Products

Security signals in one operating context.

From public exposure to code, dependencies, containers and infrastructure, QFinch connects findings to current vulnerability intelligence.

Container image security scanning

QFinch resolves approved container-image references, records immutable image identity where available, inventories operating-system and application packages, and correlates affected versions with vulnerability intelligence.

Explore product →

Dynamic application security testing

QFinch DAST assesses authorised websites through crawling, browser execution, passive analysis and bounded active checks. Results retain the tested target, coverage, supporting evidence and report artifacts.

Explore product →

Infrastructure-as-code security

QFinch identifies supported infrastructure-as-code frameworks and checks them with framework-aware rules. IaC findings receive a dedicated view so resource identity, framework, evidence and remediation are not buried among ordinary source-code results.

Explore product →

SBOM inventory

QFinch produces CycloneDX and SPDX artifacts for supported repository and container scans, retaining component identity, versions, relationships and generation provenance.

Explore product →

Secrets security

QFinch detects secret-like material in supported repository scopes while redacting sensitive values. Dedicated lifecycle views distinguish a new detection, an accepted baseline, remediation progress and later verification.

Explore product →

Security intelligence and assistant

QFinch ingests and normalizes multiple public vulnerability and risk sources, correlates identifiers and affected versions, and updates its canonical knowledge base through source-aware schedules.

Explore product →

Software composition analysis

QFinch SCA resolves supported dependency manifests, identifies direct and transitive packages, correlates affected versions with normalized vulnerability intelligence and retains dependency evidence for reporting.

Explore product →

Static application security testing

QFinch SAST runs a governed engine ensemble selected for the repository's detected languages and files. Findings retain engine and ruleset provenance, location, severity, category and remediation context.

Explore product →

QFinch organises security around governed assets and organisations. Policies determine eligible assessments; scan workers collect evidence; reports connect findings to affected locations, versions, remediation and history.

Coverage

  • DAST for authorised websites and selected API/authenticated scenarios.
  • SAST for supported source languages and build-aware analysis.
  • SCA for dependency inventories and affected-version correlation.
  • Container scanning for image package and vulnerability analysis.
  • IaC and secrets as dedicated security result categories.
  • CycloneDX and SPDX SBOM inventory with provenance and relationships.

Workflow

Assets → policies → scans → observations → correlated findings → reports → remediation → verification.

Designed for different stakeholders

Developers receive location and remediation context. Security teams receive provenance, coverage and policy evidence. Risk stakeholders receive versioned reports and supporting artifacts without incompatible scanner scores being presented as equivalent.

CTA: Book a platform walkthrough