WHY "ONE VANTAGE"
Two views of the same estate, correlated instead of separate.
What your code and your cloud config actually say
Semgrep runs static analysis across your source. Prowler checks posture across every resource in your GCP, AWS or Azure accounts against CIS and provider benchmarks. Both read the estate as it is configured, before anything ships.
What an attacker sees from the internet
Nuclei runs active web and network scans against whatever is actually reachable — the same vantage point available to anyone outside your perimeter, not a diagram of what should be exposed.
Both feeds, one findings model
Every result from every scanner is normalised, deduplicated across overlapping tools, correlated where inside and outside findings describe the same exposure, and ranked by whether it is actually reachable — not just theoretically present.
HOW IT RUNS
Discover, scan, correlate, prioritise, fix, prove.
Discover
Assets are enrolled from cloud accounts, repositories and customer-hosted connectors — the inventory a scan needs before it can run.
Scan
Semgrep, Nuclei and Prowler are dispatched as ephemeral Kubernetes jobs, one per scan run, isolated per tenant and gone when the run ends.
Normalise & correlate
Every scanner’s native output is mapped into one findings model, then deduplicated across tools so the same exposure never shows up three times.
Prioritise
Reachability analysis separates what is actually exploitable in your estate from what is merely present in a dependency tree nobody calls.
Fix
SLA clocks start on assignment, retest confirms a fix landed, and campaigns group related findings into one remediation effort instead of a hundred tickets.
Prove
Compliance packs track framework coverage with gap analysis; evidence and attestations are exportable for the audit that actually asks.
WHAT'S IN THE PLATFORM
Built for teams that ship, not just teams that scan.
One findings model, not three consoles
SAST, DAST and CSPM output normalised into a single schema — one queue, one severity scale, one place to triage.
Reachability-based prioritisation
A vulnerability in code nothing calls is not the same risk as one sitting on an internet-facing path. Ranking reflects that difference.
Findings on the diff, not after the fact
Native GitLab merge-request notes surface findings inline. The sp-scan CLI covers Jenkins, Azure DevOps, or any other CI with a standalone entry point.
Enterprise SSO, SAML and SCIM
Federate identity through your own provider and provision access through SCIM instead of a shared login your platform team has to manage by hand.
Framework coverage, gap analysis, evidence
Compliance packs track status against the frameworks you actually report against, with exportable evidence and attestations for the audit itself.
Multi-tenant by construction
PostgreSQL row-level security enforces tenant boundaries at the database layer. One customer’s findings are never a query away from another’s.
Reach customer-hosted assets
Enrol and operate connectors into environments the platform does not sit inside, without opening a standing tunnel into your estate.
Usage, quotas and billing as data
Every limit — assets, scan minutes, retained findings, storage, concurrency — is metered per tenant and enforced against the plan in force, not hardcoded per feature.
SECURITY — HOLONIX
A platform that scans everyone else has to trust with its own defaults held tighter.
Holonix runs credentials against your code and your cloud. That access is scoped, ephemeral and isolated by construction — not by a policy that asks engineers to remember.
Scanners exist only for the scan
Semgrep, Nuclei and Prowler run as ephemeral Kubernetes jobs, dispatched per scan run and torn down when it ends. There is no always-on scanner holding credentials between runs.
Row-level security, not application trust
Every tenant-scoped table carries a Postgres RLS policy evaluated on every query. Isolation does not depend on every code path remembering to filter by tenant.
Feature access is a data lookup
No route asks "is this tenant on the business plan" in code. It asks whether the tenant’s effective plan includes the feature, read from the plan a platform operator or a verified billing event assigned.
A plan changes only through an authenticated path
A tenant’s plan can change only through a platform operator, or a signature-verified billing webhook. Self-serve signup can assign a brand-new tenant the entry plan and nothing else — it can never choose or upgrade one.
Every plan and access change is recorded
Who changed what, from which source, and why — written to the tenant’s own audit trail at the time it happened, not reconstructed afterwards for a review.
A lapsed subscription degrades, it does not vanish
A past-due subscription gets a grace period before falling back to the entry plan — never a silent, immediate loss of access on a payment blip.
PRICING
Every plan meters the same five limits. Only the ceiling changes.
Assets, scan minutes, retained findings, storage and concurrent scans — enforced per tenant, on the plan actually in force. Active scanning (DAST/VAPT), connectors, SSO and compliance packs are feature-gated, not simulated behind a paywall.
Free
Passive scanning for a small estate.
- Assets10
- Scan minutes / mo300
- Retained findings5,000
- Storage1 GB
- Concurrent scans1
- ✓SAST (source code)
- ✓Cloud posture (CSPM)
- —Active scanning (DAST/VAPT)
- —Connectors
- —SSO / SCIM
- —Compliance packs
Team
Connectors and compliance packs for a growing team.
- Assets100
- Scan minutes / mo3,000
- Retained findings50,000
- Storage10 GB
- Concurrent scans3
- ✓Everything in Free
- ✓Customer-hosted connectors
- ✓Compliance packs
- —Active scanning (DAST/VAPT)
- —SSO / SCIM
Business
Active DAST/VAPT, SSO and a larger estate.
- Assets1,000
- Scan minutes / mo20,000
- Retained findings500,000
- Storage100 GB
- Concurrent scans10
- ✓Everything in Team
- ✓Active scanning (DAST/VAPT)
- ✓Enterprise SSO (SAML/OIDC) + SCIM
Enterprise
No platform limits. Run by SISLCloudWorx.
- AssetsUnlimited
- Scan minutes / moUnlimited
- Retained findingsUnlimited
- StorageUnlimited
- Concurrent scansUnlimited
- ✓Everything in Business
- ✓Unlimited assets, scans and storage
- ✓Consultant-managed engagement
Free is self-serve and requires no card. Team and Business are priced per estate on a call with our team; Enterprise is a consultant-managed engagement scoped to your environment.
FAQ
Questions worth answering up front.
Does Holonix replace Semgrep, Nuclei and Prowler, or run on top of them?
It orchestrates them. Holonix dispatches Semgrep (SAST), Nuclei (DAST — web and network) and Prowler (CSPM) as ephemeral Kubernetes jobs per scan, then normalises every result into one findings model — deduplicated and correlated across scanners — so your team works one queue instead of three separate tool consoles.
How is our tenant data isolated from every other customer on the platform?
With PostgreSQL row-level security enforced at the database layer, not application code you have to trust blindly. Every tenant-scoped table carries a policy that only opens for that tenant’s own session. Scanners themselves run as short-lived Kubernetes jobs that exist only for the duration of a scan and leave nothing resident between runs.
Can Holonix plug into our existing CI/CD pipeline?
Yes. GitLab CI gets native merge-request notes with findings inline on the diff. Every other CI system — Jenkins, Azure DevOps, or anything else — is covered by the sp-scan command-line entry point, a standalone binary built for exactly that case.
What actually changes between the Free, Team, Business and Enterprise plans?
Free is passive scanning only (SAST + cloud posture) for a small estate. Team adds customer-hosted connectors and compliance packs for a growing one. Business adds active scanning — DAST and VAPT — plus enterprise SSO for a larger estate. Enterprise removes every platform limit for consultant-managed engagements run by SISLCloudWorx.
See your estate from both sides.
Bring a real estate to the walkthrough — your own repos, cloud accounts and internet-facing assets, correlated in one findings model.