Move from noise and missed criticals to clear priorities and flow
Resolve's contextual prioritisation ties vulnerability data to your actual environment: what's deployed, what's reachable, and what the business depends on. Your team works on the right things first.
- Automated triage based on reachability and business context
- Unify findings from 218 documented security tools into one prioritised view
- Board-level reporting without the manual overhead
One platform, every AppSec category
Vulnetix Resolve is an Application Security Posture Management (ASPM) platform that also delivers Unified Vulnerability Management (UVM), Application Security Orchestration and Correlation (ASOC), Continuous Threat Exposure Management (CTEM) and Risk-Based Vulnerability Management (RBVM) in one place, on top of the DevSecOps scanning (SCA, SAST, secrets, IaC and container) you already run, so you retire the point tools instead of buying another dashboard to watch them.
Application Security Posture Management
One live view of application security posture across every repository, scanner and environment, with an owner and business context attached to each finding.
Unified Vulnerability Management
Every finding from every source deduplicated and normalised into one prioritised queue, instead of a separate backlog per tool.
Application Security Orchestration and Correlation
SARIF, SPDX and CycloneDX from more than 200 documented security tools, normalised against one schema. Overlapping results from four scanners collapse into a single decision with one owner.
Continuous Threat Exposure Management
Exposure is scoped and scored against reachability and live exploit intelligence, then re-validated as the intelligence moves. Remediation is tracked against your SLA, not ours.
Risk-Based Vulnerability Management
Rank open findings against an ordered risk strategy your organisation owns (malware, KEV, EPSS, Coalition ESS, CVSS, CWSS and custom scores), not raw vendor severity.
How It Works
1 · Unify
Bring your tools, workflows and data sources onto one platform. Connect the scanners you already run; nothing gets ripped out.
2 · Prioritise
Apply your business context and GRC frameworks. Set policies that reflect how your environment is actually built and what your auditors ask for.
3 · Automate
Take the grind out of the queue. Deduplication, triage and evidence capture run without a human. Every person opens the tool to a short list of things only they can decide.
4 · Report & Assure
Track performance, decisions and compliance. Board reporting and assessor evidence are byproducts of the daily work. Nothing is reconstructed at quarter end.
Products
Unified AppSec Platform
Enterprise AppSec teams and CISOs who need unified visibility and prioritisation across many tools.
Vulnerability Database
160 vulnerability databases, aggregated, normalised and enriched behind one API. Free community tier available.
Explore VDB →Software Composition Analysis
Track dependency and package vulnerabilities across 35+ ecosystems with multi-source severity scoring.
Learn more →AI Assistant
Context-aware remediation guidance for every finding. From CVE to actionable code change.
Learn more →Built to survive an enterprise estate
- Asset-first design: every vulnerability arrives already tied to an asset, an owner and its business context
- Contextual prioritisation: AI and decision trees that learn from your environment and past decisions
- Unified vuln control: one platform for all vulnerability data, regardless of source or tool
- Flexible data orchestration: connect any tool that exports SARIF, SPDX or CycloneDX
- The scan does not end with the pipeline: Vulnetix keeps re-scoring the dependencies already in your SBOM, so you hear about it the day a package you shipped last quarter turns exploitable
- Enterprise-ready architecture: runs on Cloudflare's edge network. Data residency and latency are handled before you ask
- Low-friction adoption: start in 15 minutes with no agents to install and no infrastructure to change
- Free & open by default: free VDB Community tier (no account), an AGPL-3.0 code scanner, an Apache-2.0 agent plugin, open OPA/Rego rule packs, free per-ecosystem STIX feeds, and a Package Firewall that's free for Go, pkg.go.dev and Arch/AUR
Each piece is useful alone. Together they close the loop.
The firewall refuses the malicious package. The CLI proves whether the vulnerable one is reachable. The VDB says whether anyone is exploiting it today. Pix writes the fix inside the editor. The monitor tells you when the answer changes. Every step writes a standard file that outlives us: CycloneDX, SPDX, SARIF, OpenVEX, STIX. Why we build it this way.
Prevention, not another finding
A scanner tells you the malicious package is installed. The Package Firewall means it never was. One policy engine sits in front of 24 registries and the pkg.go.dev API, from npm and PyPI through Debian and RPM to OCI images, Helm charts and Terraform modules. Blocked versions are filtered out of the packument, and a pinned block answers with a semantic status: 423 malware, 426 vulnerable, 425 cooldown, 428 bad actor. Set up the firewall.
Govern every LLM call without touching a client library
One gateway in front of OpenAI, Anthropic, Mistral, Groq and five more providers. Three wire surfaces are served, so OpenAI SDKs and LangChain (chat), Codex CLI (responses) and Anthropic SDKs, Claude Code and Claude Desktop (messages) all work with a base_url change and nothing else. Model allowlists, regex guardrails and PII redaction apply identically across all three. Provider keys are yours, held per organisation as KMS-encrypted ciphertext and decrypted just in time. No prompts logged. Explore the AI Firewall.
And govern what your agents can do, not just what they say
Every request a coding agent makes re-declares the tools it is offering the model, so the firewall can read them, refuse them, or strip one out and forward the rest. Tools, MCP servers, skills and the calling client each get allow and deny rules. Alongside them a runtime AI inventory records what your agents actually carry, per client, with dates: the MCP server a developer wired into a local config appears in no pull request and no repository scan, but it is in every request that agent makes. Metadata only, free on every plan. How agent governance works.
Is the vulnerable function ever called?
The Vulnetix CLI builds a call graph with tree-sitter and walks it from your entry points to the vulnerable symbol named in the advisory. A dependency you never call the affected code path of is a finding you can close with evidence rather than an argument. The surface is shown either way, including when the verdict is unreachable, so a reviewer can check the working.
Common Questions
Which Vulnetix product is right for me?
Vulnetix Resolve suits enterprise AppSec teams and CISOs. Vulnetix SCA is for engineering teams tracking dependencies. The VDB and free Community tier serve security researchers. Pix AI Assistant is for teams who want AI-powered remediation guidance at triage.
How is Vulnetix different from other AppSec platforms?
Most platforms only unify findings from their own scanners. Vulnetix ships none of its own. It ingests whatever you already run, which is why its tool coverage is the widest in the industry: 218 tools are individually documented, each with a page showing the exact format it emits and how Vulnetix reads it.
How long does it take to set up?
Most teams are up and running within 15 minutes: connect your GitHub org, set a starting policy, and unified vulnerability data begins to flow.
Who's the team behind it?
Vulnetix was founded by Christopher Langton (CISO/CTO) and Sean Marshall (CEO). Together they've built internal versions of Vulnetix for 4 enterprise companies and government organisations.