Integrate Deepfence ThreatMapper with Vulnetix. Deploy ThreatMapper to scan containers, Kubernetes, VMs, and serverless for vulnerabilities. Export JSON findings for upload to Vulnetix.
Install & scan
$ # Deploy ThreatMapper management console
wget https://github.com/deepfence/ThreatMapper/raw/release-2.5/deployment-scripts/docker-compose.yml
docker compose -f docker-compose.yml up --detach
# Console accessible at https://localhost after ~5 minutes
$ # Authenticate to ThreatMapper REST API
TOKEN=$(curl -s -X POST https://localhost/deepfence/api/v2/auth/token -H "Content-Type: application/json" -d '{"api_token":"your_api_key"}' | jq -r '.access_token')
# Start vulnerability scan
curl -s -X POST https://localhost/deepfence/api/v2/scan/start -H "Authorization: Bearer ${TOKEN}" -H "Content-Type: application/json" -d '{"scan_type":"VulnerabilityScan","node_ids":[{"node_id":"node-id","node_type":"container_image"}]}'
How Vulnetix compares: better together
Vulnetix does not replace Deepfence. Keep running it. Vulnetix sits on top of Deepfence (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Deepfence is strongest at its core category and also carries features in SCA, Secret Scanning, Cloud Security & CSPM, SBOM Generation, IaC & Cloud Configuration, Network & Vulnerability Scanners, just as Vulnetix spans categories.
| Capability | Vulnetix | Deepfence |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✓ Runtime SBOMs matched against multiple vulnerability feeds to find vulnerable dependencies |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✓ Scans container images and running containers across clouds and k8s |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ~ Compliance/misconfiguration posture checks on infrastructure configuration |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✓ SecretScanner matches filesystems/images against ~140 secret types |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✓ Evaluates cloud/infra config against CIS, PCI-DSS, HIPAA and other benchmarks (CSPM/compliance) |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✓ Generates runtime SBOMs from running workloads, apps and OS |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✓ Cloud-native YARA-based malware scanner (YaraHunter) for images, running containers and filesystems |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ~ Network topology/threat-graph visualisation of workloads and flows (not an infra vuln scanner) |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ~ Ranks threats by risk-of-exploit, CVSS and attack-surface proximity; no published EPSS/KEV feed integration |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ~ Runtime network-flow reachability via ThreatGraph (network-path, not code-level reachability) |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Deepfence does well
- Genuinely broad open-source CNAPP: one platform does runtime SBOM generation, vulnerability matching, YARA-based malware scanning (YaraHunter), ~140 secret types (SecretScanner), and cloud/compliance benchmarks (CIS, PCI-DSS, HIPAA) across VMs, containers, Kubernetes and serverless
- ThreatGraph uses live runtime network-flow context to shrink thousands of alerts to the few with real attack-path proximity
- Runtime-first: generates SBOMs from actually-running pods/containers/apps rather than only from static manifests
- Fully open source (ThreatMapper) with a self-hostable management console, no per-scan licensing
Where Vulnetix adds to it: Vulnetix consolidates Deepfence output into one cross-scanner deduped queue and adds standardised exploit-intel (EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV), tree-sitter + CVEAffected code-level reachability, immutable versioned VEX with audit, Safe Harbour autofix, EOL and SSVC policy. Deepfence remains the runtime CNAPP sensor (including its network/ThreatGraph capability, which Vulnetix ingests but does not run itself); Vulnetix is the ASPM decision and remediation layer on top.
No migration, no rip-and-replace. Deepfence keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Deepfence results in Vulnetix
Upload Deepfence JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.