Skip to content
opsnite
Verification

How we know it works, and where it doesn’t yet.

One end-to-end validation run across all 13 scan engines, the bugs it turned up, and the limits we found. No customer outcomes, because we’re not claiming any.

13
scan engines tested
9 / 0 / 4
pass / fail / skipped
81
findings persisted end to end
13
bugs found and fixed

On May 3, 2026 we ran one 12-minute validation against a demo tenant. Each engine ran the way it runs for a customer: a scan plan fans out to one isolated container task per engine, results come back over an HMAC-signed ingest, and severities normalize to five levels. All 81 findings from the run were persisted, and 81 of 81 severities normalized correctly. The run surfaced 13 bugs (10 in the platform, 3 in engine adapters), and all 13 were fixed.

Engine by engine

The results.

Skipped means not configured: those four engines need a service the customer runs, and none was attached to the demo tenant.

EngineWhat it findsResult
nucleiKnown CVEs, exposed panels, web misconfigurationspass
trivyCVEs in container images, filesystems, IaC21 CVEs on a node:14-alpine test imagepass
prowlerCloud posture checks for AWS, Azure, GCPpass
nmapOpen ports and service versionspass
openscapSCAP benchmark compliance on hostspass
lynisHost hardening gapspass
zapWeb application DAST findingspass
niktoWeb server misconfigurations, missing headerspass
kube-benchCIS Kubernetes benchmark failurespass
openvasNetwork vulnerability scanningNeeds an OpenVAS service you runskipped
wazuhHost agent alerts and vulnerability dataNeeds a Wazuh manager you runskipped
bloodhoundActive Directory attack pathsNeeds BloodHound CE you runskipped
falcoRuntime security events from containersChecked separately against a stub event source (3 findings)skipped
Beyond the engines

Other checks.

Detection catalog

14,264 detectors indexed at boot (12,958 nuclei templates and 1,306 prowler checks). 13 of 13 browser checks passed.

Plan-driven scans

A policy resolves to exact detectors: KEV-only to 479, critical-only to 1,856. 15 of 15 checks passed.

Hardening

Per-scan task isolation, concurrency above one, retry and dead-letter, asset auto-merge, paginated findings, severity normalization, idempotent feed snapshots. 6 of 7 verified. The seventh, retry on a transient failure, wasn’t triggered because no transient failure happened during the run.

AI teammate

Smoke runs on each quarterly build: 6 of 6.

Limits

What it doesn’t do yet.

  • OpenVAS, Wazuh and BloodHound need a backing service you run. The adapters are certified; we don’t host those services.
  • The BloodHound adapter enumerates attack paths but doesn’t yet score them for risk ranking.
  • Falco has only been validated against a stub event source.
  • Scans dispatch immediately from a plan. Cron-style scheduling is on the roadmap.
  • Many third-party connectors are built but haven’t run against a live customer system.
  • The framework catalog is requirement IDs and titles, not written control narratives.
  • No SCIM, no in-product e-signature, no Word redlining, no Parquet export.
  • No external audit reports for opsnite itself.

Scope of this evidence: one run against a demo tenant, done by us. It isn’t a third-party assessment. For the vendor side, see security.

Want to see a run?

We’ll walk you through a scan plan on the demo tenant and show where each finding lands.

Request a walkthrough