Unified security inspection

Find every risk. Before it ships.

Cloud posture, code scanning, Kubernetes, containers, compliance and Well-Architected review in one inspection run, with one findings graph and audit-ready reports. Run it as SaaS or inside your own infrastructure.

Request demo See the scanners
13
Scanners
4
Attack surfaces
22
Compliance frameworks
2
Ways to deploy
13 scanners, 4 attack surfaces, 1 inspection run

Every attack surface, one findings graph

Each scanner runs as an ephemeral job, in our cloud or in your cluster, and writes into the same findings pipeline, so cloud, code, runtime and application risk are scored, deduplicated and reported together.

Cloud

Accounts, identities and managed services across AWS, Azure and GCP.

3
  • Cloud postureIAM, storage, network and 120+ service checks; effective-permission analysis across principals.
  • AI workload discoveryManaged model endpoints and their logging checked against OWASP LLM Top 10 and NIST AI RMF.
  • Well-Architected reviewThe five AWS, Azure and GCP Well-Architected pillars rated with LLM-generated recommendations.

Code and supply chain

Every repository, its dependencies and the platform it lives on.

6
  • SecretsLeaked credentials in source (Gitleaks, TruffleHog).
  • Infrastructure as codeTerraform, CloudFormation, Kubernetes manifests and Dockerfiles (Checkov).
  • Static analysisLanguage-aware SAST with best-practice rulesets (Semgrep).
  • Dependencies, component inventory and licence policyKnown CVEs, component inventory and licence policy (osv-scanner, pip-audit, govulncheck, Syft, Grype).
  • Repository and org postureBranch protection, secret scanning, Dependabot, CODEOWNERS and org-level 2FA and Actions settings.
  • PII exposurePersonal data committed to repositories, folded into the codebase scan.

Runtime

What is actually running, not just what was declared.

2
  • Kubernetes clustersLive-cluster CIS Kubernetes and NSA hardening checks: RBAC, pod security, network policies.
  • Container imagesDaemon-free registry pulls; CVEs, CycloneDX SBOM and OS compliance per image and platform (Trivy, Syft, OpenSCAP).

Applications

The surface an attacker sees from outside.

2
  • Dynamic application scanningAuthenticated DAST against running web applications.
  • Penetration testingAgent-run tests against authorised targets, plus SARIF and Burp Suite report ingestion.
Compliance

Collect once. Comply with 22 frameworks.

Every finding carries its scanner check ID, title and evidence. The compliance agent maps each finding to the controls it satisfies or violates in every framework you enable, so the same evidence serves your SOC 2 auditor, your ISO assessor and your PCI QSA.

  • One scan produces evidence for every framework you select; there is no per-framework rerun.
  • Findings are tracked by fingerprint across runs, so auditors see remediation over time, not a fresh list each quarter.
  • Per-framework scores with the failed control IDs, the underlying findings and per-finding remediation guidance.
  • Custom Rego policies for internal rules, evaluated in the same run alongside the built-in frameworks.
SOC 2ISO 27001PCI DSSHIPAAHITRUSTGDPRNIST CSFNIST 800-53FedRAMP LowFedRAMP ModerateFedRAMP HighCIS AWSCIS AzureCIS GCPCIS KubernetesCSA CCMDORANIS2OWASP Top 10OWASP LLM Top 10NIST AI RMFMITRE ATT&CK
Finding
S3 bucket public access block not fully enabled
Cloud posture · high severity · AWS_S3_PUBLIC_ACCESS_BLOCK_DISABLED
maps to
Controls mapped from one public-access storage finding
SOC 2CC6.6
ISO 270018.3
HIPAA164.312(a)(1)
GDPRArt.32(1)(b)
NIST 800-53AC-3, AC-6(10)
NIS2Art.21(j)
DORAArt.9
MITRE ATT&CKT1190, T1133

One finding, eight frameworks, one piece of evidence. Check and control IDs are the ones the scanners and compliance agent emit.

Reporting

Audit-ready output in the formats auditors and tools expect

A run ends with a report bundle, not a dashboard you have to screenshot.

Reports

Rendered per run, ready for an audit binder.

  • Executive summary PDF across all scanners
  • Per-scope PDFs: each cloud account, repository, cluster, image, web application and pentest target
  • Per-framework compliance PDF with scores and failed controls
  • SBOM and PII reports
  • HTML alongside every PDF, JSON for compliance and Well-Architected scores; everything in one zip bundle

Exports and integrations

Machine-readable output for the tools you already run.

