Map your application security stack.
Review eight capabilities from source code to production. Identify missing and partial coverage, distinguish justified exclusions, and download a plan for your next security investment.
8 capabilities · Local assessment · No live scanning · No email required
Your responses are processed in this browser. Downloads include your responses. No email is required to view or export your results.
01 · Source code
Static application security testing (SAST)
Review first-party code for security defects during development and delivery.
02 · Dependencies
Software composition analysis (SCA)
Track third-party packages, known vulnerabilities, and dependency ownership.
03 · Credentials
Secret detection
Detect exposed credentials and connect alerts to a rotation process.
04 · Infrastructure
Infrastructure as code review
Review deployment configuration for access, exposure, and policy issues.
05 · Artifacts
Container image security
Review the images you build and deploy, including base-image maintenance.
06 · Production
Runtime & external exposure
Maintain exposure inventory and security-relevant production monitoring.
07 · Architecture
Threat modeling
Review trust boundaries and abuse cases when systems or data flows change.
08 · Evidence
Finding validation & fix verification
Establish which findings matter and verify important fixes before closure.
Provisional coverage map
A plan for the gaps you reported
Choose a maturity level for each capability. 8 unassessed capabilities remain unknown; they are not counted as gaps.
Integrated & owned
0
Self-reported operational capabilities.
Partial coverage
0
Manual or inconsistent implementation.
No coverage
0
Capabilities explicitly marked absent.
Not applicable
0
Excluded from applicable capability counts.
Your action plan appears as you identify absent or partial coverage. Complete the remaining capabilities to review the full map.
Still to assess: Static application security testing (SAST); Software composition analysis (SCA); Secret detection; Infrastructure as code review; Container image security; Runtime & external exposure; Threat modeling; Finding validation & fix verification.
The plan lists absent capabilities before partial ones. Refine that order using application exposure, business impact, and delivery capacity. No repository, domain, or production system is scanned by this tool.
Questions about the assessment
01Which security tooling categories does this assessment cover?
It covers static application security testing, software composition analysis, secret detection, infrastructure as code review, container image security, runtime and external exposure, threat modeling, and finding validation with fix verification.
02What counts as integrated and owned coverage?
A capability is integrated and owned when it consistently covers the intended environment, has accountable owners, and its results are reviewed through a repeatable workflow. Purchasing a tool without coverage verification and a review process is not enough.
03How are the gap recommendations prioritized?
The suggested plan lists capabilities marked as having no coverage before those marked partial. Unassessed categories remain unknown. Refine this starting order using the exposure, business impact, and delivery capacity of your applications.
04Can a capability be marked not applicable?
Yes. For example, container image checks may not apply to an environment that builds or deploys no containers. Document the reason for each exclusion and revisit it when the environment changes. Exclusions do not contribute to applicable coverage counts.
05Does the assessment scan my repositories or production assets?
No. It uses only the coverage levels you select in your browser. The downloadable report is a self-assessment and action plan. A technical audit requires a separately agreed scope and appropriate authorization.