See your compliance posture
in seconds.

In 2016, DARPA’s Cyber Grand Challenge proved something the security field had only theorized: a machine could find a vulnerability, prove it was exploitable, and patch it — with no human in the loop. DARPA called the category a Cyber Reasoning System (CRS). Nine years later, the AI Cyber Challenge extended it to real-world open-source software. The capability is no longer in question. Machines can reason about code.

What the challenge systems were never asked to do is account for themselves. A finding appeared, an exploit worked, a patch shipped — and nothing in the architecture could tell you why the system decided what it decided, prove it hadn’t been manipulated, or stop it before it acted. In a competition arena, that’s fine. In a regulated enterprise, an autonomous system that can’t explain or be governed isn’t an asset. It’s an unbounded liability.

That gap is the reason AEGIS exists. We call what we built an Autonomous Cybersecurity Reasoning System — an ACRS. It descends directly from the CRS that DARPA proved out, and adds the layer those systems never had: governance that lives outside the reasoning engine.

The CRS lineage reasoned about code deterministically — program analysis, call-graph reachability, source-to-sink taint — not by asking a model to guess. AEGIS keeps that discipline where it matters most: the shipping static-analysis engine has no LLM dependency. No hallucinated findings, no confidence-score roulette, results a second run reproduces exactly. Cross-file taint tracing across 7 languages, pattern-level coverage for 7 more, 115 detection patterns covering 126 CWE classes, and 13 compliance frameworks.

Reachability is the engine, not a score. Most tools hand you a flat list and leave triage to you. AEGIS traces whether a vulnerable pattern is actually reachable from an entry point on a tainted path — the difference between a finding and an exploitable finding. As AI-assembled code ships at scale, the bottleneck stops being finding patterns and becomes discriminating the reachable few from the inert many. That discrimination is what an ACRS is built to do.

Most security tools find vulnerabilities. AEGIS finds them, traces whether they’re reachable from an entry point on a tainted path, and produces signed evidence at every step. Three governed agent stages, one command, full provenance chain.

AEGIS doesn’t run as one process; it runs as three detection stages, each operating under its own consequence-tier authorization. The system cannot escalate its own authority — every tier transition produces a hash-chained provenance entry that auditors can independently verify.

The free npx scan runs the full Rust engine — tree-sitter AST parsing, cross-file taint analysis, call graph construction — and produces a readiness indicator for nine compliance frameworks. Pass / warn / fail status, percentage toward each baseline, and the gap that's blocking it. Capped at 50 findings.

The free scan covers nine frameworks at the traffic-light level. A product key unlocks the full 13-framework unified mapping, including FedRAMP 20x, DoD SRG, SEC/FINRA, and EU AI Act — plus unlimited findings and 40 signed report formats (OSCAL packages, DORA pillar mapping, FedRAMP ConMon, SBOM, evidence bundles).

Not regex. Not heuristics. Full abstract syntax tree parsing via tree-sitter, with inter-procedural call graph construction. Cross-file taint tracing across 7 languages (TypeScript/JavaScript, Python, Java, Go, PHP, C#, Kotlin). Pattern-level coverage for 7 additional languages. Depth varies by language — see coverage detail below.

Every scanner produces findings in a normalized format. SARIF 2.1.0 output is standard. Cross-file taint analysis traces data flow across module boundaries. 43 analysis modules across the six scanner types, with six graph modules providing call-graph and taint reachability.

Every SAST tool on the market tells you what’s broken. FedRAMP, SOC 2, and ISO 27001 also require evidence of what’s implemented — what controls are present, what policies are enforced, what security architecture is in place. That evidence doesn’t exist in a vulnerability report.

AEGIS detects implemented security controls directly from your codebase. 68 detection patterns across 12 NIST 800-53 control families. Each detection produces an OSCAL control implementation statement — the exact artifact auditors and 3PAOs consume.

Code scans cover technical controls. Organizational controls — access policies, incident response procedures, training requirements — live in ISMS documents. AEGIS ingests your ISMS markdown and maps 19 policy sections to 101 NIST controls, producing OSCAL statements for procedural evidence that code analysis can’t reach.

The merge logic prefers code evidence (automated, verifiable) and supplements with ISMS evidence for procedural controls. Controls covered by both sources receive a “defense-in-depth” designation — stronger evidence for auditors.

Every finding maps to controls across all thirteen frameworks simultaneously. Context-aware risk adjustment factors reachability, exposure, and compensating controls into the final score.

Reachability is computed by the call graph and taint analysis, not assumed. A finding in dead code carries a 0.3x multiplier; a finding in vendor dependencies carries 0.0x. The customer sees severity scored against what’s actually reachable in their topology, not against worst-case configuration.

No other scanning tool produces OSCAL, DORA pillar mapping, VEX, and CycloneDX SBOM from a single pass over the same provenance chain. Every report is signed, timestamped, and independently verifiable. Group them by who reads them:

Not just a scan report. A verifiable evidence chain. Every pipeline action produces a hash-chained provenance entry with algorithm-agile cryptography. SLSA-compatible export.

The Rust engine — AST parsing, taint analysis, call graph — is the same in every tier. Higher tiers unlock additional output formats, framework coverage, and operational features. Not a more capable analyzer.

AEGIS is the entry point. Stage 0 is free and runs locally. Stages 1 and 2 unlock when you need audit-grade evidence or third-party certification.

AEGIS rebrands. Partners deploy the same engine under their own company name, logo, colors, and product name. Your prospects never need to know what AEGIS is — they see your brand and get a diagnostic from their own code.

When a prospect runs a white-labeled scan, the structured output (framework percentages, severity counts, missing capabilities) is exportable to the partner's CRM as structured fields. This is not a PDF attachment — it is lead qualification data that pre-scopes the engagement.

1.5M LOC in 40 seconds for a full analysis pass. File scanning throughput peaks at 6.7M LOC in 5 seconds. Delta scans (--changed-only) complete in under one second. The Rust engine runs entirely locally — no source code leaves the machine, no LLM is invoked in the analysis pipeline. The engine is deterministic: same input produces the same output, byte-for-byte, including provenance hashes.

Every stage runs under consequence-tier gating (T1 reversible read → T4 external side effect). Each action produces a hash-chained provenance entry. The chain is append-only and independently verifiable.

Not hypothetical capabilities. Measured results against industry-standard test suites and production codebases.

AEGIS findings feed directly into the Raknor certification decision. The following cybersecurity conditions result in certification denial regardless of governance score: