Native scanners
Sentrasec detects across source, dependencies, infrastructure, containers, cloud accounts, clusters and running applications, and reports it all into a single, deduplicated finding set.
The scanners are the product, not wrappers around third-party tools. One finding model, one severity scale, and no reconciling outputs from tools with their own formats and their own idea of what counts as a duplicate.
Every scanner implements the same interface, so a scan runs each applicable engine in one pass and new detection surfaces arrive without changing how you deploy.
Where the language permits it, source is parsed into a syntax tree and analysed structurally. A finding points at a code path that exists rather than a string that matched.
Rules carry their relationships: the CWE they map to, the OWASP category above it, the fixes known to resolve it. That is what lets a finding explain itself.
Everything listed here ships today. Nothing on this page is a roadmap item.
Semantic static analysis that understands code structure, not regular expressions.
Source is analysed structurally rather than matched as text, so a finding is anchored to a real code path. Detection rules are versioned and stay current automatically, including in fully disconnected deployments.
Pattern and entropy detection for credentials committed to source control.
Covers the common cloud and SaaS credential formats, with entropy analysis for keys that do not match a known shape. Runs fully offline, so no candidate secret leaves the machine.
Dependency analysis resolved against known vulnerability data.
Your real resolved dependency tree is analysed, including transitive packages. Disconnected deployments resolve against bundled vulnerability data; connected deployments enrich against the full corpus with knowledge-graph context.
Infrastructure definitions checked before they ever reach an account.
Covers Terraform, Kubernetes manifests, Dockerfiles, Helm charts, Bicep and Pulumi with structural analysis, so misconfiguration is caught at review time rather than in production.
Image layer analysis and build hygiene.
Each image layer is inspected for vulnerable operating-system and language packages, alongside hygiene problems in the build itself: root execution, embedded secrets, unpinned base images.
Active testing against a running application.
The running target is crawled, its surfaces exercised, and what actually responded is reported. Findings are deduplicated and enriched with business impact before they reach you.
Object-level authorization testing and schema drift detection.
BOLA testing exercises object references across privilege boundaries to find the authorization gaps that static analysis cannot see, while drift detection compares live behaviour against the declared schema.
Observing how workloads actually behave in production.
Process execution, system activity and network behaviour are observed in running workloads, so a finding can be qualified by whether the vulnerable path is actually reached at runtime.
Cloud posture checks across AWS, Azure and GCP.
Reads live cloud configuration through provider APIs and evaluates it against posture checks, giving deployed-account state rather than the intent expressed in code.
Kubernetes posture auditing against CIS benchmarks.
Live cluster state is audited against the CIS Kubernetes benchmark, covering workload security context, RBAC and network policy.
Control evidence generated from scan results.
Maps findings and scan history onto SOC 2, PCI DSS, HIPAA and ISO 27001 control sets, producing evidence that traces back to the scan that produced it instead of a screenshot in a folder.
Attack chain synthesis across individual findings.
Composes individual findings into plausible attack chains using knowledge-graph relationships, showing how low-severity issues combine into a path that matters.
Install the CLI and run a scan against your own code.
