Client: Startup incubated in the NextAI ecosystem, with support from INCIBE
Decentralised code management and accelerated cloud growth raised the risk of critical vulnerabilities.
We built proprietary continuous auditing technology that analyses code, dependencies and configurations in CI/CD pipelines with contextual AI-based SAST and DAST, prioritising by criticality, with technical and methodological support from the National Cybersecurity Institute.
Anatomy of the solution
From input to outcome: explore the four parts of the journey.
Project repositories, dependencies and configurations.
Explanatory diagram based on the described solution. It simplifies the journey; it is not a deployed infrastructure diagram or a live monitor.
Reading the project
Growing code, dependency and configuration volumes make consistent review difficult. This case places analysis within CI/CD so security becomes part of development. The aim is not more alerts but better context for prioritising review.
SAST and DAST cover different analytical perspectives. Including dependencies, configuration and severity helps interpret a finding within the system. GitHub Actions integration puts that information where software is built and delivered.
Current relevance and possible evolution
This is aligned with Superagents through a specialist role within a process. An extension could prepare fixes and tests; accepting changes or deploying to production should retain explicit review controls.
This connects the case experience to our current services. Proposed extensions are not presented as features already delivered.
Method and scope
Specify the reference vulnerability set, false positives and negatives, severity and review time. Detection and remediation are different outcomes.
The INCIBE support described in the case should not be read as universal product certification or a guarantee that vulnerabilities are absent.
Basis of this analysis: the description, capabilities and stack published in this case. No new measurements are added and no independent audit of its results is implied.
One hour, no sales deck: we analyse your operation and tell you what can be built, where to start and what is not worth touching yet.
Nora helps you choose. Our team scopes your project.
We use essential cookies so the site works and, only if you accept them, analytics and campaign measurement cookies. You can change your decision whenever you like. Cookie policy
