Unifies SAST, SCA, DAST, secrets detection, container scanning, IaC scanning, runtime protection, and 40+ more application security capabilities into a single deployment. Deploy on your infrastructure or let us host it for you. Either way, your source code and security data are 100% yours. We never access, scan, or store it. Fully customisable per tenant.
No per-developer SaaS fees. No code leaving your network. No vendor lock-in.
This product is currently in development. Contact us to register your interest.
Security Features
From static analysis to runtime protection: every AppSec capability in one codebase.
Security Domains
Code security, cloud security, attack and pentest, runtime protection, findings management, advanced security, compliance, and integrations.
API Route Modules
Every feature backed by a dedicated REST API module. 387 Python backend files powering the platform.
API Endpoints
Purpose-built endpoints for every scan, finding, integration, and workflow. 293 TypeScript frontend components across the entire UI.
Schema Migrations
98 database tables versioned from day one. Every model, index, and constraint tracked through 28 Alembic migrations.
Eight core capabilities. Each one replaces a standalone vendor tool. Together, they eliminate the need for a fragmented AppSec stack.
Static analysis across 7 languages with deep data-flow tracking, taint analysis, and control-flow modelling. AI-powered SAST (LLM-based pattern recognition) is coming soon. Code quality analysis evaluates maintainability, complexity, and security hygiene beyond just vulnerabilities.
Every finding includes a code snippet, remediation guidance, and CWE mapping.
Software composition analysis across 9 ecosystems: npm, PyPI, Maven, Gradle, Go, NuGet, RubyGems, Cargo, and Composer. Vulnerability matching against NVD, GitHub Advisories, and proprietary feeds. License compliance checking against SPDX identifiers. SBOM generation in CycloneDX and SPDX formats.
Outdated component detection with upgrade path recommendations.
Dynamic application security testing with automated crawling and intelligent fuzzing. API scanning supports both REST and GraphQL endpoints with schema-aware test generation. Authentication-aware scanning handles session tokens, OAuth flows, and API keys.
Continuous scanning with configurable schedules and CI/CD integration.
50+ secret patterns detected across API keys, tokens, passwords, certificates, and cloud credentials. Pre-commit and CI integration prevents secrets from ever reaching the repository. Infrastructure-as-Code scanning covers Terraform, CloudFormation, and Kubernetes manifests (ARM and Ansible coming soon) across AWS, Azure, GCP, Oracle Cloud, and Alibaba Cloud.
Every IaC misconfiguration mapped to CIS benchmarks and compliance frameworks.
Container image scanning analyses layers, packages, and configurations for vulnerabilities before deployment. Runtime protection monitors container and Kubernetes workloads in production. In-app firewall (WAF) filters malicious requests. Virtual patching blocks zero-day exploits without code changes. Bot protection and safe dependency chain enforcement complete the runtime layer.
Hardened base image recommendations included.
Rule-based auto-triage assesses finding severity, exploitability, and business context to prioritise what matters. Auto-fix generates remediation patches for common vulnerability patterns. Noise reduction uses deduplication, correlation, and reachability analysis to cut false positives. Bulk operations let security teams process hundreds of findings in seconds.
Custom triage workflows adapt to your team's risk appetite and process.
Continuous attack surface monitoring discovers exposed endpoints, subdomains, APIs, and services. AI-powered pentesting with LLM-driven attack planning is coming soon. Continuous pentest campaigns maintain ongoing security validation. Bug bounty validation confirms reported vulnerabilities against your running environment.
CSPM scans AWS, Azure, and GCP configurations against CIS benchmarks.
The security knowledge graph maps attack paths across your codebase, dependencies, infrastructure, and runtime environment. Visualise how vulnerabilities chain together to form exploitable paths. An AI Security Copilot providing a natural-language interface to your security data is coming soon.
Threat modelling with STRIDE methodology and PR security scorecards for every merge request.
Most engineering teams run 8 to 12 separate security tools across code scanning, dependency management, runtime protection, and compliance. Each tool has its own dashboard, its own billing model, and its own data silo. UmbraShield consolidates all of them into a single deployment.
