Architectural Overview
Core Subsystems
1. Ingestion & Sensor Layer
- Distributed Scanner Nodes: Stateless scanner workers that can run in the cloud or as on-premise forwarders inside private VPCs.
- Continuous Recon Sensors: Passive and active reconnaissance workers querying certificate transparency logs, DNS resolvers, and network scopes.
- Bidirectional Ingestion Adapters: Native connectors pulling data from AWS, GCP, Azure, GitHub, GitLab, and Jira.
2. Normalization & TrueRisk™ Engine
- Unified Schema Mapping: Converts raw outputs from disparate scanners (Nessus, Qualys, Nuclei, Trivy, Burp, CodeQL) into a standardized Snapsec Finding Object.
- Deduplication Engine: Uses syntactic hashing (target URL, parameter, vulnerability type, CVE) to prevent duplicate alerts for recurring findings.
- Dynamic Contextual Risk Scoring: Incorporates asset business criticality, internet exposure status, and real-time exploit intelligence (EPSS, CISA KEV).
3. Data Tier
- Relational Core: High-performance PostgreSQL store managing tenant schemas, RBAC, scan policies, and audit trails.
- Evidence Storage: S3-compatible object storage storing full raw HTTP request/response payloads, screenshots, and command outputs.
- Asset Knowledge Graph: Graph database mapping dependency relationships between business units, applications, repositories, APIs, and infrastructure.
High Availability & Scalability
- Horizontal Worker Auto-Scaling: Worker pools for heavy scanning and pentesting scale independently based on queue depth.
- Database Read Replicas: Intensive reporting and search queries are offloaded to read replicas to preserve transaction throughput.