See your compliance posture
in seconds.

Most security tools find vulnerabilities. AEGIS finds them, proves they're exploitable, generates the patch, verifies the patch preserves behavior, and produces signed evidence at every step. Seven governed agent stages, one command, full provenance chain.

AEGIS doesn’t run as one process; it runs as seven, each operating under its own consequence-tier authorization. A T3 exploit-proof attempt cannot execute without sandbox containment. A T4 deployment cannot proceed without human approval. The system cannot escalate its own authority — every tier transition produces a hash-chained provenance entry that auditors can independently verify.

The free npx scan runs the full Rust engine — tree-sitter AST parsing, cross-file taint analysis, call graph construction — and produces a readiness indicator for nine compliance frameworks. Pass / warn / fail status, percentage toward each baseline, and the gap that's blocking it. Capped at 50 findings.

The free scan covers nine frameworks at the traffic-light level. A product key unlocks the full 12-framework unified mapping, including FedRAMP 20x, DoD SRG, SEC/FINRA, and EU AI Act — plus unlimited findings and the full 45 report format set (OSCAL packages, DORA pillar mapping, FedRAMP ConMon, SBOM, evidence bundles).

Not regex. Not heuristics. Full abstract syntax tree parsing via tree-sitter, with inter-procedural call graph construction and cross-file taint analysis.

Every scanner produces findings in a normalized format. SARIF 2.1.0 output is standard. Cross-file taint analysis traces data flow across module boundaries. 43 analysis modules across the six scanner types, with six graph modules providing call-graph and taint reachability.

Every SAST tool on the market tells you what’s broken. FedRAMP, SOC 2, and ISO 27001 also require evidence of what’s implemented — what controls are present, what policies are enforced, what security architecture is in place. That evidence doesn’t exist in a vulnerability report.

AEGIS detects implemented security controls directly from your codebase. 68 detection patterns across 12 NIST 800-53 control families. Each detection produces an OSCAL control implementation statement — the exact artifact auditors and 3PAOs consume.

Code scans cover technical controls. Organizational controls — access policies, incident response procedures, training requirements — live in ISMS documents. AEGIS ingests your ISMS markdown and maps 19 policy sections to 101 NIST controls, producing OSCAL statements for procedural evidence that code analysis can’t reach.

The merge logic prefers code evidence (automated, verifiable) and supplements with ISMS evidence for procedural controls. Controls covered by both sources receive a “defense-in-depth” designation — stronger evidence for auditors.

Every finding maps to controls across all twelve frameworks simultaneously. Context-aware risk adjustment factors reachability, exposure, and compensating controls into the final score.

Reachability is computed by the call graph and taint analysis, not assumed. A finding in dead code carries a 0.3x multiplier; a finding in vendor dependencies carries 0.0x. The customer sees severity scored against what’s actually reachable in their topology, not against worst-case configuration.

No other scanning tool produces OSCAL, DORA pillar mapping, VEX, and CycloneDX SBOM from a single pass over the same provenance chain. Every report is signed, timestamped, and independently verifiable. Group them by who reads them:

Not just a scan report. A verifiable evidence chain. Every pipeline action produces a hash-chained provenance entry with algorithm-agile cryptography. SLSA-compatible export.

The Rust engine — AST parsing, taint analysis, call graph, the seven-stage pipeline — is the same in every tier. Higher tiers unlock additional output formats, framework coverage, and operational features. Not a more capable analyzer.

AEGIS is the entry point. Stage 0 is free and runs locally. Stages 1 and 2 unlock when you need audit-grade evidence or third-party certification.

AEGIS rebrands. Partners deploy the same engine under their own company name, logo, colors, and product name. Your prospects never need to know what AEGIS is — they see your brand and get a diagnostic from their own code.

When a prospect runs a white-labeled scan, the structured output (framework percentages, severity counts, missing capabilities) is exportable to the partner's CRM as structured fields. This is not a PDF attachment — it is lead qualification data that pre-scopes the engagement.

1.5M LOC in 40 seconds for a full analysis pass. File scanning throughput peaks at 6.7M LOC in 5 seconds. Delta scans (--changed-only) complete in under one second. The Rust engine runs entirely locally — no source code leaves the machine, no LLM is invoked in the analysis pipeline. The engine is deterministic: same input produces the same output, byte-for-byte, including provenance hashes.

Every stage runs under consequence-tier gating (T1 reversible read → T4 external side effect). Each action produces a hash-chained provenance entry. The chain is append-only and independently verifiable.

Not hypothetical capabilities. Measured results against industry-standard test suites and production codebases.

AEGIS findings feed directly into the Raknor certification decision. The following cybersecurity conditions result in certification denial regardless of governance score: