diff --git a/README.md b/README.md index 83a473e2..eeaa4566 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@ > [!NOTE] -> **Shannon 3.0 is live:** deeper security code analysis, a rebuilt terminal experience, native CI/CD workflows, professional PDF reports, and SARIF—still fully open source, self-hosted, and bring-your-own-model. +> **[Shannon 3.0 is live](https://github.com/KeygraphHQ/shannon/discussions/439):** deeper security code analysis, more thoroughly vetted findings, a rebuilt CLI, native CI/CD, professional PDF reports, and SARIF.
@@ -17,6 +17,14 @@ It analyzes your source code, identifies attack paths, and executes real exploit **This repository is Shannon Open Source: the full agent, run locally from your command line.** +

Launch Shannon

+ +```bash +npx @keygraph/shannon@latest +``` + +The interactive launcher will guide you through setup and your first pentest. + --- Join Discord      Visit Keygraph.io @@ -69,19 +77,29 @@ Shannon analyzes your web application's source code to identify potential attack Shannon is the agent. This repository is Shannon Open Source, the standalone pentester you run yourself. The same Shannon also powers the [Keygraph platform](https://keygraph.io), Keygraph's commercial pentesting product. See [Editions](#editions) for how the two compare. -### Why Shannon Exists + +
+Why Shannon Exists Thanks to tools like Claude Code and Cursor, your team ships code non-stop. But your penetration test? That happens once a year. This creates a massive security gap. For the other 364 days, you could be unknowingly shipping vulnerabilities to production. Shannon closes that gap by providing on-demand, automated penetration testing that can run against every build or release. -### Why "Shannon"? +
+ + +
+Why "Shannon"? It's named after Claude Shannon, the father of information theory. At its core, pentesting is an information problem: every probe reduces uncertainty about a system's state. The best tools maximize the signal gained from every request, turning those bits of knowledge into an exploit path. Also, we wanted you to be able to say, "Hey Claude, run Shannon" to find all the security flaws in your vibe-coded app. -### Not a replacement for human pentesters +
+ + +
+Not a replacement for human pentesters Shannon is built to work alongside expert pentesters and red teamers, not replace them. Great pentesters understand the business, chain attacks in ways nobody anticipated, and bring years of judgment that current models can't match. @@ -89,11 +107,13 @@ Shannon solves a different problem: there is far more software to test than secu Shannon shifts pentesting left into the software development lifecycle (SDLC). Use it to run exploitation-backed tests against staging environments and releases at the cadence they actually ship, and save expert human time for the risks that need someone who knows the organization. +
+ ## Shannon in Action ![Shannon running an autonomous pentest](assets/Shannon3GIF.gif) -Penetration test reports from Shannon Open Source scanning Photoview 2.4.0. Read the [announcement][announcement] and the full [benchmark writeup][benchmark] for methodology, cost, and the comparison against Aikido and XBOW. +These reports are from Shannon Open Source scans of Photoview 2.4.0, one of the applications in Doyensec's comparison of Aikido and XBOW. We ran Shannon against the same application version and evaluated its results separately. Read the [Doyensec study](https://doyensec.com/resources/ComparingAIApplicationSecurityTestingPlatforms_Doyensec.pdf) and our [Shannon follow-up comparison](docs/shannon-xbow-aikido-benchmark.md) for the methodology, limitations, costs, and results. | Model | Report | SARIF | @@ -102,12 +122,6 @@ Penetration test reports from Shannon Open Source scanning Photoview 2.4.0. Read | Grok 4.6 | [View report](benchmark/photoview-grok-4-6.pdf) | [SARIF](benchmark/photoview-grok-4-6.sarif) | | Claude Opus 5 | [View report](benchmark/photoview-opus-5.pdf) | [SARIF](benchmark/photoview-opus-5.sarif) | -[announcement]: https://github.com/KeygraphHQ/shannon/discussions/439 -[benchmark]: docs/shannon-xbow-aikido-benchmark.md - - - - ## Quick Start @@ -151,17 +165,17 @@ For source builds, authenticated scans, provider-specific setup, and platform no ## Key Capabilities -- **No exploit, no report**: Shannon includes a vulnerability only after validating it with a working, reproducible proof of concept—eliminating the speculative warnings typical of scanners. -- **Advanced security code analysis**: Before it sends a single payload, Shannon reads the codebase and builds a picture of the application: architecture, trust boundaries, exposed interfaces, data flows, and the assets worth attacking. From there it opens targeted investigations and filters the candidates they turn up. What survives goes to the live pentesting agents. -- **Autonomous execution**: Shannon launches reconnaissance, vulnerability analysis, exploitation, and report