About Vulnetix: the team behind Software Factory

Our mission

We think the tools a team runs should start from correct vulnerability records, and that the fix for bad data has to be built in the open.

The longer answer is about data. Vulnerability records got worse, every security tool is downstream of them, and a fix is only as good as the record it starts from.

Read the full mission

Open standards: CycloneDX, SPDX, SARIF, OpenVEX and STIX in and out, and an IETF draft for cloud resources.
People approve: Agents do the work, and a person approves the changes that matter.
Free means free: The Community tier does not expire, and the code scanner is AGPL-3.0.

What we are building toward

A queue only people can empty

We want every finding to arrive with an owner, the evidence behind it and a pull request that has already passed its gates, so people spend their time on decisions.

Software Factory

Findings, issues and failing builds go through decision steps, 31 built-in agents and quality gates that are plain rules. A person approves the changes that matter, and each run keeps its trace and evidence. How Software Factory works

Who builds it

Founded by Christopher Langton and Sean Marshall.

Our story

Vulnetix started from security teams buried in vulnerability alerts and manual reporting, with little time left for proactive work.

Before starting Vulnetix, the founders built internal versions of it for 4 enterprise companies and government organisations.

Christopher Langton (CISO and CTO) has spent 20+ years in enterprise security and holds a NSW Government Innovation Award. Sean Marshall (CEO) is an exited founder who has been building products for just as long.