.svg)
One graph. Six dimensions. Every decision.
Heeler is built context-first, not around a scanner with context added later. Connect your repos, registries, and cloud. Six dimensions of context assemble automatically. Every Prevent, Fix, and Operate decision the platform makes reads from the same shared model.
Context is how you secure AI-speed development.
AI coding agents produce code — and vulnerabilities — faster than any team can review, and adversaries chain and weaponize them in minutes. Manual triage and severity queues can't hold that pace; only automation can. And automation is only as good as its context: a CVE in a test file is noise, the same CVE in an internet-facing, Tier-1 service is a P0. Get that wrong at machine speed and you've just automated the mistakes.
Legacy platforms bolt context onto a scanner as an afterthought — a tag here, an ownership CSV there — then still drop a queue on a human. Heeler is built context-first: one shared graph of code, cloud, business, ownership, threat, and agent data decides what matters, so every automated action downstream is safe to take.
Not a data warehouse. An active graph.
The graph begins assembling as soon as you connect your environment and updates continuously as code ships, deployments change, and new threat intelligence arrives.
Every automated decision reads from that one graph, not its own silo:
the coding agent reads it before suggesting an upgrade, a PR guardrail reads it to block or warn, a workflow reads it to route a new finding to the owning team.
One source of truth — the reason Heeler can prevent, fix, and route at machine speed without a human checking every call.
One shared model. Four operational outcomes.
When every decision reads from the same context engine, downstream capabilities become qualitatively different. The question isn't “do you have SAST?” — it's “what happens when the SAST finding lands?”
Precise, not theoretical.
Runtime exposure, reachability, business tier, and threat maturity feed one score — Heeler Risk (Urgent / Plan / Defer), not just CVSS + EPSS from advisory metadata. A CVE in a test-only Tier 4 path never drowns out a live one on a Tier 1 internet-facing endpoint.
Deterministic, not suggested.
Heeler analyzes the dependency graph, changelog, breaking changes, and reachability of called methods, then picks the version — the agent executes, Heeler decides. Validation runs in your own CI before the PR opens, so the result is a merge-ready patch with evidence, not a suggestion with caveats.
Surgical, not blanket.
PR guardrails scope by service runtime context, branch, and diff-only net-new violations — so developers aren't penalized for inherited debt and policies aren't blunted to avoid noise. Block / Warn / Observe lets AppSec roll out policy without an outage.
Autonomous, not campaign-scoped.
Event-driven triggers fire the moment a finding, secret, or malicious dependency lands, and because ownership and ticketing already live in the graph, the work routes itself — a Jira/Linear ticket or Slack/Teams message to the owning team, or an auto-remediation PR. No manual assignment, no triage queue.
Connect three things. The graph builds itself.
Connect three data sources: source control, your artifact registry, and your cloud. The connections are read-only and can be completed in under 15 minutes; from there, Heeler assembles the graph automatically without pipeline changes, tagging, or sensors.
Your SCM
GitHub, GitLab, Bitbucket, or Azure DevOps — code, dependencies, CI/CD workflows, contributors, and history.
What you actually ship
Container and package registries — the built artifacts Heeler fingerprints back to their source commit.
Your CSP
AWS, GCP, and Azure control planes, read-only via API — what's deployed, where it runs, and how it's exposed.
SERVICE MODELING
Every running service, mapped to the code behind it.
Connect your clouds, registries, and SCM, and Heeler fingerprints what's actually deployed and correlates it back to the exact source behind it — a patent-pending method that needs no agents, no sensors, and no build-pipeline changes. It's the differentiator: automation can only be trusted if it knows precisely what it's acting on.
Every workload — serverless functions, containers, and VMs — inventoried straight from your cloud APIs across AWS, GCP, and Azure.
Heeler matches each running artifact to your source using signals like Go symbol hashes, Java class signatures, and file and dependency checksums — resolving the exact running commit with a confidence score. Image and build labels verify the match; they're never required.
Each deployment is keyed to its source changeset and stores the correlation evidence. A new commit is a new deployment — so you always know exactly what's live.