12+ vendors. 12+ invoices. 12+ dashboards to check.
Unified AppSec is not a marketing slide. This is the engineering reality.
UmbraShield is not a rigid SaaS product where every team gets the same scan profiles with the same limitations. It is a platform you own and configure to match how your engineering organisation actually builds software.
Define custom SAST rules, SCA policies, secrets patterns, and IaC checks using the built-in policy engine. Rules can be scoped per project, per language, or per team. Severity overrides let you promote or demote findings based on your organisation's risk context rather than generic vendor defaults.
Integrate with Jenkins, GitLab CI, GitHub Actions, CircleCI, and any webhook-capable pipeline. PR security scorecards gate merges based on configurable thresholds. Block on critical findings, warn on medium, pass on low. Security SLA engine tracks remediation deadlines and escalates overdue findings.
Row-level tenant isolation on every table. Each tenant sees only their projects, findings, scans, and reports. Role-based access control with custom roles and permissions. API key management per tenant with scoped access. Audit logging tracks every action across the platform.
Native integrations with GitHub, GitLab, and Bitbucket for repository scanning. Jira, Asana, and Azure DevOps for ticket creation. Slack and Microsoft Teams for notifications. AWS, Azure, and GCP for cloud scanning. Docker Hub, ECR, ACR, and GCR for container registry scanning. Custom webhooks for anything else.
Gamified security engagement programme that tracks developer participation in security activities. Leaderboards, badges, and learning paths encourage developers to fix their own findings. Security learning paths provide structured training modules mapped to common vulnerability categories.
The security debt manager quantifies your organisation's accumulated security technical debt. Track debt by team, project, language, and vulnerability category. Set reduction targets and monitor progress over time. Industry benchmarking compares your security posture against peers in your sector.
Every feature listed below is implemented with dedicated database tables, API routes, service logic, and frontend views. These are not roadmap items or coming-soon placeholders.
SAST (7 Languages) AI-Powered SAST SCA (9 Ecosystems) Secrets Detection (50+ Patterns) IaC Scanning (5 Providers) Container Image Scanning Malware Detection License Compliance SBOM Generation Outdated Component Detection AI Code Quality Analysis
Deep static analysis with data-flow tracking, taint analysis, and control-flow modelling across Python, JavaScript, TypeScript, Java, Go, Ruby, and PHP. AI-powered SAST with LLM-based pattern recognition is coming soon. SCA covers npm, PyPI, Maven, Gradle, Go, NuGet, RubyGems, Cargo, and Composer. Secrets detection with 50+ regex and entropy-based patterns. IaC scanning for Terraform, CloudFormation, and Kubernetes (ARM and Ansible coming soon) across AWS, Azure, GCP, Oracle Cloud, and Alibaba Cloud.
CSPM (AWS/Azure/GCP) Vulnerability Management Cloud Resource Search Container & K8s Runtime Protection
Cloud security posture management scans AWS, Azure, and GCP configurations against CIS benchmarks, detecting misconfigurations in IAM policies, network security groups, storage permissions, and encryption settings. Vulnerability management provides CVE-based scanning with exploitability scoring. Graph-based cloud resource search lets you query relationships across your cloud estate. Container and Kubernetes runtime protection monitors workloads for anomalous behaviour, privilege escalation, and policy violations.
DAST (Crawl & Fuzz) API Scanning (REST & GraphQL) Attack Surface Monitoring AI-Powered Pentesting Bug Bounty Validation
Dynamic application security testing with automated crawling, intelligent fuzzing, and authentication-aware scanning. API scanning discovers and tests REST and GraphQL endpoints with schema-aware payload generation. Continuous attack surface monitoring tracks exposed services, subdomains, and APIs. AI-powered pentesting uses LLM-driven attack planning to simulate real-world adversaries. Bug bounty validation confirms researcher-reported vulnerabilities against your running applications.
