Security services

The first-party security services suite on kotoba.cloud. CTEM, DAST and SAST findings flow into the VM ledger in one shared schema.

CTEM

exposure-management component shipped

Continuous Threat Exposure Management: continuously enumerates the external attack surface and entry points, and hands attack paths plus asset context to the VM ledger.

Capability	Description
surface-inventory	continuous external attack-surface and asset inventory
attack-path	reachable attack-path identification
context	asset context (public routes, dependencies, owner)
exposure-feed	exposure events fed to the VM ledger

inputs: assets, dns, certificates, open-endpoints
outputs: attack-paths, exposure-findings, asset-context
VM integration: CTEM hands attack paths and asset context to the VM ledger; they are the basis of the reachability score.

DAST

dynamic-testing gated

Dynamic application security testing: probes running applications and reports runtime findings to the VM ledger.

Capability	Description
runtime-probe	dynamic probing of running applications
auth-scenarios	probing with authenticated scenarios
runtime-finding	runtime vulnerability detection as findings

inputs: running-apps, scan-scopes, auth-scenarios
outputs: runtime-findings, request-response-evidence
VM integration: DAST emits reproducible runtime findings (request/response evidence) to the VM ledger.

SAST

static-analysis gated

Static application security testing: analyzes source code for vulnerable patterns and missing sanitization, reporting code findings to the VM ledger.

Capability	Description
code-analysis	static source-code analysis
taint-flow	taint / data-flow inspection
code-finding	code findings with file and line

inputs: source-code, dependency-manifests
outputs: code-findings, taint-paths, dependency-notes
VM integration: SAST emits code findings with file and line to the VM ledger, so the fix target is found faster.

VM

vulnerability-management component shipped

Vulnerability management (wvme): consumes the shared-schema findings emitted by the three upstream services, dedups and scores them by reachability and exploitability, and tracks the remediation lifecycle in a ledger keyed by CPE/CVE. Accepts CVE/CPE feed input.

Capability	Description
dedup	finding deduplication (asset × vulnerability key)
scoring	reachability × exploitability scoring
ledger	vulnerability ledger keyed by CPE/CVE
remediation	remediation lifecycle (detected → in progress → verified → closed)
cve-cpe-feed	CVE/CPE feed intake

inputs: findings-from-ctem, findings-from-dast, findings-from-sast, cve-cpe-feeds
outputs: vulnerability-ledger, remediation-status, exposure-reports
VM integration: VM is the ledger service: it receives the three upstream services' findings in the shared schema and dedups, scores and tracks remediation.

Dataflow into the VM ledger

The three upstream services emit shared-schema findings; VM dedups, scores and tracks remediation.

→ CTEM · role: attack-path-and-context
→ DAST · role: runtime-findings
→ SAST · role: code-findings
→ VM · role: aggregation-ledger · ledger keys: cpe, cve

finding schema: finding-id, service, asset, severity, evidence, first-seen, last-seen

This page and GET /v1/security/services render from the one canonical def. Enforcement stays on the private authority; this surface only describes.