Transform every finding into clarity, priority, and action.

The Security ETL Engine.

Request a trial

Scanner noise, turned into prioritised action

Security scanners produce thousands of findings and almost no direction. Sinterly ingests them, verifies exploitability and reachability, and ranks what actually matters, so teams act on the few findings that change your risk, not the many that do not.

187findings across Juice Shop, WebGoat, DVWA & NodeGoat
65.4average priority score
5scored components per finding

The product, on our own findings

These are screens from Sinterly running on Kademos Labs' own security data, not a mock-up. Each one is built around the same idea: every number can be traced to the findings that produced it.

Prioritisation you can read, and change

A finding's priority is five weighted components: exploitability, reachability, business context, cost of delay, remediation effort. The weights are yours to tune, they must sum to 1.00, and every past score keeps the weights it was calculated with. The ranking is never a black box.

Sinterly priority scoring: five weighted components summing to 1.00, with a versioned history

Everything open, in one triage view

Open findings by severity, what is in remediation, what is ageing past thirty days, and the deduplication and Jira queues still waiting on a person. The whole tenant's posture sits on a single screen.

Sinterly risk summary: open findings by severity, remediation and ageing metrics

Where the programme is heading

Critical exposure on your production-critical tier, quarterly fix rate, backlog by age, exposure by business tier. The board view, exportable as a summary, with every figure drilling into the findings behind it.

Sinterly security trajectory: critical exposure, fix rate, backlog by age and exposure by business tier

From scanner export to prioritised backlog in under a minute

We measured it on production, not a demo rig: a SARIF upload was deduplicated, scored and ranked on the dashboard in 4.8 seconds. CSV took 4.1, a threat model 3.9. Your first ingestion is minutes of work, not a migration project.

How it works

Ingest

Upload SARIF, CSV or OTM through the dashboard, or connect a source and pull findings directly.

Transform

Deduplicate, enrich, and verify reachability and exploitability.

Prioritise

A five-component score. Every number is citable to its evidence.

Act

Role-aware views and Jira tickets, so the right work reaches the right team.

Works with what you already run

Only integrations that are built and verified today. Any SARIF 2.1.0 file is accepted, verified with Semgrep and Trivy; Grype, ZAP, Gitleaks, Checkov and CodeQL output is recognised.

Findings, never code

Sinterly works on scanner findings. It has no path to your source code. Every trust claim below names its mechanism.

  1. Two ways in, both code-blind. Upload scanner output you export yourself, so we hold nothing but the findings. Or connect a source like GitHub Code Scanning with a token scoped to scanner findings only: a fine-grained token with code-scanning read cannot read your source code.
  2. Row-level tenant isolation, enforced by the database. Every table carries your tenant identity and the database refuses cross-tenant reads, other tenants' data is invisible by construction, not by filter.
  3. Append-only audit log. Every administrative decision is recorded, and a database immutability trigger makes edits and deletions impossible, including by us.
  4. Credentials encrypted before they reach the database. Integration secrets are encrypted app-side with AES-256-GCM, never displayed again after saving, and the encryption key never touches the database provider.
  5. Explainable scoring. Every priority score shows its five inputs and the exact weights used at the time it was calculated, so historical scores stay auditable after you tune the formula. No black-box numbers.

Read the full security architecture →

Priced per target, not per developer

A target is one thing you want watched: an application, a service, a repository. Hiring another engineer does not change your bill. Start with 30 days free, then we agree a price from what you actually used.

What Sinterly is not

Sinterly does not scan anything. All-in-one platforms bundle their own scanners, so buying one is how you get scanners. Sinterly sells no scanner at all: it takes the findings your existing tools already produce and works out which of them are genuinely being exploited, in what order to fix them, and on what evidence. Those are two different purchases at a similar monthly price, and it is worth knowing which one you are making.

So the honest answer depends on where you are. If you run no scanners today, buy those first: we would have nothing to work on, and we will tell you so rather than sell you a trial. If you already run two or more and cannot tell which of their findings actually matters, that is the problem Sinterly was built for, and everything you already pay for stays exactly where it is.

Trial

Freefor 30 days

The whole product, with no card and no obligation.

  • Every feature, not a cut-down edition
  • Upload scanner output, or connect a source
  • Set-up help directly from us
  • Your data stays yours, and leaves with you
Request a trial

Starter

Let's talkafter your trial

For a team where one person owns security.

  • Up to 5 targets
  • Unlimited scanner uploads
  • One live connector
  • Jira ticket creation and status sync
  • Independent exploitability verdicts with evidence
  • Build gate, advisory
Discuss Starter

Team

Let's talkafter your trial

For a security function with a backlog to answer for.

