How Alphaea works

Alphaea is one security platform that covers the whole surface of a modern application: its source code, its dependencies and secrets, its infrastructure-as-code, the live web app, the network around it, and the cloud accounts it runs in. Instead of stitching together six separate tools, a tester drives all of it from one console.

The part that makes it different: Alphaea supplies the logic — how to look, what to try, how to prove it — but the thinking is done by whatever AI model you connect. Bring Kimi, Claude, Llama, OpenAI, DeepSeek, or a fully local model. Alphaea runs a deterministic engine first so most of the work costs no tokens at all, and only hands your model the small, structured questions that actually need reasoning.

At a glance: your targets go into the console; an orchestrator checks them against a signed scope and routes each one to the right engine; deterministic checks run first, your AI reasons over what is left, and the results become reports, framework coverage, a CI/CD verdict, and learning.

When Alphaea tests a live web application it runs a chain of stages. Each stage has one job, and the second-to-last one is the reason the reports are trustworthy: if an attempt can't be proven, it never becomes a finding.

Each engine is deliberately simple to reason about: what it looks at, what it gives back, and whether it needs your AI or runs purely on deterministic rules.

Sending a whole scan's raw output to a language model is what makes AI security tools expensive. Alphaea inverts that. Deterministic engines do the bulk work and compress what they find into a small, structured summary; only that summary reaches your model. The exact compression technique is proprietary — but the shape of it is simple:

Because the model is yours, you also choose where it runs. A local model (Ollama / vLLM) means zero egress; a hosted model means only that small summary is exchanged, never your code or data.

Every finding is crosswalked to the frameworks an auditor cares about — OWASP Top 10, CWE, MITRE ATT&CK, CIS Controls v8, NIST 800-53, PCI-DSS 4.0, ISO 27001, OWASP ASVS, HIPAA and SOC 2. A tester picks the frameworks for the engagement; the report and a coverage view then render for exactly those, showing which controls were exercised and where the gaps are. ATT&CK results export as a Navigator layer.

Alphaea drops into a pipeline as a pass/fail gate. A build runs a scan; Alphaea scores the findings against a policy you set — maximum counts per severity, an optional weighted risk ceiling, which scan types count, and whether only tester-validated findings count. If the policy is breached the gate returns a non-zero exit code and the pipeline stops before the artifact ships. Copy-paste snippets are provided for GitHub Actions, GitLab CI, Jenkins and plain curl.

When your team confirms a finding or marks one a false positive, that decision becomes tenant-local learning data. Alphaea feeds it back so future scans suppress the noise your team already dismissed and lean into what they care about. The flywheel belongs to you — it is never pooled into a vendor model.

Alphaea comes in three tiers. On Cloud, your workspace is isolated per-tenant and never used for training. On Hybrid and Sovereign (on-prem), the platform runs inside your environment and — with a local model — no code, traffic, finding or secret crosses your boundary at all. You choose the trade-off between convenience and isolation; the capabilities are the same.

This page explains what each part does and how the pieces connect. A few things are intentionally described as validated black boxes, because they are the platform's core IP:

• The exploit-planning and payload construction logic behind dynamic testing.
• The token-minimization technique that keeps AI cost tiny across every model.
• The secret-detection engine (entropy / decoding heuristics).
• The internals of scope signing and the proof-validation judge.

Everything about inputs, outputs, data flow and coverage is open here; the detection and cost internals stay with us. If you are evaluating Alphaea and need a deeper technical session under NDA, that is available on request.