Integrate Arnica with Vulnetix. Use the Arnica API to export SAST and SCA findings from your repositories, then upload to Vulnetix for consolidated vulnerability management.
Run Arnica in CI
Scan on every push and upload the report as a workflow artifact:
- name: Export Arnica findings
env:
ARNICA_TOKEN: ${{ secrets.ARNICA_TOKEN }}
ARNICA_ORG: ${{ secrets.ARNICA_ORG_ID }}
run: |
curl -s "https://api.arnica.io/v1/findings?orgId=$ARNICA_ORG&severity=critical,high" -H "Authorization: Bearer $ARNICA_TOKEN" | jq '.findings' > arnica-findings.json
- name: Upload to Vulnetix
run: vulnetix upload --file arnica-findings.json
How Vulnetix compares: better together
Vulnetix does not replace Arnica. Keep running it. Vulnetix sits on top of Arnica (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Arnica is strongest at its core category and also carries features in SCA, Secret Scanning, IaC & Cloud Configuration, License Compliance, SBOM Generation, just as Vulnetix spans categories.
| Capability | Vulnetix | Arnica |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✓ Real-time SAST on source-code pushes across supported SCMs |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✓ Third-party dependency scanning with default reachability guidance |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✓ IaC misconfiguration scanning as part of code-risk coverage |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✓ Real-time hardcoded-secret detection and mitigation |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ~ Flags open-source license violations across the org |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ~ Catalogues 100% of OSS libraries; SBOM/inventory visualisation |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ~ Positioned as an ASPM platform unifying SAST/SCA/secrets/IaC findings; SCM-native rather than broad third-party-scanner ingest |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ~ Prioritises with CVSS + EPSS + KEV plus org context |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ~ SCA reachability applied by default to filter unreachable alerts |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ~ One-click fix or auto-generated remediation pull requests |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Arnica does well
- Pipelineless architecture: connects directly to GitHub/GitLab/Azure DevOps and scans on push in real time without modifying CI/CD pipelines
- Developer-centric workflow that auto-assigns findings to the committing developer and posts fix suggestions as PR comments with one-click apply or auto-generated fix PRs
- SCA reachability analysis applied by default, with function-level analysis across direct and transitive dependencies, to cut alerts down to those an attacker can truly reach
- Rich contextual prioritisation combining OWASP Top 10, CVSS, EPSS and KEV with per-PR policies on severity, direct-vs-transitive and prod-vs-dev deps
Where Vulnetix adds to it: Arnica and Vulnetix overlap heavily as developer-facing ASPM (both do SAST/SCA/secrets/IaC, reachability, EPSS/KEV, PR fixes). Vulnetix differentiates on scanner breadth beyond SCM-native code (container, cloud/CSPM, malware + install-time package firewall across 25+ registries, SBOM generation in CycloneDX 1.7 + SPDX 2.3) and on governance depth: cross-scanner dedup that also ingests third-party scanner output, immutable versioned VEX + audit, EOL policy, SSVC, and a broader exploit-intel blend (adds Coalition ESS, CWSS, Vulnetix LEV). Better together: Vulnetix can consolidate Arnica's findings into its unified prioritised queue.
No migration, no rip-and-replace. Arnica keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Arnica results in Vulnetix
Upload Arnica JSON, SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.