diff --git a/README.md b/README.md index 8a69b970..cf0e932c 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@ > [!NOTE] -> **[Shannon 2.0 is officially here](https://github.com/KeygraphHQ/shannon/discussions/405)** +> **Shannon 3.0 is live:** deeper security code analysis, a rebuilt terminal experience, native CI/CD workflows, professional PDF reports, and SARIF—still fully open source, self-hosted, and bring-your-own-model.
@@ -13,7 +13,7 @@ ### Shannon is an autonomous, AI pentester for web applications and APIs. -It analyzes your source code, identifies attack paths, and executes real exploits to prove vulnerabilities before they reach production. +It analyzes your source code, identifies attack paths, and executes real exploits to prove vulnerabilities before they reach production. **No exploit, no report.** **This repository is Shannon Open Source: the full agent, run locally from your command line.** @@ -39,7 +39,6 @@ It analyzes your source code, identifies attack paths, and executes real exploit - [Documentation](#documentation) - [Safety, Scope, and Limitations](#safety-scope-and-limitations) - [License](#license) -- [Acknowledgements](#acknowledgements) - [About Keygraph](#about-keygraph) - [Community and Support](#community-and-support) - [Common Questions](#common-questions) @@ -107,41 +106,36 @@ For source builds, authenticated scans, provider-specific setup, and platform no ## Key Capabilities -- **Proof-by-exploitation reports**: Shannon reports validated findings with reproducible proof-of-concept steps instead of speculative warnings. -- **White-box attack planning**: Shannon uses source-code analysis to guide dynamic testing and focus on realistic attack paths. +- **No exploit, no report**: Shannon includes a vulnerability only after validating it with a working, reproducible proof of concept—eliminating the speculative warnings typical of scanners. +- **Advanced security code analysis**: Before sending a payload, Shannon maps API routes, traces data flows, and synthesizes the application's architecture so it can plan realistic, multi-step attacks instead of blindly fuzzing endpoints. - **Autonomous execution**: Shannon launches reconnaissance, vulnerability analysis, exploitation, and report generation from a single command. +- **Live terminal experience**: A rebuilt CLI makes scans easy to configure and shows agent progress and clean results without requiring operators to inspect the underlying orchestration logs. - **Authenticated testing**: configuration files can describe login flows, test credentials, TOTP, email-based login flows, focus areas, and rules of engagement. - **OWASP-focused coverage**: Shannon targets exploitable Injection, XSS, SSRF, Broken Authentication, and Broken Authorization issues. - **Resumable workspaces**: Shannon can resume interrupted runs without re-running completed agents. -- **Machine-readable output**: Shannon emits findings as structured JSON, and as SARIF 2.1.0 by default on exploit-mode scans (opt out with `report.sarif: "false"`). SARIF is the OASIS standard for static analysis results, so findings flow into any code scanning service, vulnerability management platform, security dashboard, or CI/CD pipeline that reads it. -- **Bring your own key, provider-agnostic**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, and any endpoint speaking the Anthropic Messages API or the OpenAI Chat Completions or Responses API, including self-hosted models served through Ollama, vLLM, or LM Studio and gateways such as OpenRouter and LiteLLM. You supply the credentials, so source code and model traffic stay inside your infrastructure. Local and self-hosted models are technically supported but not recommended: they may not follow Shannon's instructions or tool-use constraints as reliably as frontier models, so take that path only if you know how your chosen model behaves. +- **Native CI/CD**: Run Shannon headlessly from GitHub Actions, GitLab CI, or another pipeline and gate releases by finding severity. +- **Professional and machine-readable reports**: Shannon generates evidence-rich PDF and Markdown reports plus structured JSON and SARIF 2.1.0. SARIF is enabled by default on exploit-mode scans and can be disabled with `report.sarif: "false"`. +- **Bring your own key, provider-agnostic**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, and any endpoint speaking the Anthropic Messages API or the OpenAI Chat Completions or Responses API, including self-hosted models served through Ollama, vLLM, or LM Studio and gateways such as OpenRouter and LiteLLM. You supply the credentials