Skip to main content
Version: 1.5.2

General information

The TRON.ASOC platform is a unified system for vulnerability management and security control across all stages of the software development life cycle (DevSecOps). The product serves as a centralized hub that aggregates, normalizes, and analyzes data from dozens of security tools, turning disparate scan results into manageable business processes.

Seamless integration and security ecosystem​

The platform serves as a universal connector for an extensive security tool stack, supporting both proprietary and open-source solutions:

  • Deep SAST: PT Application Inspector, Solar AppScreener (supports both source and binary code), PVS-Studio, Semgrep, GitLab Advanced SAST, SASTAV, ESLint.
  • Container and IaC security: Kaspersky Container Security, Trivy, Grype, Aqua, KICS.
  • SCA/OSA (software composition analysis): CodeScoring, OWASP Dependency Track.
  • Artifact management: JFrog.
  • Mobile platform security: AppSec.Sting (analysis of ready-made .apk/.ipa builds).
  • Code and secret security: Gitleaks (hardcoded secret detection).

The platform doesn't just receive reports—it also manages the scanning process by initiating checks, configuring parameters, and scheduling runs.

A critical feature is the ability to manually add vulnerabilities (Manual), which lets you include the results of internal audits and penetration tests in the overall statistics.

Vulnerability management​

TRON ASOC transforms the process of handling identified defects from reactive to proactive.

Users can assess the severity and business impact of vulnerabilities, change their statuses, and assign priorities for developers.

Built-in commenting mechanisms enable seamless communication between security professionals and developers directly in the context of a specific issue.

A flexible exception system (False Positive, Accepted Risk), with configurable validity periods and rule scopes, prevents users from revisiting resolved issues and helps them focus on current threats.

Release quality and quality gates​

The platform implements the concept of quality gates at every stage of the security pipeline.

Using acceptance criteria, users can configure quality metrics for each scan—for example, “critical vulnerabilities are prohibited” or “the defect density threshold hasn't been exceeded.”

Based on these criteria, TRON ASOC automatically determines whether the checks have passed successfully and blocks the product from transitioning to the next stage—for example, production—if it doesn't meet security standards.

Analytics, reporting, and forecasting​

The platform also lets users visualize and assess DevSecOps processes.

Interactive dashboards provide a clear, real-time view of project security status.

Accumulated historical data lets users do more than confirm the presence of vulnerabilities—it helps them forecast risks and assess the codebase's remediation progress.

Users can also export detailed reports in various formats for integration with corporate GRC and SIEM systems.

Architecture and enterprise infrastructure​

The platform doesn't require external CI pipelines to operate, which makes it possible to implement a secure development culture even in environments with strict security policies or isolated networks.

LDAP, Active Directory, and SSO support lets administrators manage user accounts centrally.

Flexible access control configuration (RBAC) lets organizations differentiate permissions among developers (viewing and remediation), security analysts (verification and rejection), and auditors (view-only).