Problem
Enterprise application security produces findings faster than it produces understanding. At Finastra, results from GitHub CodeQL, software composition analysis, and container scanning each lived in their own tool with their own dashboards, severity models, and owners. Engineering leaders could not answer the basic question — how secure is this application, and is it getting better? — without someone manually stitching exports together. Maturity discussions defaulted to anecdotes.
Scoring posture created a second problem: questions. Why did my SAST score drop? Why is DAST shown as not applicable when we upload the results? Every one of them landed on a security engineer, and answering the same explanations repeatedly did not scale.
Architecture decision
The ASPM Dashboard is a single pane of glass over the whole tooling estate: a Go backend that aggregates findings from GitHub CodeQL, SCA, and container scanning, with a modern React frontend on top.
The important design decision is that it does not stop at aggregation. Raw findings are combined with static posture signals — SAMM assessment results, API security posture, WAF coverage, and other configuration-level data — into a computed maturity score. That turns three scanners’ worth of noise into a per-application posture that can be compared, tracked over time, and argued about productively: teams see where they stand and which specific inputs move their score.
The question load is handled by a RAG assistant built into the dashboard. It combines two sources: tools the model can call to query the platform’s database for the facts behind a team’s score, and the user documentation held in a vector database. Grounding answers in both means a team asking why is my SAST score down gets the actual inputs behind their number plus the relevant documentation — not a generic explanation.
Outcome
Running as an internal self-service portal at Finastra: AppSec and engineering leadership share a current view of posture across the portfolio, and product teams get their scoring questions answered without waiting on a security engineer — time that used to go to repeated explanations goes back to engineering. More transparency, stricter governance, better security maturity.
← All projects