and choose exactly where model traffic goes. Local and self-hosted models are technically supported but not recommended: they may not follow Shannon's instructions or tool-use constraints as reliably as frontier models, so take that path only if you know how your chosen model behaves. +- **Private by design**: Shannon runs on your infrastructure and sends no product telemetry. For a fully air-gapped deployment, route it to a local model endpoint. ## Editions -Shannon ships in two ways: **Shannon Open Source**, the pentester you run yourself, and the **Keygraph platform**, the commercial pentesting product that runs Shannon continuously and closes the full AppSec lifecycle around it. +**Shannon Open Source** is the complete autonomous pentester for developers and security teams. It is optimized for fast local and CI/CD runs: understand the application, execute real attacks, and report only proven vulnerabilities. -**Shannon Open Source** (this repository) is the standalone pentester: a CLI agent for white-box, proof-by-exploitation testing of web applications and APIs you own or are authorized to test. It reads your source, plans attacks, executes real exploits, and reports only what it can prove. It runs on demand and is complete in that lane. You point it at a target, it pentests, it reports. +**Keygraph Enterprise Platform** turns Shannon's proof engine into an organization-wide AppSec program, adding exhaustive analysis, centralized vulnerability management, automated remediation, enterprise governance, and continuous operation at scale. -The **Keygraph platform** is the enterprise-ready, continuous pentesting product powered by Shannon. In the Keygraph platform, an enhanced build of Shannon runs continuously in a hardened, orchestrated environment fed by Keygraph's full code-analysis stack. Around that engine, the platform closes the entire vulnerability lifecycle, from analysis to a verified fix: - -- **Analyze**: Code Property Graph SAST, SCA with reachability, secrets, IaC, and container scanning. First-class detection in their own right, and context that sharpens Shannon's attacks. -- **Prove**: autonomous black-box and source-aware white-box pentests turn candidate findings into proven, exploited vulnerabilities rather than speculative alerts. -- **Manage**: one canonical record per vulnerability per repository, deduplicated across every source, with ownership, status, SLA tracking, dashboards, and bidirectional Jira sync. -- **Remediate and verify**: patches written automatically and re-tested against the patched code before delivery, landing in your existing review workflow rather than auto-applied. -- **Deploy**: self-hosted and air-gapped environments, strict bring-your-own-key model access, and customer-controlled LLM gateway patterns, so source, results, and model traffic stay inside your perimeter. - -Shannon is the proof engine at the center of the Keygraph platform. Shannon Open Source gives you that engine to run yourself. The Keygraph platform surrounds Shannon with continuous analysis, finding management, remediation, verification, and enterprise deployment. - -| AppSec lifecycle stage | Shannon Open Source | Keygraph platform | +| | Shannon Open Source | Keygraph Enterprise Platform | | --- | --- | --- | -| Analyze | Basic LLM pass-through of source to plan attacks | Actual code-base parsing, plus Code Property Graph, SAST, SCA with reachability, secrets, IaC, and containers | -| Pentest and prove | White-box only, proof by exploitation | Enhanced white-box, plus black-box and grey-box modes, run continuously | -| Manage findings | Local Markdown report | Canonical findings system: deduplication across sources, ownership, SLA, dashboards, Jira sync, and professional pentest-grade PDF reports | -| Remediate and verify | Fix manually from the report, then re-run the full scan to verify | Automated remediation: opens a PR with the fix, verified by point re-test without re-running the full scan | -| Deploy and operate | Local CLI and Docker worker | Self-hosted, air-gapped, BYOK, continuous, enterprise integrations | -| License and support | AGPL-3.0, community | Commercial, supported | +| Best for | Local and CI/CD pentesting | Continuous AppSec across teams and repositories | +| Security analysis | Fast, code-informed white-box pentesting | Exhaustive agentic SAST plus continuous white-box, black-box, and grey-box pentesting | +| Additional coverage | Not included | SCA with reachability, secrets scanning, and business-logic testing | +| AppSec operations | N/A — standalone CLI | Canonical findings, deduplication, SLAs, analytics, automated remediation, and targeted verification | +| Governance | N/A — local, single-operator CLI | SSO, SCIM, granular access control, APIs, and full audit logging | +| Deployment | Self-hosted, air-gapped, BYOM, AGPL-3.0 | On-premises or air-gapped, granular model routing, commercial support | -Learn more on the [Keygraph website](https://keygraph.io), read the [Keygraph platform technical overview](docs/keygraph-platform.md), start a free trial or book a [demo](https://cal.com/team/keygraph/shannon-pro), or contact [shannon@keygraph.io](mailto:shannon@keygraph.io). +Shannon Open Source is not a trial edition. Choose Keygraph Enterprise when you need deeper analysis and a governed, closed-loop AppSec program. + +[Explore the Keygraph Enterprise Platform →](docs/keygraph-platform.md) ## Architecture @@ -189,7 +183,7 @@ At a high level: - **Reconnaissance** explores the live application and correlates runtime behavior with code-level context. - **Vulnerability analysis** runs specialized agents for Injection, XSS, SSRF, Authentication, and Authorization. - **Exploitation** attempts real proof-of-concept attacks and discards hypotheses that cannot be proven. -- **Reporting** compiles validated findings, evidence, and remediation guidance into a final Markdown report. +- **Reporting** compiles validated findings, evidence, severity, and reproduction steps into professional PDF and Markdown reports, with structured JSON and SARIF for downstream systems. Each scan runs in an ephemeral Docker container with an isolated workspace and per-invocation orchestration. @@ -206,7 +200,7 @@ Use these guides for operational detail: | [Workspaces and resuming](docs/workspaces.md) | Naming workspaces, resuming interrupted scans, and workspace storage. | | [Safety and limitations](docs/safety.md) | Authorized-use requirements, non-production guidance, mutative effects, cost, and model caveats. | | [Coverage and roadmap](docs/coverage-roadmap.md) | Current vulnerability coverage and planned work. | -| [Keygraph platform](docs/keygraph-platform.md) | The continuous, agentic pentesting platform: code analysis, black-box and white-box testing, finding management, remediation, verification, and enterprise deployment. | +| [Keygraph Enterprise Platform](docs/keygraph-platform.md) | Exhaustive agentic SAST, continuous pentesting, full-lifecycle finding management, remediation, targeted verification, enterprise governance, and on-premises deployment. | ## Safety, Scope, and Limitations @@ -216,7 +210,7 @@ You are responsible for using Shannon legally and ethically. Do not point Shanno Important limitations: -- Shannon Open Source focuses on actively exploitable issues such as Injection, XSS, SSRF, Broken Authentication, and Broken Authorization. Broader static-analysis coverage, including vulnerable dependencies and insecure configurations, is delivered through the Keygraph platform. +- Shannon Open Source is tuned for fast, code-informed pentesting in everyday development and CI/CD. Exhaustive agentic SAST, broader scanner coverage, centralized governance, and full-lifecycle vulnerability management are delivered through the Keygraph Enterprise Platform. - Findings still require human review. LLM-generated reports can contain weakly supported or incorrect details. - Anthropic, OpenAI, xAI, and AWS Bedrock are built-in providers, and any Anthropic Messages API or OpenAI Chat Completions or Responses API endpoint works through a custom base URL. Model capability varies, and a model that does not follow Shannon's instructions or tool-use constraints reliably will produce weaker results. - A full run can take roughly 1 to 1.5 hours and may incur LLM API costs depending on model pricing and application complexity. @@ -232,14 +226,6 @@ Commercial and enterprise licensing is available for organizations that need dif For commercial licensing, contact [shannon@keygraph.io](mailto:shannon@keygraph.io). -## Acknowledgements - -Thanks to [Pi](https://github.com/earendil-works/pi), -[Playwright CLI](https://github.com/microsoft/playwright-cli), -and [Mantis](https://github.com/google/mantis). - -See [THIRD_PARTY_NOTICES.md](./THIRD_PARTY_NOTICES.md) for licensing and attribution details. - ## About Keygraph **Keygraph** is the company behind Shannon. It also builds the **Keygraph platform**, the commercial agentic pentesting product that closes the full AppSec lifecycle and runs an enhanced build of Shannon as its pentesting engine. diff --git a/assets/keygraph-platform/agentic-sast-results.png b/assets/keygraph-platform/agentic-sast-results.png