WHY “ONE VANTAGE”
Two views of the same estate, correlated instead of separate.
What your code, containers and cloud config actually say
Static analysis, secret and dependency scanning, infrastructure-as-code checks, container and Kubernetes audits, and cloud posture across GCP, AWS and Azure. All of it reads the estate as it is configured, before anything ships.
What an attacker sees from the internet
Active web, API and network testing against whatever is actually reachable — the same vantage point available to anyone outside your perimeter, not a diagram of what should be exposed.
Both feeds, one findings model
Every result from every scanner and every imported report is normalised, deduplicated by fingerprint, correlated into attack paths where inside and outside findings describe the same exposure, and ranked by what is reachable.
SCANNER COVERAGE
22 packs, one orchestration layer.
Open-source scanners, run the same way every time: version-pinned, content-verified, dispatched as isolated jobs and normalised into one model. Passive packs run on every plan; active packs run on Business and above, against targets you have authorised.
Static analysis
Semgrep
Leaked credentials
Gitleaks · TruffleHog
Vulnerable packages
Trivy · govulncheck (Go modules)
Misconfiguration before apply
Checkov
Images, clusters, nodes
Trivy image · Trivy k8s · kube-bench
GCP, AWS and Azure
Prowler · ScoutSuite
Active testing (VAPT)
Nuclei · OWASP ZAP · Nikto · Schemathesis
What is exposed and reachable
Nmap · Subfinder · Nuclei network templates
ALREADY PAY FOR OTHER SCANNERS?
Bring their findings into the same queue.
Upload reports or pull them over API from the tools your team already runs, and they are deduplicated against everything Holonix scans itself.
THREE WAYS TO RUN A SCAN
Wherever the target is, there is a mode that reaches it.
The modes are independent — a customer can use one, two or all three — and every finding lands in the same store with the same fingerprint deduplication. Findings record how they were produced, because the platform cannot vouch for a tool it did not run.
Holonix runs the scanner
Each scan is an ephemeral Kubernetes Job, isolated per tenant and gone when the run ends. Scanners never touch the database. Needs a credential — or nothing at all for a public domain or host.
A runner inside the customer’s network
A Go runner scans from inside, then returns a signed, encrypted bundle. Built for internal networks, air-gapped sites and customers who will not open an inbound port.
Their pipeline runs the scanners
GitHub and GitLab merge requests get findings on the diff; any other CI uses the sp-scan command. Holonix reads the reports and returns a verdict — one that never blocks a release because Holonix itself is down.
HOW IT RUNS
Discover, scan, correlate, prioritise, fix, prove.
Discover
Assets are enrolled from cloud accounts, repositories, domains and customer-hosted connectors — the inventory a scan needs before it can run.
Scan or import
Run scanners as ephemeral jobs, through a connector, or from CI — or import reports from the tools you already pay for. Everything lands in one store.
Normalise & correlate
Every result is mapped into one findings model and deduplicated by fingerprint, so the same exposure never shows up three times.
Prioritise
Reachability and attack-path analysis separate what is exploitable in your estate from what is merely present, and every priority carries its rationale.
Fix
Group related findings into one ticket, track SLA clocks, and retest to confirm a fix actually landed.
Prove
Map findings to the frameworks you report against, then export evidence packs, attestations and branded reports.
INTELLIGENCE
Ranking by what an attacker could actually use.
Findings joined into the route an attacker would walk
A graph of assets, exposure, credentials and leaked secrets is evaluated against correlation rules, so an exposed service plus a leaked key plus a weak role reads as one path, not three unrelated tickets. Recomputed after every ingest and again nightly.
Is the vulnerable code actually called?
Call-graph and import analysis filters dependency findings down to the ones your code genuinely reaches, so a critical CVE in a package nothing imports stops outranking a real exposure.
Every score comes with its reasons
Priority is re-derived nightly and whenever the evidence changes, with the rationale stored beside it, so a reviewer can see why a finding is at the top instead of taking the number on faith.
False positives your team calls once, not every scan
Triage decisions feed back into per-rule false-positive rates and calibration, so noisy detections are demoted and the same dismissal is not repeated on the next run.
WORKFLOW
From a finding to a closed ticket, without leaving the queue.
