SigmaSec
Loading SigmaSec workspace
SigmaSec
Loading SigmaSec workspace
Enterprise Early Access · Continuous Exposure Management
SigmaSec runs Nuclei, Trivy, Gitleaks, Opengrep, and Nmap against your code and infrastructure, then ranks what they find — matching each CVE against CISA KEV and EPSS, checking whether the vulnerable dependency is used in your code, and explaining each finding in plain English before an engineer ever sees it.
Illustrative example — every mark is one finding
Five engines run across code, dependencies, containers, secrets and endpoints.
Critical or high once scored against KEV, EPSS and CVSS together.
The vulnerable dependency is imported and called in your code.
On CISA KEV or likely to be exploited (EPSS), and used in your code.
Dependency upgrades opened as pull requests, ready for review.
Select a confirmed finding to read it.
Raw scanner output is the first bar. The work starts at the last one.
Coverage
We consume best-in-class open source rather than rewriting it. The value is in what happens after the output lands: one finding model, one deduplication pass, one ranked queue.
| Engine | Reads | Feeds | Status |
|---|---|---|---|
| Trivy | Lockfiles, manifests, container image layers | Vulnerable dependencies and image packages | Live |
| Gitleaks | Last 50 commits of the default branch | Secrets queue (masked; raw values never stored) | Live |
| Nuclei | Deployed web and network surface | Internet-facing exposure map | Live |
| Opengrep | Your own source code | Code-level (SAST) findings | Live |
| Nmap | Ports and service banners | Asset inventory | Live |
The output
A CVE identifier and a severity label tell an engineer almost nothing about what to do next. Every finding that reaches your queue arrives with the reasoning behind its rank and the specific fix — and, for dependency upgrades, a pull request ready to review.
This is what your team reads at nine in the morning — not a spreadsheet export.
This SSH server still offers diffie-hellman-group1-sha1, a 1024-bit key exchange that is considered breakable. An attacker who can sit between client and server could force a weak session. Detected by a Nuclei template against api-internal-22.
Remediation: remove diffie-hellman-group1-sha1 from /etc/ssh/sshd_config and restart. Check that no legacy clients still depend on it before rolling out.
Where the work actually goes
Aggregating scanners is easy, and most tools stop there. Deciding which findings deserve an engineer is the hard part.
01 / MEASURE
Web endpoints, container images, dependencies, committed secrets and application code all resolve to a single finding shape, coordinated in one run. A finding seen again in a later scan stays one record instead of stacking up in your queue.
02 / DECIDE
Severity tells you a vulnerability could exist. We add whether it is known to be exploited, how likely exploitation is, and whether the vulnerable dependency is used in your code. Findings that score high on those rise to the top of the queue.
03 / EXPLAIN
Not a summary of the CVE description. A plain-English explanation of the risk in your context and the specific remediation — and, for dependency upgrades, a pull request you can review and merge.
Data handling
Every security team asks the same first question about an AI product: where does my code go? Here is the complete answer, in the order it usually gets asked.
| Question | Answer | Status |
|---|---|---|
| Where does scanning run? | Self-host the full stack with Docker Compose and scanning runs on your infrastructure — your code never leaves it. On our hosted service, repositories are cloned into scan workers for the duration of a scan. Private-VPC Terraform modules are on the roadmap. | Self-host today |
| Do you train on our data? | No. SigmaSec doesn't train models on customer data. AI explanations can run on a local model (Ollama) so nothing leaves your deployment, or on Claude via Anthropic's API under its commercial terms. | Your choice |
| Where is metadata stored? | Self-hosted: wherever you run it, including Indian cloud regions for DPDP Act 2023 obligations. Hosted: ask us for the current hosting region. | Ask us |
| Are you SOC 2 audited? | Not yet. Audit logging and role-based access control are in place. We will not claim certification before we hold it. | Not yet |
Read the privacy policy — or contact us for architecture and subprocessor details.
Who is building this
We are pre-launch and building in the open. If you are evaluating us, talk to us directly.
Security, applied cryptography and AI engineering, with hands-on work in post-quantum TLS and embedded systems.
15+ years building frontends and products for banking, SaaS and AI teams.
A small number of security teams are shaping the roadmap with us. Named logos appear here only once partners agree to be named.
Private beta
You get a scoped scan of one repository, the prioritised queue it produces, and a walkthrough of how every finding in it was ranked. No credit card, no automated drip sequence.
We reply within two business days with a scheduling link.