new file mode 100644 index 00000000..dc4c2ae1 Binary files /dev/null and b/assets/keygraph-platform/agentic-sast-results.png differ diff --git a/assets/keygraph-platform/automated-remediation.png b/assets/keygraph-platform/automated-remediation.png new file mode 100644 index 00000000..a9bc85e2 Binary files /dev/null and b/assets/keygraph-platform/automated-remediation.png differ diff --git a/assets/keygraph-platform/canonical-findings.png b/assets/keygraph-platform/canonical-findings.png new file mode 100644 index 00000000..52d6fefb Binary files /dev/null and b/assets/keygraph-platform/canonical-findings.png differ diff --git a/assets/keygraph-platform/enterprise-access-control.png b/assets/keygraph-platform/enterprise-access-control.png new file mode 100644 index 00000000..89246b6f Binary files /dev/null and b/assets/keygraph-platform/enterprise-access-control.png differ diff --git a/assets/keygraph-platform/targeted-verification.png b/assets/keygraph-platform/targeted-verification.png new file mode 100644 index 00000000..a3510582 Binary files /dev/null and b/assets/keygraph-platform/targeted-verification.png differ diff --git a/docs/keygraph-platform.md b/docs/keygraph-platform.md index fbf3cd42..7b539015 100644 --- a/docs/keygraph-platform.md +++ b/docs/keygraph-platform.md @@ -1,94 +1,131 @@ -# Keygraph Platform +# Keygraph Enterprise Platform -The Keygraph platform is Keygraph's commercial continuous pentesting and AppSec platform for teams running security across many repositories, services, and environments. While Shannon is a local white-box pentesting CLI, the Keygraph platform is a complete AppSec system: it combines parsed-code SAST, source-to-sink analysis, black-box and white-box agentic pentesting, verified remediation, CI/CD gating, SLA tracking, and reporting for security and compliance teams. +Shannon 3.0 makes advanced, code-informed autonomous pentesting available to everyone. The open-source CLI maps routes and data flows, understands application architecture, executes real attacks, and produces PDF and SARIF results—locally, in CI/CD, or fully air-gapped with your own model. -This repository contains Shannon, the AGPL-3.0 open-source CLI for strictly white-box pentesting. The Keygraph platform supports both white-box and black-box agentic pentesting and adds static analysis, finding management, remediation workflows, reporting, and enterprise deployment options. +The **Keygraph Enterprise Platform** is the commercial AppSec operating system for organizations that need to run that process continuously across many repositories, teams, and environments. It adds exhaustive agentic SAST, business-logic and source-to-sink analysis, broader scanner coverage, centralized vulnerability management, automated remediation and targeted verification, enterprise governance, and organization-wide reporting. -## Who Should Consider the Keygraph Platform +> Shannon Open Source is a complete autonomous pentester, not a trial edition. Keygraph Enterprise is for teams that need greater analysis depth, shared control, and a closed-loop vulnerability-management program. -The Keygraph platform is intended for organizations that need: +## Who It Is For -- Continuous AppSec coverage across many repositories and services -- White-box pentesting when source code is available -- Black-box pentesting against deployed applications and APIs without source-code access -- Agentic SAST, SCA with reachability, secrets scanning, IaC scanning, container scanning, and business logic testing -- Canonical finding management, deduplication, ownership, status tracking, and severity tracking -- Sync into developer workflows, including ticketing and source-control systems -- User-initiated remediation with verification before delivery -- SLA tracking, reporting dashboards, and compliance evidence -- Commercial support -- Self-hosted, air-gapped, BYOK, and customer-controlled LLM gateway deployment options +Keygraph Enterprise is designed for organizations that need to: -## Full Vulnerability Lifecycle +- continuously test hundreds or thousands of repositories, services, applications, and APIs; +- combine agentic pentesting, SAST, SCA, secrets, and business-logic findings in one system; +- enforce security policy in GitHub Actions, GitLab CI, and enterprise delivery pipelines; +- give developers one canonical, actionable record for each vulnerability instead of duplicate scanner alerts; +- assign owners, apply SLAs, track status, and measure risk and remediation performance across the organization; +- generate fixes and verify them without rerunning an entire scan; +- enforce enterprise identity, authorization, audit, and API-access controls; and +- deploy fully on-premises or air-gapped with customer-controlled models, keys, and routing. -The Keygraph platform is designed to cover the full vulnerability lifecycle, not only discovery: +## Close the Entire AppSec Loop -1. **Find** exploitable issues with white-box pentesting, black-box pentesting, SAST, SCA, secrets, IaC, container, and business logic testing. -2. **Normalize** results into canonical findings so duplicate scanner outputs become one tracked vulnerability per repository. -3. **Prioritize** findings using exploit evidence, reachability, severity, ownership, and business context. -4. **Sync** work into developer workflows through ticketing and source-control integrations. -5. **Remediate** with user-initiated patch generation when teams want help moving from evidence to code changes. -6. **Verify** fixes by re-running the relevant scanner or exploit workflow before a remediation is delivered. -7. **Track** ownership, status, SLAs, MTTR, and drift over time. -8. **Report** through dashboards for risk, trends, compliance evidence, and security program operations. +The platform connects discovery, triage, remediation, and verification in one continuous workflow: -## Pentesting Modes +1. **Analyze** every repository with exhaustive agentic SAST and complementary scanners. +2. **Prove** exploitability with source-aware white-box, black-box, and grey-box pentesting. +3. **Normalize and deduplicate** results into a canonical finding per vulnerability and repository. +4. **Prioritize and assign** using severity, reachability, exploit evidence, ownership, policy, and business context. +5. **Remediate** with an AI-authored patch delivered as a reviewable pull request. +6. **Verify** the specific fix with deterministic checks and adversarial agent reasoning—without rerunning the full scan. +7. **Track and govern** status, exceptions, SLAs, audit history, trends, and compliance evidence until closure. -Shannon is strictly white-box: it requires access to the target application's source code and repository layout. +## Exhaustive Agentic SAST -The Keygraph platform supports two pentesting modes: +Shannon 3.0's open-source code analysis is tuned for fast, everyday pentest runs. The Enterprise engine is designed for exhaustive audits. It parses the codebase and builds structural context before asking agents to reason about security: -- **White-box agentic pentesting**: Agents use source-code context to understand architecture, identify realistic attack paths, and validate exploitability against the running application. -- **Black-box agentic pentesting**: Agents test deployed applications and APIs without source-code access, useful for third-party surfaces, production-like external validation, or environments where source access is unavailable. +- **Repository and architecture modeling** identifies services, frameworks, entry points, assets, trust boundaries, and cross-repository relationships. +- **Interprocedural call and data-flow analysis** traces values across functions, files, fields, containers, and framework-managed request lifecycles. +- **Source, sink, and sanitizer modeling** follows untrusted input to sensitive operations and records where validation, encoding, authorization, or other controls alter the path. +- **Threat-driven decomposition** breaks large applications into risk, taint-flow, framework, and specialist analysis tasks so deep scans remain systematic. +- **Adversarial verification** challenges each candidate as a potential false positive and weighs code evidence before it becomes a finding. +- **Semantic deduplication and exploit-chain analysis** consolidate variants of the same defect and identify combinations whose impact is greater than any isolated issue. +- **Business-logic invariant testing** derives rules the code is supposed to preserve—such as tenant isolation, workflow order, approval limits, balances, and state transitions—then agents fuzz those invariants for application-specific flaws. -Both modes follow the same core principle: do not report what might be vulnerable when an exploit can prove what is vulnerable. +The result is broad vulnerability hunting with precise paths back to the relevant code, not a flat list of pattern matches. -## AppSec Coverage +

+ Keygraph Enterprise SAST results grouped into business-logic issues, point issues, and secrets +

-The Keygraph platform combines agentic pentesting with broader AppSec coverage: +## Complete Application-Security Coverage -- **Agentic SAST**: Code Property Graph analysis with LLM reasoning for data flow, context, and sanitization decisions. -- **SCA with reachability**: Dependency vulnerability analysis that prioritizes issues reachable from application entry points. -- **Secrets scanning**: Detection and validation of credentials, tokens, and API keys. -- **Business logic testing**: Authorization bypass, IDOR, workflow abuse, state-machine flaws, race conditions, and other application-specific logic issues. -- **IaC scanning**: Terraform, CloudFormation, Kubernetes, Helm, and related infrastructure configuration checks. -- **Container scanning**: Vulnerable packages, exposed secrets, and misconfigurations across image layers. +Agentic SAST and pentesting work alongside additional first-class scanners: -## Static-Dynamic Correlation +- **SCA with reachability** prioritizes vulnerable dependencies that application code can actually reach. +- **Full secrets scanning** detects credentials, tokens, and keys across source and repository history. +- **Agentic pentesting** correlates code intelligence with live application behavior and attempts real exploitation. The core rule remains: no exploit, no pentest finding. -Static-dynamic correlation is a core product difference. A static finding, such as unsanitized input reaching a SQL query, is not treated as a purely theoretical issue. It is sent to an exploit agent, tested against the live application, and traced back to the exact source-code location when confirmed. +## One System of Record for Every Finding -The result is a finding with proof of exploitability, source context when available, ownership, status, SLA, remediation history, and reporting metadata. +Keygraph ingests results from every analysis source, correlates them, and maintains one canonical finding per vulnerability per repository. Security and engineering teams work from the same record, with evidence, source location, severity, scan history, status, assignee, resolution, and last-verification state. -## Enterprise Deployment +The vulnerability-management layer provides: -The Keygraph platform supports enterprise deployment patterns for teams with strict data, model, and network requirements: +- deterministic and semantic deduplication across scans and scanners; +- ownership, assignment, triage, false-positive, risk-acceptance, and resolution workflows; +- SLA policies, escalation, aging, and last-verified tracking; +- bidirectional developer-workflow integrations and APIs; +- dashboards for risk, coverage, trends, new versus resolved findings, SLA compliance, and MTTR; and +- exportable evidence for customers, auditors, and compliance programs. -- **Self-hosted deployments** inside the customer's cloud or infrastructure -- **Air-gapped deployments** for isolated environments -- **Strict BYOK model access** using customer-managed model credentials -- **Customer-controlled LLM gateway patterns** for routing, policy, logging, and isolation -- **Enterprise identity and provisioning** such as SSO and SCIM -- **Deep integrations** with source control, ticketing, chat, registries, and cloud environments +

+ Keygraph Enterprise canonical findings inventory with severity, status, source, and verification filters +

-Deployments can be designed so source code, scan results, prompts, completions, and model traffic remain inside the customer's security perimeter. +## Remediate, Then Verify the Fix -## Capability Comparison +From an individual finding, a user can ask Keygraph to produce a focused patch. The remediation agent reasons from the root cause and evidence, changes only the required code, and opens a pull request into the existing review process. It does not silently apply fixes to a protected branch. -| Need | Shannon | Keygraph platform | +

+ Keygraph Enterprise remediation workflow for generating a fix and opening a pull request +

+ +After a patch is available, targeted verification re-analyzes the affected code and, for dynamic pentest findings, re-tests the original proof of concept against the target. Deterministic checks and adversarial agent reasoning produce a clear verdict without the cost and delay of rerunning the entire scan. + +

+ Keygraph Enterprise targeted finding-verification workflow +

+ +## Enterprise Governance and Integrations + +Keygraph is built for shared operation across security, platform, and engineering teams: + +- SAML 2.0 or OIDC single sign-on and SCIM provisioning; +- organization, team, and user management; +- built-in and custom roles with granular relationship-, attribute-, and role-based authorization (ReBAC, ABAC, and RBAC); +- repository, pentest-profile, scanner, finding, and administration boundaries; +- full audit logging and scoped API keys; +- integrations with source control, CI/CD, ticketing, chat, and cloud environments; and +- commercial support and enterprise onboarding. + +