In-App Firewall (WAF) AI Anomaly Monitoring Bot Protection Virtual Patching (Zero-Day Blocking) Safe Dependency Chain
In-app firewall filters malicious requests at the application layer with customisable rule sets. AI-driven anomaly monitoring detects behavioural deviations in real-time traffic patterns. Bot protection identifies and blocks automated attacks, credential stuffing, and scraping. Virtual patching deploys emergency mitigations for zero-day vulnerabilities without requiring code changes or redeployment. Safe dependency chain enforcement verifies package integrity and blocks tampered or malicious dependencies.
Auto-Triage (ML-Based) Auto-Fix (Automated Remediation) Bulk Operations Noise Reduction Custom Triage Workflows
ML-based auto-triage assesses severity using exploitability, reachability, and business context, not just CVSS scores. Auto-fix generates remediation patches and dependency upgrades for common vulnerability patterns. Bulk operations let security teams update status, assign owners, and apply policies across hundreds of findings simultaneously. Noise reduction uses deduplication, occurrence correlation, and reachability analysis to eliminate false positives. Custom triage workflows define per-project escalation paths and approval chains.
Security Knowledge Graph Security Debt Manager Developer Security Champions Threat Modelling (STRIDE) PR Security Scorecard Security SLA Engine Industry Benchmarking Security Learning Paths
The security knowledge graph maps attack paths across code, dependencies, infrastructure, and runtime to visualise exploitable chains. Security debt manager quantifies accumulated risk and tracks reduction over time. Developer security champions programme gamifies security engagement with leaderboards and badges. STRIDE threat modelling automates threat identification for application components. PR security scorecard gates every merge request with configurable risk thresholds. SLA engine enforces remediation deadlines with automated escalation. Benchmarking compares your posture against industry peers. Learning paths provide structured developer security training mapped to CWE categories.
Compliance Framework Mapping Gap Analysis Reports SBOM Generation & Export Custom Report Builder Scheduled Reports
Map findings to SOC 2, ISO 27001, HIPAA, PCI-DSS, and CIS controls with automated coverage tracking. Gap analysis reports identify which controls lack evidence and what remains to be addressed. SBOM generation produces CycloneDX and SPDX-compliant software bills of materials for every project. Custom report builder lets you create reports with flexible filters, groupings, and visualisations. Scheduled reports deliver findings summaries, trend analysis, and compliance status to stakeholders on configurable cadences.
Multi-Tenancy Role-Based Access Control Policy Engine Audit Logging AI Security Copilot Threat Intelligence Feeds Git Platform Integrations Ticketing Integrations Messaging Integrations CI/CD Pipeline Integrations Custom Webhooks
Multi-tenant architecture with row-level isolation and per-tenant configuration. RBAC with custom roles and granular permissions. Policy engine defines scan rules, triage workflows, and compliance mappings as code. Immutable audit logging for every action. AI Security Copilot provides natural language interaction with your security data. Ask questions, investigate findings, generate reports through conversation. Threat intelligence feeds from NVD, GitHub Advisories, and commercial sources. Native integrations with GitHub, GitLab, Bitbucket, Jira, Asana, Slack, Teams, Jenkins, GitHub Actions, and 20+ more services.
UmbraShield runs wherever you need it: on physical hardware, in virtual machines, across cloud providers, inside containers, or on air-gapped networks. Every deployment method includes the complete platform (all 50+ features, all 53 API modules, all UI views). No feature gating by deployment type.
Direct installation on Ubuntu/Debian or RHEL/Rocky. PostgreSQL, Redis, and Nginx configured automatically. Systemd services for the FastAPI backend, Celery workers, and scan orchestration. Single-server or distributed deployment.
install.sh --installProduction-ready Docker Compose with dedicated containers for the API, worker pool, Redis, PostgreSQL, and Nginx reverse proxy. Health checks, restart policies, and volume mounts pre-configured. Three compose variants: development, standard, and distributed.
docker compose up -dHelm chart with configurable replicas, resource limits, and horizontal pod autoscaling. Bitnami subcharts for PostgreSQL and Redis. Ingress, TLS termination, and network policies included. Tested on EKS, AKS, GKE, and bare-metal K8s clusters.
