Skip to main content
Version: 1.7

General information

The TRON.ASOC platform is a unified system for vulnerability management and security controls across all stages of the software development lifecycle (DevSecOps). The product serves as a centralized hub that aggregates, normalizes, and analyzes data from dozens of security tools, turning disparate scan results into manageable business processes.

Seamless integration and the security ecosystem​

The platform serves as a universal connector for a broad stack of information security tools, supporting both proprietary and open-source solutions:

  • SAST: PT Application Inspector, Solar AppScreener (supports both source and binary code), PVS-Studio, Semgrep, GitLab Advanced SAST, SASTAV, ESLint.
  • Container and IaC security: Kaspersky Container Security, Trivy, Grype, Aqua, KICS.
  • SCA/OSA (software composition analysis): CodeScoring, OWASP Dependency Track.
  • Artifact management: JFrog.
  • Mobile platform security: AppSec.Sting (analysis of ready-made .apk/.ipa builds).
  • Code and secret security: Gitleaks (hardcoded secret detection).

The platform doesn't just receive reports. It also manages the scanning process by initiating checks, configuring parameters, and scheduling runs.

A critical feature is the ability to manually add vulnerabilities (Manual). This lets you include internal audit and penetration testing results in the overall statistics.

Vulnerability management​

TRON ASOC transforms the process of handling identified defects from reactive to proactive.

Users can assess the severity and business impact of vulnerabilities, change their statuses, and assign priorities to developers.

Built-in commenting features enable seamless communication between information security specialists and developers directly in the context of a specific issue.

A flexible exception system (False Positive, Accepted Risk), with configurable rule duration and scope, means you don't have to revisit resolved issues and can focus on current threats.

Release quality and quality gates​

The platform implements the concept of quality gates at every stage of the security pipeline.

Users can configure quality metrics for each scan by using acceptance criteria, for example, “critical vulnerabilities are prohibited” and “the defect density threshold isn't exceeded.”

Based on these criteria, TRON ASOC automatically determines whether the product passes the validation layer and blocks its transition to the next stage, for example, production, if it doesn't meet security standards.

Analytics, reporting, and forecasting​

The platform also lets you visualize and evaluate DevSecOps processes.

Interactive dashboards provide clear, real-time information about project security.

Accumulated historical data lets you do more than confirm that vulnerabilities exist. It also lets you forecast risks and evaluate the codebase's “recovery” trend.

Users can also export detailed reports in various formats for integration with corporate GRC and SIEM systems.

Architecture and enterprise infrastructure​

The platform doesn't require external CI pipelines, so you can implement a secure development culture even in environments with strict security policies or isolated networks.

LDAP, Active Directory, and SSO support lets you manage user accounts centrally.

Flexible role-based access control (RBAC) lets you separate capabilities among developers (viewing and remediation), information security analysts (verification and rejection), and auditors (view-only access).