We set it up with you
Your products, their repositories, images and SBOMs, and who in your organization sees what. You do not start from an empty workspace and a blank form.
KROMSE for many products
Vulnerability detection for companies with many products.
The self-service product is the same one large teams use, with higher limits. What changes is agreed in a written proposal: help setting it up, a fit with how your organization already works, and connections to the systems your engineers use every day.
Tell us what you ship and we will answer with what KROMSE finds today, and what it does not.
What working with us looks like
We fit your way of working
Which findings matter to you, how severity maps to your own process, which reports your teams need, and what the people who sign off should see first.
We connect to what you already run
Your build pipelines push SBOMs to KROMSE, so their coverage does not depend on anyone remembering to start a scan.
You have someone to talk to
A named contact for questions about a finding, a scan result or a decision you have to defend, as agreed in your written proposal.
What it connects to today
Everything listed here works now. Anything else you need is scoped in a written proposal before you commit.
Your code, wherever it lives
- GitHub through the read-only KROMSE app
- GitLab through a clone URL and an access token
- Any HTTPS git server reachable from the internet
- Tokens are encrypted at rest and used only to read the commit being scanned
Your pipelines
- Push an SBOM from GitHub Actions, GitLab CI, Azure Pipelines or Jenkins
- Ready-made snippets for each, generated for your product
- Workspace API tokens, so a pipeline authenticates as itself and can be revoked on its own
- Upload a firmware image or a CycloneDX or SPDX SBOM directly
Talk to us about Enterprise
Tell us what you make, how many products you have, and what your team needs. You can also contact info@kromse.com.