Skip to main content
Version: 1.5.1

Overview

The TRON.ASOC platform is a unified system for vulnerability management and security controls throughout the software development lifecycle (DevSecOps). The product serves as a centralized hub that aggregates, normalizes, and analyzes data from dozens of security tools, turning scattered scan results into manageable business processes.

Seamless integration and the security ecosystem​

The platform serves as a universal connector for a broad stack of information security tools and supports both proprietary and open-source solutions:

  • Advanced SAST: PT Application Inspector, Solar AppScreener (supports both source and binary code), PVS-Studio, Semgrep, GitLab Advanced SAST, SASTAV, ESLint.
  • Container and IaC security: Kaspersky Container Security, Trivy, Grype, Aqua, KICS.
  • SCA/OSA (software composition analysis): CodeScoring, OWASP Dependency Track.
  • Artifact management: JFrog.
  • Mobile platform security: AppSec.Sting (analysis of ready-made .apk/.ipa builds).
  • Code and secrets security: Gitleaks (hardcoded secret detection).

The platform doesn't just receive Reports—it also manages the scanning process: it initiates checks, configures parameters, and schedules Scans.

A critical feature is the ability to manually add Vulnerabilities (Manual), which lets you include the results of internal audits and penetration tests in the overall statistics.

Vulnerability management​

TRON ASOC transforms the process of handling detected defects from reactive to proactive.

Users can assess the severity and business impact of Vulnerabilities, change their statuses, and assign priorities to developers.

Built-in commenting mechanisms enable seamless communication between information security specialists and developers directly in the context of a specific issue.

A flexible exception system (False Positive, Accepted Risk), with configurable validity periods and rule scopes, prevents users from revisiting resolved issues and lets them focus on current threats.

Release quality and quality gates​

The platform implements the concept of Quality Gates at every stage of the security pipeline.

Using acceptance criteria, users can configure quality Metrics for each scan—for example, "critical Vulnerabilities are prohibited" or "the defect density threshold hasn't been exceeded."

Based on these criteria, TRON ASOC automatically determines whether the product has successfully passed the verification layer. If it doesn't meet security standards, the platform blocks the product's Transition to the next stage, such as production.

Analytics, reporting, and forecasting​

The platform also lets users visualize and evaluate DevSecOps processes.

Interactive dashboards provide clear, real-time information about the security status of projects.

Accumulated historical data lets users do more than confirm the presence of Vulnerabilities. It also helps them forecast risks and assess the codebase's recovery over time.

Users can also export detailed Reports in various formats for integration with corporate GRC and SIEM systems.

Architecture and corporate infrastructure​

The platform doesn't require external CI pipelines to operate, which lets organizations implement a secure development culture even in environments with strict security policies or isolated networks.

Support for LDAP, Active Directory, and SSO enables centralized account management.

Flexible access control configuration (RBAC) lets administrators separate capabilities among developers (viewing and remediation), information security analysts (verification and rejection), and auditors (view-only).