Application Vulnerability Assessment

Know exactly what's in your code — and what's at risk.

Name: SOCFortress Application Vulnerability Assessment
Brand: SOCFortress
Availability: InStock

AppVa scans every dependency in your repositories and container images, generates a complete Software Bill of Materials, and maps each component against live CVE databases — so you can fix real risks before they become breaches.

Request access Request access See features See features

Source types

Three ways in, one repository view

GitHub repositories, source archives, and container images all appear in the same repository management interface.

GitHub repositories

Connected over HTTPS, with optional branch targeting and personal access tokens.

HTTPS connection

Branch targeting

Personal access tokens

ZIP archives

Upload an archive of any source code and scan it exactly like a connected repository.

Any source code

Direct upload

Same scan pipeline

Docker images

Specified by name or loaded from .tar and .tar.gz archives, scanned layer by layer.

Image by name

.tar / .tar.gz

Full image inventory

Platform features

Full-spectrum dependency intelligence, from code to container

SBOM Generation
Powered by Syft, AppVa produces a complete Software Bill of Materials for every repository and image — cataloguing all open-source libraries, transitive dependencies, and their exact versions.
CVE Vulnerability Scanning
Grype cross-references every component in your SBOM against live CVE databases, surfacing exploitable vulnerabilities with CVSS scores and affected version ranges so you know exactly what to patch.
Multi-Source Repository Support
Connect GitHub repositories via HTTPS with optional branch selection and access tokens, upload ZIP archives of source code, or scan Docker images and .tar archives — all from a single interface.
Dashboard & Analytics
Aggregate statistics across all repositories: vulnerability severity distribution charts, top vulnerable packages, license distribution analysis, and trend views to track your security posture over time.
Scheduled Scanning
Define cron-based scan schedules per repository with 30-second check intervals. Pause and resume schedules without deletion — maintain continuous coverage without manual intervention.
Notification Channels
Receive automated scan summaries via Slack, Microsoft Teams, or any webhook endpoint. Multiple channels per repository, with add, edit, test, and enable/disable controls for each integration.
PDF Reporting
Export full scan results as PDF reports including CVE IDs, affected packages, CVSS scores, and SBOM component lists — ready for audits, compliance reviews, or executive briefings.
Role-Based Access & 2FA
TOTP two-factor authentication at login and admin-controlled reset capability. Three permission levels — viewer, operator, and admin — ensure the right people have the right access to scan data and configuration.