Built for volume
A virtualised queue with persistent filters, bulk edit, finding templates, similar-finding detection, CVSS, and request/response evidence on the finding itself.
Due dates that are stored, not guessed
Each finding carries a stored due date kept current as severity or policy changes, so the queue sorts by what is actually overdue. Breaches are noted on the linked ticket.
Finding groups as one ticket
Push a group of related findings to Jira or ServiceNow as a single ticket, map ticket resolutions back onto findings, and keep SLA comments in sync on the ticket.
Accepted risk with a second pair of eyes
Risk acceptance with peer review, notes on every finding, and a full audit log of who decided what and when. Retest confirms FIXED rather than trusting a status change.
Structure for assessments and pipelines
Engagements with tests, presets, calendar, auto-close and documents; CI/CD engagements; OWASP ASVS and custom checklists; and an asset intake questionnaire.
Home, metrics and search
A portfolio home, metrics in your organisation’s own time zone, an alerts inbox, and ⌘K search. Alerts reach your team by email, Slack or Microsoft Teams.
COMPLIANCE & REPORTING
Findings mapped to the frameworks you answer to.
Compliance packs map findings to controls, show the gaps, and assemble evidence packs and attestations for the audit itself. Reports export as PDF, Word or Excel from templates you can brand.
Control mappings are working subsets of each framework, there to support your assessment and audit evidence. They are not a certification or an attestation of compliance on their own.
ACCESS & CUSTOMERS
Built for security teams, and for the practices that serve them.
SSO, SCIM and self-service TOTP
Federate through SAML or OIDC, provision through SCIM, and let every person enrol and remove their own authenticator.
Custom roles and API tokens
Define your own permission sets, issue scoped API tokens, and keep a tenant from ever stranding itself without a user-management role.
Scoped viewers for your customers
Give a client read access limited to their own products or business units, enforced in the database rather than in the interface.
Run it as your own security practice
Onboard each customer as an isolated workspace, move them through onboarding, active, suspended and offboarded, and hand back a data export at the end.
SECURITY — HOLONIX
A platform that holds credentials to your estate has to be held to a higher standard.
Holonix runs credentials against your code and your cloud. That access is scoped, ephemeral and isolated by construction — not by a policy that asks engineers to remember.
Scanners exist only for the scan
Platform-run scans are ephemeral Kubernetes jobs, dispatched per run and torn down when it ends. There is no always-on scanner holding credentials between runs.
Row-level security, not application trust
Every tenant-scoped table carries a Postgres RLS policy evaluated on every query. Isolation does not depend on every code path remembering to filter by tenant.
No verification, no scan
An active scan is refused until the target has a completed verification and a scope document. Holonix will not test what you have not proved you are entitled to test.
Every image signed and verified
Platform images are signed with a key held in a cloud KMS and verified against a pinned public key before they are released to production.
Pass, fail, or honestly neutral
If Holonix cannot evaluate a pull request, the check says neutral, never pass and never a hard failure. A gate that blocks releases when the tool is broken gets switched off within a week.
Secrets encrypted under a managed key
Scan credentials and integration secrets are held in a vault encrypted under a key-management-service master key, opened only for the job that needs them.
Entitlements, not if-statements
A tenant’s plan changes only through a platform operator or a signature-verified billing event. Feature access is a lookup against the plan in force, never a branch in code.
Every access and plan change is recorded
Who changed what, from which source, and why — written to the tenant’s own audit trail at the time it happened, not reconstructed afterwards for a review.
PRICING
Every plan meters the same five limits. Only the ceiling changes.
Assets, scan minutes, retained findings, storage and concurrent scans — enforced per tenant, on the plan actually in force. Active scanning, connectors, SSO and compliance packs are feature-gated by plan.
Free
Passive scanning for a small estate.
- Assets10
- Scan minutes / mo300
- Retained findings5,000
- Storage1 GB
- Concurrent scans1
- ✓Every passive scanner: code, secrets, dependencies, IaC, containers, Kubernetes, cloud posture
- ✓Findings model, triage queue, ticketing, reports
- —Active scanning (web, API, network VAPT)
- —Connectors
- —SSO / SCIM
- —Compliance packs
Team
Connectors and compliance packs for a growing team.