  • SARIF for GitHub code scanning and Advanced Security
  • OCSF and ASFF streams for your SIEM and AWS Security Hub
  • CycloneDX SBOM per scanned image; component and licence inventory per repository
  • REST API and vsutra CLI for everything the console shows
  • Jira and GitHub Issues sync; Slack, email and webhook alerts with console deep links

Findings intelligence

Aggregation that survives the next run.

  • One findings graph across all 13 scanners, deduplicated by pattern
  • Cross-run history per finding fingerprint
  • Attack path analysis across cloud, identity and workload findings
  • Natural-language search over findings
  • Mute rules, remediation templates and LLM-assisted fixes with pull requests
Deployment

Run it as SaaS or in your own cluster

Same scanners, same findings graph, same reports. Choose where the platform runs. With the hosted scan agent, private source code stays in your network on either option.

SaaS

Hosted by VirtualSutra

The console, API, scanners and reporting run in our cloud. Add the hosted scan agent in your network and private source code never leaves it.

  • Sign in to the hosted console; nothing to operate
  • Cloud accounts scanned with read-only credentials
  • Private repositories scanned by the hosted agent inside your network — in early access, available on request
  • Internet-reachable container registries scanned by pulling the images with read-only credentials, no agent required
  • Findings, scores and reports in the console within minutes

Available on: Community (free), Pro and Enterprise

Self-hosted

Your Kubernetes cluster

The whole platform installs from one Helm chart into a cluster you run, including air-gapped environments with a private registry.

  • Single Helm chart with ephemeral scanner jobs and priority classes
  • Air-gap profile, private registry and offline vulnerability database
  • Bring your own SSO, secrets manager and LLM endpoint
  • Findings and evidence stay entirely inside your infrastructure

Available on: Pro and Enterprise

Hosted scan agent · Early access

SaaS without shipping your code

Enable the agent for a repository and it is cloned and scanned by a small container you run inside your network. The agent reaches out to the hosted API, never the other way round.

Request demo
  1. Install the agent

    One container or Helm chart inside your network, with access to a container-runtime socket and its own scoped credential.

  2. It claims scan jobs

    The agent polls the hosted API over outbound HTTPS only; no inbound ports, no VPN.

  3. It scans locally

    Repositories are cloned and scanned inside your network with the codebase scanners: secrets, IaC, SAST, dependencies and SBOM.

  4. Only findings leave

    Batches of findings and progress events are posted back; source code is never uploaded.

Enterprise-ready

Built for security teams that don't cut corners.

Hosted or self-hosted, air-gappable and auditable. With the hosted scan agent, private source code never leaves your network; the self-hosted option keeps findings and evidence there too.

  • SaaS or air-gapped Kubernetes deployment
  • Hosted scan agent for private repositories
  • GitHub App and GitLab OAuth
  • PR blocking with per-schedule thresholds
  • SSO / OIDC / OAuth2 login
  • Per-organisation API keys and scopes
  • Custom compliance frameworks
  • Custom check registration
  • Slack, email and webhook alerts
  • SARIF export for GitHub Advanced Security
  • PDF, HTML and JSON reports
  • Audit-ready evidence artifacts
Talk to us about your environment

Air-gap, private registries, on-prem LLMs.

Contact us
Pricing

A plan for every way you deploy.

Community is free while we are in early access and hosted by us. Pro and Enterprise run as SaaS or in your own cluster. Tell us about your environment and we'll scope the right fit.

Community

Free during early access · Hosted

A first complete picture of one cloud account, one code organisation and one registry.

  • A starter workspace: one cloud account, one code organisation and one container registry
  • Compliance scoring, executive summary and per-scope reports
  • Community support by email

Kubernetes cluster scanning, dynamic application scanning and penetration testing are not included. Workspace scope is agreed when we set it up with you.

Request your free workspace

Pro

Recommended

SaaS or self-hosted

Unlimited accounts, repositories and registries, plus Kubernetes, application scanning and enterprise integrations.

  • Everything in Community, without the account, repository or image limits
  • All 13 scanners, including Kubernetes, DAST and penetration testing
  • Self-hosted Kubernetes option (Helm)
  • GitHub PR blocking (GitLab merge-request gating on request)
  • SSO / OIDC / OAuth2
  • Custom compliance frameworks
  • Slack, webhook and email alerts
  • SARIF, OCSF and ASFF exports
  • Priority support
Contact us

Enterprise

SaaS or self-hosted

Air-gapped deployment, SLA and dedicated onboarding.

  • Everything in Pro
  • Air-gapped cluster with private registry
  • On-prem LLM support
  • Custom scanner integrations
  • Dedicated Slack channel
  • SLA and security review
  • Compliance audit support
Contact us