helm install umbrashield ./helmFor defence, government, and high-security environments with no internet access. Pre-packaged bundle includes all Python wheels, container images, and system dependencies. Offline installation with the same feature set. Nothing phones home.
install-airgap.sh --bundle ./umbrashield-bundle.tar.gzDeploy on AWS EC2, Azure VMs, GCP Compute Engine, or any IaaS provider. Use your cloud infrastructure without surrendering source code to vendor-managed SaaS. All installation scripts work identically whether the host is physical or cloud-provisioned. Combine with managed Kubernetes (EKS, AKS, GKE) for elastic scaling.
Full support for VMware ESXi/vSphere, Microsoft Hyper-V, Proxmox VE, KVM/QEMU, and Xen. Deploy as a VM alongside your existing virtualised infrastructure. Snapshot, clone, and template using standard hypervisor tooling. No hardware-specific dependencies.
Three arguments that get stronger every year.
When you use a cloud-hosted SAST or SCA tool, your entire codebase (every file, every commit, every dependency manifest) is uploaded to your vendor's infrastructure for analysis. Your intellectual property, trade secrets, and proprietary algorithms sit on someone else's servers.
With UmbraShield, scans run on your infrastructure. Source code, findings, and remediation data never leave your network, whether you self-host or let SinonTech host it for you. Either way, we never access, read, or store your code.
Your source code is your competitive advantage. It should not live on a vendor's cloud.
Application security platforms have privileged access to source code repositories, CI/CD pipelines, cloud credentials, and vulnerability data. A compromise of your AppSec vendor exposes not just your code, but a detailed map of every weakness in it.
UmbraShield eliminates the shared-cloud attack surface. Your instance is not shared infrastructure. There is no multi-tenant vendor cloud where a vulnerability in one customer's environment exposes another's source code. Your security data is your own.
The tool that finds your vulnerabilities should not create new ones.
Per-developer SaaS pricing punishes growth. A startup with 5 developers pays a manageable fee. A scaling company at 50 developers watches AppSec costs multiply tenfold. An enterprise at 500+ developers sees security tooling become one of the largest line items in the engineering budget.
UmbraShield breaks that linear cost curve. Whether you self-host or use our managed hosting, costs scale with compute and storage, not with headcount. The same deployment scans code for 5 developers or 5,000.
Same platform at 10 developers as at 10,000. Your security budget grows with infrastructure, not headcount.
UmbraShield is built by engineers who have operated application security at scale. The architecture reflects hard-won lessons about what breaks during a critical scan and what survives audit season.
| Language | Python 3.11+ with FastAPI |
|---|---|
| Database | PostgreSQL with 28 Alembic migrations, 98 tables |
| Task Queue | Celery with Redis broker (40 task types) |
| API Surface | 53 route modules, 500+ endpoints, JWT + API key authentication |
| Multi-Tenancy | Row-level tenant isolation on every table |
| Scanners | 11 scanner modules (SAST, SCA, secrets, IaC, container, DAST, API, CSPM, malware, attack surface) |
| Integrations | 8 integration categories, 30+ connectors |
| File Count | 387 Python modules across models, schemas, services, routes, scanners, and tasks |
| Framework | React 18 with TypeScript |
|---|---|
| Build Tool | Vite |
| Styling | Tailwind CSS with dark mode default |
| State | Redux Toolkit with React Query for server state |
| Routing | React Router with role-based and tenant-scoped access |
| Pages | 55 page components across all security features |
| API Clients | 49 API service modules |
| File Count | 293 TypeScript modules across pages, components, services, and types |
UmbraShield is in active development. Request access to receive deployment documentation, architecture walkthroughs, and priority onboarding when the platform enters beta.
Get in touch to discuss your requirements.
UmbraShield is part of the SOC-in-a-Box suite by SinonTech.
Self-hosted security infrastructure for organisations that take data sovereignty seriously.