Skip to main content
Version: 1.6.1

General information

The TRON.ASOC platform is a unified system for vulnerability management and security control throughout the software development life cycle (DevSecOps). The product serves as a centralized hub that aggregates, normalizes, and analyzes data from dozens of security tools, turning disparate scan results into manageable business processes.

Seamless integration and the security ecosystem​

The platform serves as a universal connector for an extensive stack of information security tools, supporting both proprietary and open-source solutions:

  • SAST: PT Application Inspector, Solar AppScreener (supports both source and binary code), PVS-Studio, Semgrep, GitLab Advanced SAST, SASTAV, ESLint.
  • Container and IaC security: Kaspersky Container Security, Trivy, Grype, Aqua, KICS.
  • SCA/OSA (software composition analysis): CodeScoring, OWASP Dependency-Track.
  • Artifact management: JFrog.
  • Mobile platform security: AppSec.Sting (analysis of ready-made .apk/.ipa builds).
  • Code and secret security: Gitleaks (hardcoded secret detection).

The platform not only receives Reports but also manages the scanning process: it initiates checks, configures parameters, and schedules scans.

A critical feature is the ability to manually add vulnerabilities (Manual), which lets you include internal audit and penetration testing results in the overall statistics.

Vulnerability management (Vulnerability Management)​

TRON.ASOC transforms the process of handling detected defects from reactive to proactive.

Users can assess the severity and business impact of vulnerabilities, change their statuses, and assign priorities for developers.

Built-in commenting mechanisms create seamless communication between information security specialists and developers directly in the context of a specific issue.

A flexible exception system (False Positive, Accepted Risk), with configurable rule duration and scope, eliminates the need to revisit resolved issues and helps teams focus on current threats.

Release quality and quality gates (Quality Gates)​

The platform implements the concept of quality gates at every stage of the security pipeline.

Using acceptance criteria, users can configure quality Metrics for each scan, for example, “critical vulnerabilities are prohibited” and “the defect density threshold hasn't been exceeded.”

Based on these criteria, TRON.ASOC automatically determines whether the product has successfully passed the security checks and blocks its Transition to the next stage, for example, production, if it doesn't meet security standards.

Analytics, reporting, and forecasting​

The platform also lets users visualize and assess DevSecOps processes.

Interactive dashboards provide clear, real-time information about the security status of projects.

Accumulated historical data lets users do more than record the presence of vulnerabilities. It also helps them forecast risks and assess the codebase's recovery trend.

Users can also export detailed Reports in various formats for integration with corporate GRC and SIEM systems.

Architecture and enterprise infrastructure​

The platform doesn't require external CI pipelines, which lets organizations establish a secure development culture even in environments with strict security policies or isolated networks.

LDAP, Active Directory, and SSO support enables centralized account management.

Flexible access control configuration (RBAC) lets organizations separate permissions for developers (viewing and remediation), information security analysts (verification and rejection), and auditors (view-only).