generation from a single command. -- **Live terminal experience**: A rebuilt CLI makes scans easy to configure and shows agent progress and clean results without requiring operators to inspect the underlying orchestration logs. -- **Authenticated testing**: configuration files can describe login flows, test credentials, TOTP, email-based login flows, focus areas, and rules of engagement. -- **OWASP-focused coverage**: Shannon targets exploitable Injection, XSS, SSRF, Broken Authentication, and Broken Authorization issues. -- **Resumable workspaces**: Shannon can resume interrupted runs without re-running completed agents. -- **Native CI/CD integrations**: Run Shannon through the official GitHub Action or reusable GitLab CI/CD component. Preserve reports, SARIF, and logs as pipeline artifacts; publish findings into native security workflows; and gate releases only on vulnerabilities Shannon actually demonstrates. -- **Professional and machine-readable reports**: Shannon generates evidence-rich PDF and Markdown reports plus structured JSON and SARIF 2.1.0. SARIF is enabled by default on exploit-mode scans and can be disabled with `report.sarif: "false"`. -- **Bring your own key, provider-agnostic**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, and any endpoint speaking the Anthropic Messages API or the OpenAI Chat Completions or Responses API, including self-hosted models served through Ollama, vLLM, or LM Studio and gateways such as OpenRouter and LiteLLM. You supply the credentials and choose exactly where model traffic goes. Local and self-hosted models are supported. -- **Private by design**: Shannon runs inside your infrastructure and writes results to a local workspace. Model requests go straight to the provider or endpoint you configure, and they carry source and application context with them, so choose that endpoint deliberately. Point Shannon at a local model endpoint and nothing leaves your environment. +- **No exploit, no report**: Reports only vulnerabilities confirmed with a reproducible proof of concept, reducing speculative scanner noise. +- **Advanced code analysis**: Maps architecture, trust boundaries, interfaces, data flows, and critical assets before sending credible attack paths to live pentesting agents. +- **Autonomous execution**: Runs reconnaissance, analysis, exploitation, and reporting from a single command. +- **Live terminal experience**: Simplifies scan setup and shows agent progress and results without exposing orchestration logs. +- **Authenticated testing**: Supports credentials, login flows, TOTP, email authentication, focus areas, and rules of engagement through configuration. +- **OWASP-focused coverage**: Tests for exploitable injection, XSS, SSRF, broken authentication, and broken authorization. +- **Resumable workspaces**: Resumes interrupted scans without repeating completed work. +- **Native CI/CD integrations**: Runs through the official GitHub Action or GitLab CI/CD component, preserves artifacts, publishes findings, and gates releases on proven vulnerabilities. +- **Multi-format reports**: Produces evidence-rich PDF and Markdown reports plus JSON and SARIF 2.1.0. SARIF is enabled by default for exploit-mode scans. +- **Provider agnostic and BYOK**: Supports Anthropic, OpenAI, xAI, AWS Bedrock, compatible APIs and gateways, and local models served through Ollama, vLLM, or LM Studio. +- **Private by design**: Runs in your infrastructure, stores results locally, and sends model requests directly to your chosen endpoint. A local endpoint keeps data inside your environment. @@ -220,24 +234,11 @@ See the [Shannon GitHub Action documentation](https://github.com/KeygraphHQ/shan ## Editions -**Shannon Open Source** is the complete autonomous pentester for developers and security teams. It is optimized for fast local and CI/CD runs: understand the application, execute real attacks, and report only proven vulnerabilities. +**Shannon Open Source** is a complete autonomous pentester, especially well suited to individual developers and small teams running focused security tests locally or in CI/CD. -**Keygraph Enterprise Platform** turns Shannon's proof engine into an organization-wide AppSec program, adding exhaustive analysis, centralized vulnerability management, automated remediation, enterprise governance, and continuous operation at scale. +**Keygraph Enterprise Platform** is for organizations that need a shared platform for continuous agentic pentesting/AppSec across many teams, repositories, and environments. It centralizes deeper analysis, vulnerability management, remediation, verification, governance, and reporting so teams do not have to assemble and maintain those workflows themselves. - -| | Shannon Open Source | Keygraph Enterprise Platform | -| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Best for | Local and CI/CD pentesting | Continuous AppSec across teams and repositories | -| Security analysis | Multi-stage agentic review models