- Assets100
- Scan minutes / mo3,000
- Retained findings50,000
- Storage10 GB
- Concurrent scans3
- ✓Everything in Free
- ✓Customer-hosted connectors
- ✓Compliance packs, evidence and attestations
- —Active scanning (web, API, network VAPT)
- —SSO / SCIM
Business
Active VAPT, SSO and a larger estate.
- Assets1,000
- Scan minutes / mo20,000
- Retained findings500,000
- Storage100 GB
- Concurrent scans10
- ✓Everything in Team
- ✓Active scanning: Nuclei, ZAP, Nikto, Schemathesis, Nmap
- ✓Enterprise SSO (SAML/OIDC) + SCIM
Enterprise
No platform limits. Run by SISLCloudWorx.
- AssetsUnlimited
- Scan minutes / moUnlimited
- Retained findingsUnlimited
- StorageUnlimited
- Concurrent scansUnlimited
- ✓Everything in Business
- ✓Unlimited assets, scans and storage
- ✓Consultant-managed engagement
Free is self-serve and requires no card. Team and Business are priced per estate on a call with our team; Enterprise is a consultant-managed engagement scoped to your environment.
FAQ
Questions worth answering up front.
Does Holonix replace tools like Semgrep, Nuclei and Prowler, or run on top of them?
It orchestrates them. Holonix runs 22 open-source scanner packs — including Semgrep, Gitleaks, TruffleHog, Trivy, Checkov, Prowler, ScoutSuite, Nuclei, OWASP ZAP and Nmap — as ephemeral Kubernetes jobs, then normalises every result into one findings model, deduplicated and correlated across scanners, so your team works one queue instead of a console per tool.
We already use other scanners. Can we keep them?
Yes. Holonix imports reports from Burp Suite, Acunetix, OWASP ZAP, Nessus, Tenable, Qualys, OpenVAS, Checkmarx, SonarQube, Snyk, Dependency-Check, Grype, Trivy, GitHub code scanning, Dependabot and GitHub secret scanning, plus any tool that emits SARIF or CycloneDX VEX. Imported findings are deduplicated against everything Holonix scans itself.
How is our tenant data isolated from every other customer on the platform?
With PostgreSQL row-level security enforced at the database layer, not application code you have to trust blindly. Every tenant-scoped table carries a policy that only opens for that tenant’s own session. Platform-run scanners are short-lived Kubernetes jobs that exist only for the duration of a scan and never touch the database.
Can Holonix plug into our CI/CD pipeline without risking our releases?
Yes. GitHub and GitLab merge requests get findings on the diff, and any other CI system uses the sp-scan command. The gate fails open by design: if Holonix cannot evaluate a change, the check reports neutral rather than pass or a hard failure, so an outage on our side never blocks your release.
Will Holonix scan systems we have not authorised?
No. Active scanning — web, API and network testing — is refused until the target has a completed verification and a scope document, and it is only available on the Business plan and above. Passive scanners that read code, configuration and cloud posture run on every plan.
Can it scan inside a network we cannot open to the internet?
Yes. In connector mode a Go runner is deployed inside the customer’s network, scans from there and returns a signed, encrypted bundle. It suits internal networks and air-gapped sites that allow no inbound access. Connectors are available from the Team plan.
Does mapping to RBI, CERT-In, ISO 27001 or PCI-DSS make us compliant?
No, and Holonix does not claim it does. Compliance packs map findings to controls across RBI, CERT-In, DPDP, ISO/IEC 27001, PCI-DSS 4.0, SOC 2 and CIS Controls v8, show the gaps, and assemble evidence packs and attestations to support your assessment. The mappings are working subsets of each framework, not a certification.
What actually changes between the Free, Team, Business and Enterprise plans?
Free is passive scanning for a small estate. Team adds customer-hosted connectors and compliance packs for a growing one. Business adds active scanning and enterprise SSO for a larger one. Enterprise removes every platform limit for consultant-managed engagements run by SISLCloudWorx. All plans meter the same five limits: assets, scan minutes, retained findings, storage and concurrent scans.
See your estate from both sides.
Bring a real estate to the walkthrough — your own repos, cloud accounts and internet-facing assets, correlated in one findings model.