Skip to main content
Version: 1.6

Overview

The TRON.ASOC platform is a unified system for Vulnerabilities management and security control throughout the software development life cycle (DevSecOps). The product serves as a centralized hub that aggregates, normalizes, and analyzes data from dozens of security tools, turning disparate Scan results into manageable business processes.

Seamless integration and the security ecosystem​

The platform serves as a universal connector for an extensive security tool stack, supporting both proprietary and open-source solutions:

  • SAST: PT Application Inspector, Solar AppScreener (supports both source and binary code), PVS-Studio, Semgrep, GitLab Advanced SAST, SASTAV, ESLint.
  • Container and IaC security: Kaspersky Container Security, Trivy, Grype, Aqua, KICS.
  • SCA/OSA (software composition analysis): CodeScoring, OWASP Dependency Track.
  • Artifact management: JFrog.
  • Mobile platform security: AppSec.Sting (analysis of ready-to-use .apk/.ipa builds).
  • Code and secrets security: Gitleaks (hardcoded secret detection).

The platform not only receives Reports but also manages the Scans process: it initiates checks, configures parameters, and schedules runs.

A key feature is the ability to manually add Vulnerabilities (Manual), which lets you include internal audit and penetration test results in the overall statistics.

Vulnerability Management​

TRON ASOC transforms the process of handling discovered defects from reactive to proactive.

Users can assess the severity and business impact of Vulnerabilities, change their statuses, and assign priorities for developers.

Built-in commenting mechanisms provide seamless communication between security specialists and developers directly in the context of a specific issue.

A flexible exception system (False Positive, Accepted Risk), with configurable expiration times and rule scopes, helps users avoid revisiting resolved issues and focus on current threats.

Release quality and quality gates​

The platform implements the concept of Quality Gates at every stage of the security pipeline.

Using acceptance criteria, users can configure quality Metrics for each scan, for example, “critical Vulnerabilities aren't allowed” or “the defect density threshold isn't exceeded.”

Based on these criteria, TRON ASOC automatically determines whether the product has successfully passed the security checks. If it doesn't meet security standards, the platform blocks the product's Transition to the next stage, for example, production.

Analytics, reporting, and forecasting​

The platform also lets users visualize and evaluate DevSecOps processes.

Interactive dashboards provide clear, real-time information about project security status.

Accumulated historical data lets users do more than confirm the presence of Vulnerabilities. It also lets them forecast risks and evaluate the codebase's remediation trends.

Users can also export detailed Reports in various formats for integration with corporate GRC and SIEM systems.

Architecture and corporate infrastructure​

The platform doesn't require external CI pipelines, so organizations can adopt a secure development culture even in environments with strict security policies or isolated networks.

LDAP, Active Directory, and SSO support lets administrators manage user accounts centrally.

Flexible access control configuration (RBAC) lets administrators separate permissions for developers (viewing/editing), security analysts (verification/rejection), and auditors (view-only).