architecture, trust boundaries, and data flows, filters candidate vulnerabilities, and hands the survivors to live pentesting agents | Exhaustive parsed-code agentic SAST: persistent Code Property Graphs, interprocedural source-to-sink and sanitizer modeling, cross-repository context, exploit-chain analysis, and business-logic testing | -| Additional coverage | Not included | SCA with reachability, secrets scanning, and business-logic testing | -| AppSec operations | N/A — standalone CLI | Canonical findings, deduplication, SLAs, analytics, automated remediation, and targeted verification | -| Governance | N/A — local, single-operator CLI | SSO, SCIM, granular access control, APIs, and full audit logging | -| Deployment | Self-hosted, air-gapped, BYOM, AGPL-3.0 | On-premises or air-gapped, granular model routing, commercial support | - - -Shannon Open Source is not a trial edition. Choose Keygraph Enterprise when you need deeper analysis and a governed, closed-loop AppSec program. - -[Explore the Keygraph Enterprise Platform →](docs/keygraph-platform.md) +[Learn about the Keygraph Enterprise Platform and compare editions →](docs/keygraph-platform.md) ## Architecture @@ -375,4 +376,4 @@ Shannon works with local models served through Ollama, vLLM, or LM Studio, which Shannon executes real exploits. It reports a finding only when it has produced a working proof-of-concept, and discards hypotheses it cannot prove. It is a pentester, not a passive scanner. -**Built by [Keygraph](https://keygraph.io)** \ No newline at end of file +**Built by [Keygraph](https://keygraph.io)** diff --git a/docs/keygraph-platform.md b/docs/keygraph-platform.md index 0332b89b..d87cf951 100644 --- a/docs/keygraph-platform.md +++ b/docs/keygraph-platform.md @@ -1,133 +1,101 @@ # Keygraph Enterprise Platform -Shannon 3.0 makes advanced, code-informed autonomous pentesting available to everyone. The open-source CLI maps routes and data flows, understands application architecture, executes real attacks, and produces PDF and SARIF results—locally, in CI/CD, or fully air-gapped with your own model. +Shannon 3.0 is an open-source pentester. It reads your source, maps routes and data flows, runs real attacks against a live target, and writes PDF and SARIF reports. It runs locally, in CI, or air-gapped with your own model. Shannon Open Source is a complete pentester, not a trial edition. -The **Keygraph Enterprise Platform** is the commercial AppSec operating system for organizations that need to run that process continuously across many repositories, teams, and environments. It adds exhaustive agentic SAST, business-logic and source-to-sink analysis, broader scanner coverage, centralized vulnerability management, automated remediation and targeted verification, enterprise governance, and organization-wide reporting. +Keygraph Enterprise runs an enterprise-hardened fork of Shannon continuously across hundreds of repositories and adds what a security team needs around it: audit-depth static analysis on a parsed code graph, business-logic testing, SCA and secrets scanning, one deduplicated record per vulnerability across scans and scanners, generated fixes, fix verification, and SSO, RBAC, and audit logs. It is for security teams that own vulnerability management across many engineering teams and need one place to triage, assign, fix, and verify. -> Shannon Open Source is a complete autonomous pentester, not a trial edition. Keygraph Enterprise is for teams that need greater analysis depth, shared control, and a closed-loop vulnerability-management program. +Both editions are BYOK. Keygraph never receives your source and never proxies model traffic, open source or commercial. Shannon Open Source runs from your machine or CI runner. Keygraph Enterprise deploys as a platform inside your cloud or data center, including fully air-gapped. -## Who It Is For +## Shannon Open Source vs. Keygraph Enterprise -Keygraph Enterprise is designed for organizations that need to: +| | Shannon Open Source | Keygraph Enterprise | +| --- | --- | --- | +| Best for | Developers and teams running repository-level pentests locally or in CI | Security organizations running continuous AppSec across many teams and repositories | +| Code analysis | Agent pass over architecture, entry points, and data flows to seed the pentest, sized to finish inside a CI run | Persistent code property graph plus a long-running analysis harness with interprocedural taint, sanitizer modeling, cross-repo context, exploit chains, and multi-pass review | +| Pentesting | On-demand, source-aware white-box pentesting with optional authenticated testing, focused on injection, XSS, SSRF, broken authentication, and broken authorization, with proof by exploitation | Enterprise-hardened Shannon fork run continuously, with grey-box and black-box targets and business-logic invariant testing | +| SCA and secrets | Not included | SCA with reachability and secrets scanning including history | +| Findings | Per-run PDF, Markdown, JSON, and SARIF, with SARIF ingestion into GitHub code scanning | One record per vulnerability per repo across scans and scanners, plus ownership, SLAs, dashboards, and audit evidence | +| Fixes and verification | Not included | Fix PRs with verification by re-analysis and exploit replay, with no full rescan required | +| CI/CD and source control | GitHub Action and GitLab CI component for pull-request, release, and scheduled runs, with gates on `status: exploited` | GitHub, GitLab, Azure DevOps, and Bitbucket with organization-wide policy and centrally managed integrations | +| Deployment and models | Runs locally or on a CI runner with BYOK to any Anthropic- or OpenAI-compatible endpoint or local model | Deployed in your AWS, GCP, Azure, or on-prem environment. Customer-hosted services and stored platform data remain inside your environment. Model requests go directly to the provider, private endpoint, gateway, or local model you configure. A local model supports fully disconnected deployments | +| Governance, license, support | AGPL-3.0 and community support | SSO, SCIM, RBAC, and audit logs, plus a commercial license, enterprise support, and SOC 2 Type II | -- continuously test hundreds or thousands of repositories, services, applications, and APIs; -- combine agentic pentesting, SAST, SCA, secrets, and business-logic findings in one system; -- enforce security policy in GitHub Actions, GitLab CI, and enterprise delivery pipelines; -- give developers one canonical, actionable record for each vulnerability instead of duplicate scanner alerts; -- assign owners, apply SLAs, track status, and measure risk and remediation performance across the organization; -- generate fixes and verify them without rerunning an entire scan; -- enforce enterprise identity, authorization, audit, and API-access controls; and -- deploy fully on-premises or air-gapped with customer-controlled models, keys, and routing. +## How it fits your pipeline -## Close the Entire AppSec Loop +1. Scans run on pull requests, releases, and a schedule against repositories in GitHub, GitLab, Azure DevOps, or Bitbucket. +2. Pipelines gate on exploited severity. A code-analysis hypothesis never fails a build. +3. Findings from every scanner and every run land as one record per vulnerability per repository, with an owner and an SLA. The same finding across ten runs is one record, not ten alerts. +4. From a finding, Keygraph opens a fix PR into your normal review flow. +5. Verification confirms the fix against the changed code and the original exploit. No full rescan is required. -The platform connects discovery, triage, remediation, and verification in one continuous workflow: +## What is different technically -1. **Analyze** every repository with exhaustive agentic SAST and complementary scanners. -2. **Prove** exploitability with source-aware white-box, black-box, and grey-box pentesting. -3. **Normalize and deduplicate** results into a canonical finding per vulnerability and repository. -4. **Prioritize and assign** using severity, reachability, exploit evidence, ownership, policy, and business context. -5. **Remediate** with an AI-authored patch delivered as a reviewable pull request. -6. **Verify** the specific fix with deterministic checks and adversarial agent reasoning—without rerunning the full scan. -7. **Track and govern** status, exceptions, SLAs, audit history, trends, and compliance evidence until closure. +### Static analysis on a code property graph -## Exhaustive Agentic SAST +Shannon Open Source's code analysis is sized to finish inside a CI run: agents read the repository, map the attack surface, and hand candidates to the pentester. Enterprise is built for depth instead. It first parses each repository into a persistent code property graph, then runs an analysis harness derived from one built for long-running vulnerability audits, heavily adapted to query the graph rather than read files. The harness decomposes the application into risk, taint-flow, framework, and specialist tasks and supports longer-running audit workflows beyond typical CI job windows. -Shannon 3.0's open-source code analysis runs a multi-stage agentic workflow. It models application architecture, trust boundaries, exposed interfaces, and data flows, opens targeted investigations, reviews the candidates they turn up, and hands the survivors to live pentesting agents. That workflow is built for practical local and CI/CD runs. +On the graph, it performs: -The Enterprise engine goes further, for audits at organization scale. It parses the codebase and builds persistent structural context before agents start reasoning about security: +- Interprocedural taint tracking across functions, files, fields, containers, and framework request lifecycles. +- Source, sink, and sanitizer modeling that records where validation, encoding, or authorization changes a path. +- Cross-repository modeling of services, entry points, and trust