Skip to main content
Version: 1.5

Overview

The TRON.ASOC platform is a unified system for vulnerability management and security control across all stages of the software development lifecycle (DevSecOps). The product serves as a centralized hub that aggregates, normalizes, and analyzes data from dozens of security tools. It turns disparate scan results into manageable business processes.

Seamless integration and the security ecosystem​

The platform serves as a universal connector for an extensive security tool stack. It supports both proprietary and open-source solutions:

  • Advanced SAST: PT Application Inspector, Solar AppScreener (supports both source and binary code), PVS-Studio, Semgrep, GitLab Advanced SAST, SASTAV, ESLint.
  • Container and IaC security: Kaspersky Container Security, Trivy, Grype, Aqua, KICS.
  • SCA/OSA (software composition analysis): CodeScoring, OWASP Dependency-Track.
  • Artifact management: JFrog.
  • Mobile platform security: AppSec.Sting (analyzes ready-to-use .apk/.ipa builds).
  • Code and secret security: Gitleaks (searches for hardcoded secrets).

The platform not only receives reports but also manages the scanning process. It initiates checks, configures parameters, and schedules scans.

The ability to manually add vulnerabilities (Manual) is a critical feature. It lets you include internal audit and penetration testing results in the overall statistics.

Vulnerability management​

TRON ASOC transforms defect handling from a reactive process into a proactive one.

Users can assess the severity and business impact of vulnerabilities, change their statuses, and assign priorities to developers.

Built-in commenting features enable seamless communication between security specialists and developers directly in the context of a specific issue.

A flexible exception system (False Positive, Accepted Risk) lets you configure rule duration and scope. This prevents teams from revisiting resolved issues and helps them focus on current threats.

Release quality and quality controls (Quality Gates)​

The platform implements the concept of Quality Gates at every stage of the security pipeline.

Users can define quality metrics for each scan with acceptance criteria, for example, “critical vulnerabilities are prohibited” or “the defect density threshold hasn't been exceeded.”

Based on these criteria, TRON ASOC automatically determines whether the product successfully passed the verification stage. If it doesn't meet security standards, the platform blocks the transition to the next stage, for example, to production.

Analytics, reporting, and forecasting​

The platform also helps users visualize and evaluate DevSecOps processes.

Interactive dashboards provide clear, real-time information about project security status.

Historical data lets users do more than confirm the presence of vulnerabilities. It also helps them forecast risks and track the codebase's recovery over time.

Users can also export detailed reports in various formats for integration with enterprise GRC and SIEM systems.

Architecture and enterprise infrastructure​

The platform doesn't require external CI pipelines to operate. This lets organizations implement a secure development culture even in environments with strict security policies or isolated networks.

Support for LDAP, Active Directory, and SSO enables centralized account management.

Flexible role-based access control (RBAC) separates permissions for developers (viewing and remediation), security analysts (verification and rejection), and auditors (view-only).