Introduction

ScanSuite is a security scanning orchestration platform. It takes the things you already have — a repository, a running web application, a range of hosts, a container image — and runs security analysis against them, on your own infrastructure.

Two kinds of engine work side by side. AI agents plan their own work, call tools, and verify what they find against the real system before reporting it. Classic scanners — more than thirty open-source and commercial engines — run in parallel in isolated containers. Both feed the same finding pipeline, so results arrive deduplicated and in one place.

What you can point it at

• Source code archives
• Code repositories, including monitored branches that scan on change
• Web application and API URLs
• Host names, IP addresses and domains
• Container image names

ScanSuite selects the appropriate scanners through pre-configured connectors and invokes them with parameters tuned for the target, rather than asking you to assemble a scan profile yourself.

What comes back

Findings are normalised into a single vulnerability record, deduplicated within the scan and against history, and stored for tracking and reporting. Raw scanner reports and structured parsed results are both available for download, and results can be uploaded to DefectDojo for centralised vulnerability management.

How you reach it

• A web dashboard
• A command-line interface
• CI/CD pipelines

Start here

If you are new to the platform, read Architecture to understand how the components fit together, then work through installation.