boundaries. +- Semantic deduplication of variants of the same defect, and exploit-chain analysis for combinations with higher impact than any single issue. +- Multiple review passes per candidate, checking the agent's claim against the graph and available deployment and configuration context. Candidates that cannot be substantiated are not reported. -- **Repository and architecture modeling** identifies services, frameworks, entry points, assets, trust boundaries, and cross-repository relationships. -- **Interprocedural call and data-flow analysis** traces values across functions, files, fields, containers, and framework-managed request lifecycles. -- **Source, sink, and sanitizer modeling** follows untrusted input to sensitive operations and records where validation, encoding, authorization, or other controls alter the path. -- **Threat-driven decomposition** breaks large applications into risk, taint-flow, framework, and specialist analysis tasks so deep scans remain systematic. -- **Exhaustive adversarial verification** challenges candidates across multiple review passes, weighing structural evidence against what the agents found, then asks whether each one is viable in the application's production configuration. -- **Semantic deduplication and exploit-chain analysis** consolidate variants of the same defect and identify combinations whose impact is greater than any isolated issue. -- **Business-logic invariant testing** derives rules the code is supposed to preserve—such as tenant isolation, workflow order, approval limits, balances, and state transitions—then agents fuzz those invariants for application-specific flaws. +### Business-logic invariants -The result is broad vulnerability hunting with precise paths back to the relevant code, not a flat list of pattern matches. +Shannon Open Source focuses on injection, XSS, SSRF, and broken authentication and authorization. Enterprise adds testing for the bugs that do not fit a vulnerability class: it derives invariants the application is supposed to hold (tenant isolation, workflow ordering, approval limits, balance conservation, state transitions) and tests them against the running application. This is where application-specific vulnerabilities live and where pattern-based SAST often provides little or no signal. + +### Proof by exploitation + +The pentesting engine is a hardened fork of Shannon with the same rule: a pentest finding requires a working exploit. No exploit, no finding. Enterprise stores the exploit and replays it later to verify the fix. + +SCA prioritizes vulnerable dependencies that application code actually reaches. Secrets scanning covers current source and repository history.

- Keygraph Enterprise SAST results grouped into business-logic issues, point issues, and secrets + Keygraph Enterprise findings grouped into business-logic issues, point issues, and secrets

-## Complete Application-Security Coverage +## Findings -Agentic SAST and pentesting work alongside additional first-class scanners: +Shannon Open Source hands you a report per scan. Enterprise dedupes across runs and across scanners, deterministically and semantically, into one record per vulnerability per repository. Each record carries evidence, source location, severity, scan history, status, owner, resolution, and last-verified state. -- **SCA with reachability** prioritizes vulnerable dependencies that application code can actually reach. -- **Full secrets scanning** detects credentials, tokens, and keys across source and repository history. -- **Agentic pentesting** correlates code intelligence with live application behavior and attempts real exploitation. The core rule remains: no exploit, no pentest finding. +Workflows cover assignment, triage, false-positive and risk-acceptance decisions, and SLA policies with escalation and aging. Dashboards report open risk, coverage, new versus resolved, SLA compliance, and MTTR, exportable as evidence for customers and auditors. -## One System of Record for Every Finding - -Keygraph ingests results from every analysis source, correlates them, and maintains one canonical finding per vulnerability per repository. Security and engineering teams work from the same record, with evidence, source location, severity, scan history, status, assignee, resolution, and last-verification state. - -The vulnerability-management layer provides: - -- deterministic and semantic deduplication across scans and scanners; -- ownership, assignment, triage, false-positive, risk-acceptance, and resolution workflows; -- SLA policies, escalation, aging, and last-verified tracking; -- bidirectional developer-workflow integrations and APIs; -- dashboards for risk, coverage, trends, new versus resolved findings, SLA compliance, and MTTR; and -- exportable evidence for customers, auditors, and compliance programs. +Findings still require human review. Enterprise's extra review passes reduce weakly supported findings, but they do not eliminate them.

