finding model, and a knowledge graph that holds the relationships between rules, weaknesses, vulnerabilities, fixes and your actual environment.
Detection is a solved problem. Understanding is the one worth working on.
How we build
The finding is not the product
Producing a list of issues is the easy part, and the industry has been good at it for twenty years. What is missing is everything that turns a list into a decision: context, reachability, evidence and the reasoning that connects them.
Native beats orchestration
Wrapping other people’s scanners means inheriting their formats, their severity scales and their blind spots. Writing the scanners natively means one finding model, one deduplication pass and the ability to fix a false positive at the source.
Open where it counts
You can read every scanner, run it without an account, and verify what it does with your source. Trust in a security tool should be checkable rather than asserted.
Offline is a first-class mode
Plenty of organisations cannot send code or findings anywhere. Air-gapped operation is part of the architecture rather than a stripped-down edition, which is why the same binaries serve all three deployment modes.
Decisions stay human
The platform assembles context, proposes fixes and explains its reasoning with citations. Accepting a risk or downgrading a severity remains an action a person takes and signs their name to.
Read the code
The scanner engine, CLI, MCP server and API are open source.