Securing the world's best teams
Hard deadline for the NIS2 early warning to the CSIRT
Of relevant turnover — the maximum Ofcom fine
Of critical dependency vulnerabilities stay critical with runtime context (Datadog, 2026)
Of breaches involve a third party, up 60% YoY (Verizon DBIR, 2026)
Self-service, top-ups and account management. Usually Java, JavaScript or TypeScript stacks that change every sprint.
Source and the live portal are scored on the same severity scale.
Self-service, top-ups and account management. Usually Java, JavaScript or TypeScript stacks that change every sprint.
Source and the live portal are scored on the same severity scale.
Static analysis of billing, provisioning and network management systems, alongside the portals, services and APIs built around them.
The published Android or iOS build is analyzed as a binary against OWASP MASVS. Source code and a developer environment are not required.
SCA maps the full dependency tree, scores supply chain health across 8 metrics, flags licensing risks and generates a CycloneDX SBOM per scan. Vulnerability data comes from NVD, GitHub, GitLab, OSV and DerScanner datasets.
COBOL, PL/SQL, ABAP, Delphi. Billing and provisioning still run on them. DerScanner scores them on the same severity scale as modern stacks.
Vendor packages scored without source code: .dll, .exe, .apk, .ipa and .class on the same ruleset as in-house code.
Triage and fixes that run offline inside your network. DerTriage and DerCodeFix need no Internet access and can be permanently disabled.
One installation with separate reporting, policies and access rights per domain.
Billing, portals, mobile and network tools sit in separate project groups with their own access rights and policies. The platform stays one installation.
Limits on critical findings and minimum scores decide what blocks a build. A release train does not wait on an informational finding.
Scans run from Jenkins, GitLab CI, TeamCity and Azure DevOps as a build step. Results return to the same interface for every team.
Portals, apps, billing and OSS under NIS2, on one installation.
Talk to us about MNOSelf-care portals and provisioning systems tested inside the operator network.
Talk to us about fixed-lineThe Android app subscribers run, scanned from the Google Play link against MASVS.
Talk to us about MVNOSupplier deliverables scored as binaries, with a CycloneDX SBOM for releases shipped with dependency manifests.
Talk to us about vendor softwareInterconnect logic, roaming agreements and network config sit in the same repositories as application code.
DerScanner installs on internal servers, air-gapped networks included. Code, findings and the on-prem AI agents stay on premises.
Portals, apps, billing modules and internal tools ship on separate schedules.
Scans start from the pipeline, and tags sort projects by team or product. Findings turn into Azure Boards tasks from the DerScanner interface.
Teams cannot tell which commits were written by a human and which by a model.
SAST scans model-written code the same way as human-written code. DerCodeFix proposes fixes for vulnerabilities DerTriage confirmed.
Most alerts never get reviewed.
DerTriage reviews SAST findings on premises and flags likely false positives before the security team opens the queue.
Article 21 mandates supply chain security as part of risk management. Article 23 sets a 24-hour early warning, a 72-hour notification and a final report within one month.
SCA across the dependency tree with supply chain health scoring. Binary analysis of supplier packages. CVE tracking that links new advisories to the applications carrying the component.
CycloneDX SBOM per application and supplier findings report.
Article 21 mandates supply chain security as part of risk management. Article 23 sets a 24-hour early warning, a 72-hour notification and a final report within one month.
SCA across the dependency tree with supply chain health scoring. Binary analysis of supplier packages. CVE tracking that links new advisories to the applications carrying the component.
CycloneDX SBOM per application and supplier findings report.
Yes. Scanners, database, agents and AI modules install inside the operator network. Licensing loads from a file through the admin panel.
Binary analysis reads .dll, .exe, .apk, .ipa and .class files directly. It inventories the components inside them and scores findings on the same severity scale as your in-house code. This covers element managers, provisioning tools and packaged software from any supplier.
COBOL, PL/SQL, ABAP, Delphi, Perl, Pascal and Visual Basic sit in the same platform as C, C++, Java, C#, Python, Go, JavaScript and TypeScript. 43 languages in total. One severity scale. One report.
Yes. A published Android or iOS build is uploaded and analyzed as a binary against OWASP MASVS. This covers the exact version running on handsets right now, not the source code from three sprints ago.
No. DerTriage and DerCodeFix run on the same servers as the scanners, inside your network. Nothing is sent to an external provider. Nothing is trained on your code.
Scans run as a build step in Jenkins, GitLab CI, TeamCity or Azure DevOps. A policy per project decides which severity blocks the build and which is logged for later. Security becomes a gate with clear rules, not a black box.
An exportable report with every finding mapped to OWASP Top 10 and CWE/SANS Top 25. A CycloneDX SBOM of third-party components. Scan history per project as proof of when each check ran and who reviewed the result.
Hybrid SAST and SCA analysis builds a call graph from application code through transitive dependencies and marks whether a vulnerable function is actually reachable. This works for JavaScript, TypeScript, Python, C# and Java. DerTriage runs the first pass on the same servers as the scanners.
The platform does not label code by author. Every commit goes through the same rules and the same severity scale. This matters when a release mixes hand-written and generated code across dozens of teams and nobody can trace which is which.
We pick one application - usually a subscriber portal or a billing module - and run a scan on your internal servers. You compare the results against what your current toolchain found. The scope and deployment model are agreed in one conversation.
Prefer email? company@derscanner.com