- Keygraph Enterprise canonical findings inventory with severity, status, source, and verification filters + Keygraph Enterprise findings inventory with severity, status, source, and verification filters

-## Remediate, Then Verify the Fix +### Fix and verify -From an individual finding, a user can ask Keygraph to produce a focused patch. The remediation agent reasons from the root cause and evidence, changes only the required code, and opens a pull request into the existing review process. It does not silently apply fixes to a protected branch. +From a finding, Keygraph generates a patch scoped to that finding and opens a pull request. It never commits to a protected branch.

Keygraph Enterprise remediation workflow for generating a fix and opening a pull request

-After a patch is available, targeted verification re-analyzes the affected code and, for dynamic pentest findings, re-tests the original proof of concept against the target. Deterministic checks and adversarial agent reasoning produce a clear verdict without the cost and delay of rerunning the entire scan. +Verification re-analyzes the changed code and, for pentest findings, replays the original exploit against the patched target. The verdict comes from deterministic checks plus a review pass, without rerunning the full scan.

- Keygraph Enterprise targeted finding-verification workflow + Keygraph Enterprise finding-verification workflow

-## Enterprise Governance and Integrations +## Deployment and access control -Keygraph is built for shared operation across security, platform, and engineering teams: +Keygraph Enterprise deploys entirely inside your AWS, GCP, Azure, or on-prem environment, including networks with no internet egress. There is no Keygraph-operated control plane. Customer-hosted services and stored platform data remain inside your environment for the life of the deployment. -- SAML 2.0 or OIDC single sign-on and SCIM provisioning; -- organization, team, and user management; -- built-in and custom roles with granular relationship-, attribute-, and role-based authorization (ReBAC, ABAC, and RBAC); -- repository, pentest-profile, scanner, finding, and administration boundaries; -- full audit logging and scoped API keys; -- integrations with source control, CI/CD, ticketing, chat, and cloud environments; and -- commercial support and enterprise onboarding. +Model access is BYOK and BYOM. Route workloads to Anthropic, OpenAI, xAI, or Bedrock, a private cloud endpoint, your own gateway such as LiteLLM with your routing and policy applied, or local models on vLLM or Ollama. Model requests go directly to the endpoint you configure. Keygraph never receives or proxies them. A local model supports a fully disconnected deployment. + +Access control: SAML/OIDC SSO, SCIM, roles with repository-scoped visibility (RBAC, plus attribute and relationship rules where needed), full audit log, scoped API keys.