  • Up to 25 targets
  • Every connector we have built
  • Build gate in blocking mode
  • Threat-model ingest and design-intent checks
  • Board summary and decision exports
  • Recorded risk acceptances with expiry
Discuss Team

We would rather earn the conversation than win it on a number. Run the trial, see what Sinterly actually finds in your backlog, and we will agree a fair monthly price for the plan that fits, based on how many targets you ended up watching and what you used. No per-seat charge, no minimum term, and no automatic conversion: nothing is billed unless you have said yes in writing. If it turns out Sinterly is not right for you, we will say so.

Questions, answered honestly

What is a Security ETL Engine?

Security scanners produce findings in incompatible formats with no shared idea of severity, priority, or ownership. Sinterly ingests those findings (extract), normalises and deduplicates them into one finding model (transform), scores them with an explainable five-component formula, and routes the result to your dashboard and ticketing (load). The same discipline data teams apply to analytics pipelines, applied to security findings.

Which tools does Sinterly work with today?

Ingestion: any scanner that produces SARIF 2.1.0, verified with Semgrep and Trivy, with Grype, ZAP, Gitleaks, Checkov and CodeQL output recognised, plus CSV exports, OTM threat-model files (pytm, IriusRisk), and a direct connector for GitHub Code Scanning. Ticketing out: Jira. Asana and Azure DevOps are planned; you can register interest in the product and we build the most-requested first. We only list integrations that are built and verified.

Do I need to give Sinterly access to my source code?

No, and this is deliberate. Sinterly works on scanner findings, never source code. Upload scanner output you export yourself and we hold nothing else. If you use the GitHub Code Scanning connector, its token is scoped to scanner findings only (a fine-grained token with code-scanning read cannot read your repositories' contents), and it is encrypted with AES-256-GCM before it reaches our database, never displayed again after saving.

What happens to my data?

Findings are stored with row-level tenant isolation enforced by the database itself, so other tenants' data is invisible by construction. Every administrative action is recorded in an append-only audit log protected by a database immutability trigger. Integration credentials are encrypted with AES-256-GCM before they reach the database and are never displayed again after saving.

How is the priority score different from a scanner's severity?

Scanner severity tells you how bad a vulnerability class is in the abstract. Sinterly's score combines five weighted components: exploitability, reachability, business context, cost of delay, and remediation effort. Every score shows its inputs and the weights used at the time it was calculated. You can read the formula, tune the weights, and audit every historical score. No black boxes.

Why not just use DefectDojo?

DefectDojo is a capable open-source findings warehouse you host, operate, and configure yourself, with prioritisation largely left to you. Sinterly is hosted and opinionated: explainable prioritisation, deduplication with human-confirmed merges, and ticketing sync are the product, not plugins you assemble. If you have the time and people to run your own instance, DefectDojo is a fair choice. Sinterly is for teams that do not.

How is this different from an all-in-one platform like Aikido?

Aikido and platforms like it bundle their own scanners: you buy the platform instead of buying scanners. Sinterly sells no scanner at all. It takes the output of whichever tools you already chose and gives you an independent verdict on which findings are actually being exploited, with the evidence attached. The independence is the point: a platform that sells you its own scanner has a reason for its own findings to look important, and we do not have one. In practice the two sit together perfectly well, and a team already running an all-in-one platform is an easier Sinterly customer than one running nothing, because they already have findings for us to work on. If you have no scanner output at all today, buy a scanner first. We will say so.

Can Sinterly fix the vulnerabilities it finds?

No, by design. Sinterly tells you what to fix first and why, with evidence, and routes the work to your ticketing. It never modifies your code; auto-remediation is a different product with different risks, and bolting it on would compromise the thing Sinterly does well. Each finding carries a suggested fix as guidance for the engineer who owns it.

Is Sinterly SOC 2 certified?

Not yet. Certification audits cost more than makes sense at our stage, and we would rather be honest about that than imply otherwise. What we have done: verified the platform against ASVS 5.0 (L2 for the core chapters, L1 elsewhere), enforced tenant isolation at the database layer, made the audit log append-only, and encrypted credentials app-side. The full architecture is on our Security page. SOC 2 is planned when customer procurement requires it.

What happens when I request a trial?

A real person from the team contacts you, sets up your tenant, and walks you through your first ingestion, typically starting with a SARIF export from a scanner you already run. From there the product is self-serve: upload through the dashboard and your prioritised backlog appears in seconds. Early trials are deliberately hands-on: you get direct support, and your feedback shapes the roadmap. No credit card, no automated drip campaign.

How much does it cost?

Nothing for the first 30 days. After that we agree a monthly price with you, based on the plan that fits and how many targets you ended up watching, and we invoice you directly. We charge per target rather than per developer, so growing your engineering team does not raise your security bill. See pricing for what the plans cover. We would rather price honestly against what Sinterly found in your backlog than publish a number you have no way to judge yet, and nothing converts automatically when a trial ends.

Request a trial

Tell us where to reach you and we will be in touch.