Less noise in the queue: rule-based detection with AI filtering false positives from code findings. Attack surface, web apps, APIs, networks, code, containers and cloud deduplicate into one record with ownership, SLA escalation and automatic mapping to nine compliance frameworks.
No credit card required · Read-only access · EU-hosted · Repository data deleted after each scan
Run attack surface, web app, API, network, code, container, Kubernetes and cloud checks in one place. If a check cannot run, Vornin shows the coverage gap instead of reporting a false clean result.
Repeat detections are fingerprinted and combined into one finding and lifecycle. Scheduled profiles run daily, weekly, or monthly in your organisation's timezone using a consistent configuration.
Daily external attack surface monitoring tracks new hosts, certificates, DNS records, and exposed services. High-value discoveries can queue a full scan, while emerging-threat checks show whether an actively exploited vulnerability affects your stack.
Web vulnerability scanner, authenticated scanning, API security, known vulnerability checks, WordPress scanner. OWASP Top 10 (DAST) coverage, REST and GraphQL checks, configurable crawling and authenticated scanning.
Subdomain discovery, takeover detection, port scanning, SSL/TLS analysis, DNS security. 45+ passive discovery sources, service and version detection, certificate and cipher checks, plus SPF, DKIM, DMARC, DNSSEC and CAA.
SAST, secret scanning, dependency scanning, licence review, runtime end-of-life detection. 1,000+ SAST rules across 12 languages. Dependency scanning ranks the packages your code imports. Secrets are masked, with opt-in live verification. Licence review flags packages whose licences need legal review. Runtime checks catch Node.js, Python and .NET versions that no longer get security fixes. AI reviews every code finding for false positives. CycloneDX SBOM output.
Container image scanning, Kubernetes posture, cloud security posture, infrastructure-as-code scanning. Image and cluster checks plus 600+ read-only posture checks per provider across AWS, Azure and Google Cloud.
Support for other scanner results: Import Nessus, OpenVAS, CSV, and JSON results into the same findings, evidence, and compliance workflow. Vornin normalises the imported results but does not run those scanners.
* Vornin internal testing, September 2026. All tools were run on the same data corpus and scored using the same method.
Vornin de-duplicates repeat detections, so each issue is tracked once across scans. Owner, SLA, discussion, scan evidence, and verification history stay together from detection to closure.
Scans record severity, fingerprint, affected host, URL, and supporting evidence for each finding.
Findings are ranked by a rule-based score that measures true exploitability: predictive and deterministic threat intelligence (EPSS, CISA KEV), public exploit code and reachability, weighed with severity, SLA urgency, compliance impact and age. Exploited, critical, overdue or confirmed-reachable findings are never deprioritised.
Each finding can be assigned an owner, with comments, deadlines, and escalations kept on a single timeline.
Rescans close findings automatically once an issue is fixed. You can also verify a fix manually for an individual finding.
Rank vulnerable packages by whether your code imports them, across JavaScript, TypeScript, Python, Go, Java and C#, so unused dependencies do not outrank live exploit paths. Development-only and transitive packages are flagged. Reachability weighting can be disabled if raw severity is wanted.
Business workspaces can set remediation deadlines by severity and automatically send escalation emails, webhooks, and owner notifications when SLAs are missed.
Comments, status changes, reassignments, and suppressions stay on one tamper-evident finding timeline, preserving who did what and when for audit.
AI writes plain-language context and fix guidance for every finding, reviews every code finding for false positives to reduce noise, and triages exploitability on request.
Each finding maps to relevant technical security controls. Every lifecycle event becomes part of a tamper-evident evidence chain that technical teams and auditors can verify independently.
a3f1…7e2c
8c4b…109a
d720…4ff1
05b7…cc31
f49e…6203
Each event hashes the previous link and its own payload. Rewriting an earlier event breaks every link that follows.
Export a complete, self-verifiable evidence pack for any finding. It includes the current finding state, full event and comment history, compliance mappings, supporting evidence, chain verification, and everything needed to independently reproduce that verification, the same evidence you would attach to a customer security questionnaire.
Export a single PDF covering every finding lifecycle and chain status in one audit record.
Generate an executive brief and technical report from every scan without manual reformatting. On Team and above, export findings as CSV, Static Analysis Results Interchange Format (SARIF) 2.1.0, or a CycloneDX software bill of materials (SBOM), and schedule PDF delivery. Business adds custom branding; Scale adds full white-label delivery.
Findings are automatically mapped to relevant technical security controls. Controls that scanners cannot test are clearly marked for manual attestation, never automatically counted as complete. Every export keeps the evidence connected to its control and source finding.
Start with one read-only scan. Keep every finding, fix, and proof together.
Read-only access · Working scan data deleted after each scan · EU-hosted