- Keygraph Enterprise granular roles and repository visibility controls + Keygraph Enterprise roles and repository visibility controls

-## On-Premises, Air-Gapped, and Customer-Controlled AI - -Keygraph Enterprise can run entirely inside your AWS, GCP, Azure, or on-premises environment, including networks with no public internet access. Deployments can keep source code, scan artifacts, findings, prompts, completions, and model traffic inside your security perimeter. - -AI access is bring-your-own-key and bring-your-own-model. Organizations can route workloads through approved commercial providers, private cloud endpoints, an internal LLM gateway, or local open-source models, with granular routing and policy controlled by the customer. There is no requirement for a Keygraph-operated control plane or model proxy. - -Keygraph maintains a SOC 2 Type II audit and makes the current report available to customers under appropriate confidentiality terms. - -## Shannon 3.0 vs. Keygraph Enterprise - -| | Shannon Open Source | Keygraph Enterprise Platform | -| --- | --- | --- | -| Best for | Individual developers and teams running pentests locally or in CI/CD | Security organizations running a continuous AppSec program across many teams and repositories | -| Code analysis | Multi-stage agentic review maps architecture, trust boundaries, exposed interfaces, and data flows, filters candidate vulnerabilities, and hands the survivors to live pentesting agents | Exhaustive parsed-code analysis: persistent Code Property Graphs, interprocedural source-to-sink and sanitizer modeling, cross-repository context, exploit-chain analysis, and business-logic invariant testing | -| Pentesting | On-demand, source-aware white-box pentesting with proof by exploitation | Continuous white-box, black-box, and grey-box pentesting across applications and environments | -| Additional AppSec coverage | Not included | SCA with reachability, secrets scanning, and business-logic invariant testing | -| CI/CD and reporting | Official GitHub Action and reusable GitLab CI/CD component; staging, release, merge-request, and scheduled pentests; demonstrated-vulnerability severity gates; PDF, Markdown, JSON, SARIF, artifacts, and native security-workflow ingestion | Organization-wide policies and gating, centrally managed integrations, canonical findings, dashboards, analytics, SLA tracking, and compliance evidence | -| Automated remediation and verification | Not included | AI-authored pull requests with targeted code and exploit verification | -| Enterprise governance | N/A — local, single-operator CLI | SSO, SCIM, teams, ReBAC/ABAC/RBAC, audit logs, API keys, ownership, and SLA policies | -| Deployment and AI | Self-hosted, no telemetry, BYOM, and fully air-gapped with a local model | Fully on-premises or air-gapped, BYOK/BYOM, and granular routing through customer-controlled gateways | -| License and support | AGPL-3.0 and community support | Commercial license, enterprise support, and SOC 2 Type II controls | +Keygraph maintains a SOC 2 Type II audit. The report is available to customers under NDA. ## Talk to Keygraph -Visit [keygraph.io](https://keygraph.io), book a [Keygraph demo](https://cal.com/team/keygraph/shannon-pro), or contact [shannon@keygraph.io](mailto:shannon@keygraph.io). +Visit [keygraph.io](https://keygraph.io), book a [demo](https://cal.com/team/keygraph/shannon-pro), or email [shannon@keygraph.io](mailto:shannon@keygraph.io). diff --git a/docs/shannon-xbow-aikido-benchmark.md b/docs/shannon-xbow-aikido-benchmark.md index 1576b3d5..46c4f3de 100644 --- a/docs/shannon-xbow-aikido-benchmark.md +++ b/docs/shannon-xbow-aikido-benchmark.md @@ -132,6 +132,6 @@ Exploit-mode scans write SARIF 2.1.0 by default, so findings land in GitHub code ### Conclusion -The complaint we hear most from CISOs about AI pentesting isn't accuracy, it's cost. At $4,000 a scan, the tier Doyensec purchased from both XBOW and Aikido, the math works for an annual check-up. It doesn't work per release, and teams are shipping faster than ever. A large enterprise with 5,000 repositories is looking at $20 million for a single pass. +The complaint we hear most from CISOs about AI pentesting is the economics of continuous coverage. Doyensec paid $4,000 for each Aikido and XBOW assessment. At that benchmark price, treating 5,000 repositories as separate assessment targets would imply $20 million for one portfolio-wide pass before enterprise discounts. That may be viable for selective annual testing, but not for testing an entire portfolio at release cadence. -Shannon v3 running DeepSeek v4 Flash scanned Photoview for $6.10 and caught the same critical SQL injection the $4,000 platforms caught. The same enterprise would pay about $30,000 for that pass. The cheap model doesn't catch everything: our Claude Opus 5 run found 6 of 7 patched vulnerabilities to DeepSeek's 3, for $115. That's the point. Run the cheap model on every change, run the heavy one on a schedule, and continuous pentesting becomes affordable. \ No newline at end of file +Shannon v3 running DeepSeek v4 Flash scanned Photoview for $6.10 and caught the same critical SQL injection the $4,000 platforms caught. At the observed DeepSeek model cost, 5,000 equivalent Shannon runs would consume about $30,500 in model tokens, before infrastructure and operational costs. The cheap model doesn't catch everything: our Claude Opus 5 run found 6 of 7 patched vulnerabilities to DeepSeek's 3, for $115. These results support a tiered testing strategy in which teams use lower-cost models for frequent scans and more capable models for periodic deeper assessments, making continuous pentesting economically practical.