Skip to content
AINO Information

VAST platform

Every finding, from scanner to verified fix, on your own infrastructure.

VAST (Vulnerability Assessment Scanning Tool) is the platform we built to run our own assessments and that our clients run in-house. It turns scanner output into work that gets done and checked.

The pipeline

Scan with DAST, SAST or SCA engines; import findings with evidence; open a ticket with an owner and due date; retest each finding; report the verified state.

  1. 01

    Scan

    VAST dispatches work to scanner agents installed on your own Windows hosts. Website scans run WebInspect against the running application; source code scans run Fortify SCA, Sonatype Nexus IQ, or VAST's own AI scan on an uploaded source tree. One batch can run several engines at once.

  2. 02

    Findings

    Every engine's output is imported into one vulnerability record per weakness per release, with its evidence: request and response for a website finding, data-flow trace and code snippet for a source code finding. The same weakness reported again by the next scan updates the record instead of duplicating it.

  3. 03

    Ticket

    A finding becomes a ticket with an owner and a due date set by severity and environment. Owners can request a false-positive review, an extension or a transfer; an approver accepts or rejects. Tickets can be switched off entirely for deployments that only want the findings.

  4. 04

    Retest

    A retest re-runs the scanner against the selected findings only, and decides per finding. For source code, your fixed files are laid over the original scan so the verdict compares like with like. A finding is marked fixed only by a recheck, never by a person.

  5. 05

    Report

    Word and PDF reports from any completed scan, with the verified state of each finding. Fortify-format result files can be opened in Fortify tools or uploaded to Fortify SSC automatically.

In the product

What it looks like

Captured from a demo instance scanning public test applications (OWASP WebGoat, OpenText IWA).

  • VAST overview dashboard: severity cards for critical, high, medium and low, a severity donut, and a severity-by-application heat map.
    Overview: severity per application, filtered to the applications you own.
  • Application vulnerabilities list with severity tabs, source filter, and an AI analysis column showing Exploitable chips.
    Findings per application, with the AI verdict beside each one and retest or filter actions on the row.
  • Vulnerability detail dialog on the AI Verdict tab: Exploitable, a checklist of source, path and sink with the evidence line quoted, and agree or disagree buttons.
    AI verdict for one finding: the checklist it was derived from, the code it quotes, and the reviewer's agree or disagree.
  • Scans list filtered to completed scans, showing scan tools, severity counts and AI analysis status per task.
    Scans: engines used, severity counts, and whether AI analysis has run.
  • Scanner agents page listing a Linux and a Windows agent, online, with their modules, CPU and memory.
    Scanner agents on your own hosts, with the engines each one carries and its live load.
  • AI model configuration page: local LLM endpoint, model name, and the findings-at-once and scans-at-once limits.
    AI model settings: a local OpenAI-compatible endpoint, and two limits that size the load on the GPU host.

Platform

What is in the box

A React web interface, a Go backend on PostgreSQL, and Go scanner agents on your scanner hosts. Scanner engines are your own licences; VAST drives them.

Dashboard
Severity distribution and ticket status per application, filtered by what the user owns.
Assets and releases
Applications, releases, authentication configuration (Basic, Form, OAuth, API key, JWT, login macro) and scan scope.
Scans
Batch scans and retests with progress, logs, result download and manual ticket creation.
Tickets
My tickets, batch retest, batch requests; an approvals queue for reviewers.
Reports
Generated from completed scans; multi-chart Word reports.
Configuration
Scanner registration and heartbeat, users, five roles with custom permission sets, LDAP sign-in, ticket due-date policy, operation log.

Integrates with OpenText Fortify SCA, OpenText WebInspect, Sonatype Nexus IQ and Fortify SSC. Product names are trademarks of their respective owners.

AI assistance

The AI gathers evidence and gives a first opinion. People decide.

Scanners find; confirming and fixing still land on people. VAST's on-premises language model reads the evidence the scanner captured and produces a judgement that can be checked quickly, not a conclusion that must be trusted.

  • Four-way verdict, with the evidence quoted

    For each critical or high finding the model answers: exploitable, hardening needed, false positive, or uncertain. It must quote the code or response it based that on; when evidence is missing it says uncertain rather than guessing.

  • Remediation and a code-fix draft

    Root cause, fix approach and a safe pattern for the actual language and framework, plus a before/after draft the developer can start from.

  • Advisory, never in charge

    The AI never closes a ticket, never changes risk, never marks a false positive. Deterministic retests and filters remain the only source of truth.

  • Knowledge you own

    Reviewers' corrections accumulate into a versioned knowledge base that stays in your deployment. Every model call is archived with the prompt, the knowledge used and the answer, so a judgement can be traced.

  • Fully on-premises

    The platform, the scanner agents and the language model all run inside your network. Source code, findings and model inference never leave it, and the model host needs no internet access.

AI scan

Source code scanning without a third-party scanner

VAST's own source code scan: our engine derives facts and leads from the code deterministically; the on-premises model reads those facts and judges. Clients who only tick AI scan need no Fortify licence, no scanner host and no build environment.

  1. 1.Upload source; no build, no compiler needed.
  2. 2.Hand-written parsers for Java, C#, VB.NET and JSP produce a language-neutral code model; JavaScript and TypeScript parse today, detection knowledge is being built.
  3. 3.Six analyzers (taint propagation, semantic, structural, control-flow, configuration, content) produce deterministic leads: the same code always yields the same leads.
  4. 4.The on-premises model judges each candidate: confirmed, uncertain, or rejected. A rejection must quote the code; uncertain always counts as a finding.
  5. 5.Results enter the same pipeline as Fortify findings and are written as an FPR file.

Deployment

On-premises, sized to your team

A platform host, one or more scanner hosts, and, for AI assistance, one GPU host that only serves the model. A desktop-class AI host covers a single team; a workstation-class GPU covers several teams and large batches. We benchmark on your hardware with your own findings before go-live.

Ask for a demo