+ Keygraph Enterprise granular roles and repository visibility controls +

+ +## On-Premises, Air-Gapped, and Customer-Controlled AI + +Keygraph Enterprise can run entirely inside your AWS, GCP, Azure, or on-premises environment, including networks with no public internet access. Deployments can keep source code, scan artifacts, findings, prompts, completions, and model traffic inside your security perimeter. + +AI access is bring-your-own-key and bring-your-own-model. Organizations can route workloads through approved commercial providers, private cloud endpoints, an internal LLM gateway, or local open-source models, with granular routing and policy controlled by the customer. There is no requirement for a Keygraph-operated control plane or model proxy. + +Keygraph maintains a SOC 2 Type II audit and makes the current report available to customers under appropriate confidentiality terms. + +## Shannon 3.0 vs. Keygraph Enterprise + +| | Shannon Open Source | Keygraph Enterprise Platform | | --- | --- | --- | -| Licensing | AGPL-3.0 | Commercial | -| White-box pentesting | Yes; source code required | Yes; source-aware testing with platform workflows | -| Black-box pentesting | No | Yes; autonomous testing without source-code access | -| Code analysis / SAST | Prompting and source pass-through to guide pentesting | Actual code parsing, Code Property Graph analysis, source-to-sink path analysis, and agentic SAST | -| AppSec coverage | OWASP-focused agentic pentesting | Agentic pentesting, SAST, SCA, secrets, IaC, containers, and business logic testing | -| CI/CD and gating | Manual/local CLI runs | Headless commercial CLI for CI/CD gating across enterprise CI/CD platforms | -| Finding lifecycle | Local Markdown reports | Canonical findings, deduplication, ownership, status, SLA tracking, workflow sync, and reporting dashboards | -| Remediation | Manual | User-initiated remediation with verification before delivery | -| Fix verification | None; manual reruns only | Targeted verification without rerunning the entire scan, completing the remediation lifecycle | -| Enterprise deployment | Local CLI and Docker worker | Self-hosted, air-gapped, BYOK, and customer-controlled LLM gateway options | -| Support | Community | Commercial support | +| Best for | Individual developers and teams running pentests locally or in CI/CD | Security organizations running a continuous AppSec program across many teams and repositories | +| Code analysis | Fast, attack-oriented analysis maps routes, data flows, architecture, and likely attack paths | Exhaustive agentic SAST traces interprocedural source-to-sink paths, models sanitizers, adversarially verifies candidates, deduplicates findings, and analyzes exploit chains | +| Pentesting | On-demand, source-aware white-box pentesting with proof by exploitation | Continuous white-box, black-box, and grey-box pentesting across applications and environments | +| Additional AppSec coverage | Not included | SCA with reachability, secrets scanning, and business-logic invariant testing | +| CI/CD and reporting | GitHub Actions and GitLab workflows, severity gating, PDF, Markdown, JSON, and SARIF | Central policies and gating, APIs and integrations, canonical findings, dashboards, analytics, SLA tracking, and compliance evidence | +| Automated remediation and verification | Not included | AI-authored pull requests with targeted code and exploit verification | +| Enterprise governance | N/A — local, single-operator CLI | SSO, SCIM, teams, ReBAC/ABAC/RBAC, audit logs, API keys, ownership, and SLA policies | +| Deployment and AI | Self-hosted, no telemetry, BYOM, and fully air-gapped with a local model | Fully on-premises or air-gapped, BYOK/BYOM, and granular routing through customer-controlled gateways | +| License and support | AGPL-3.0 and community support | Commercial license, enterprise support, and SOC 2 Type II controls | -## Contact +## Talk to Keygraph -Learn more on the [Keygraph website](https://keygraph.io), start a free trial, book a [Keygraph demo](https://cal.com/team/keygraph/shannon-pro), or contact [shannon@keygraph.io](mailto:shannon@keygraph.io). +Visit [keygraph.io](https://keygraph.io), book a [Keygraph demo](https://cal.com/team/keygraph/shannon-pro), or contact [shannon@keygraph.io](mailto:shannon@keygraph.io).