Every deployment is placed on its real boundary — production, staging, dev, test — automatically, so risk scoring and enforcement apply where code actually runs, not where a spreadsheet says it does.
Once a service is modeled, everything Heeler knows attaches to it
- Deployments
- Dependencies
- SCA findings
- SAST findings
- Compromised dependencies
- Secrets
- Endpoints
- License violations
- Service-to-service relationships
That's the jump from a list of findings to a picture of your real, running risk.
Six dimensions of context, assembled once.
Each dimension is a first-class citizen of the graph. Each reads from the same connections. All six are queryable by every layer of the platform — the same context that a PR guardrail evaluates is what the code-generation agent sees.
The AI agent supply chain, inventoried.
Every skill your AI agents load is a new class of dependency — with the same supply-chain risk profile as npm or Maven.
- →Skill catalog inventories every skill file in use: skills.md, CLAUDE.md, AGENTS.md, and equivalents
- →Per-skill inspection: external binaries invoked, shell commands run, secrets embedded, outbound network calls
- →MCP config inventory across the environment
- →A 0–100 safety score per file — higher is safer, At Risk below 70 — with an assessed intent of benign, suspicious or malicious
- →Governance: filter and search across skills as a first-class dependency class
Every repo, module, and dependency — resolved.
Build-emulation resolution — lockfiles optional, no pipeline integration, no manual manifest curation.
- →Full dependency tree: direct and transitive, first-party and third-party — including dependencies vendored inside CI/CD actions
- →Monorepo auto-decomposition into modules — each one resolved as its own unit, not one flat repository
- →Proprietary Symbol Property Graph engine — not pattern matching. Cross-function, cross-file, source-to-sink taint.
- →First-party library lineage traced back to source repo for transitive remediation
- →CI/CD modeled as a peer ecosystem: workflows walked transitively through the full call chain
Deployment state, mapped to code.
Sensor-less inventory means every container, VM, and serverless function is fingerprinted — no agents installed.
- →Each deployment mapped to the exact running changeset — reachability grounded in what actually shipped
- →Running container images fingerprinted and matched back to the exact source commit
- →Service-to-service connections with directionality, data flows, identity relationships
- →Internet accessibility (including CDNs) detected automatically
- →Environmental boundaries auto-classified: production, corporate, DR, staging, test, dev, sandbox
Applications, tiers, and criticality.
The business layer of the graph is what turns a CVE score into a real risk decision.
- →Service tier classification (Tier 1–4) captures data sensitivity, regulatory scope, and customer-trust impact
- →Tier set at the application level cascades to every service in that application
- →Precedence rule: repos shared across applications inherit the highest tier (Tier 1 wins over Tier 4)
- →Applications group services that deliver a shared business outcome — the unit for ownership, tier, and reporting
- →Production identification is automated — no manual labeling required
Who owns what, down to the dependency.
Routing work correctly is the difference between an autonomous fix pipeline and a ticket that sits open for 90 days.
- →Automated ownership — Tech Lead, Security Lead, Assignee — cascading from application to repo, service, and finding
- →Tech Lead and Security Lead designations propagate from app down to individual dependency
- →Team import and sync from Port, GitHub Teams, GitLab groups, and GitHub custom properties
- →Contributor de-duplication across multiple emails and SCM identities
- →Highest-contributor fallback when explicit team mapping is absent
Every feed, resolved and reconciled.
Alias-aware, ecosystem-native, exploit-informed. The threat layer is what turns EPSS-plus-CVSS into a real exposure verdict.
- →Advisories: GHSA (alias-aware GHSA↔CVE resolution), OSV (ecosystem-native), NVD/CVE with CVSS v3 and v4
- →Compromised & malicious: OSSF Malicious Packages, OSV malicious-package stream, Heeler package-risk intelligence, behavioral-SAST backstop
- →Exploit & weaponization: CISA-KEV, VulnCheck-KEV, EPSS (score + percentile), CVSS v4 ExploitMaturity, known-ransomware-campaign flag
- →Supply-chain hygiene: OSSF Scorecard — on the packages you consume, and on your own repositories
- →Continuous re-evaluation — an advisory that switches identifier doesn't break remediation
See the Context Engine across your environment.
A demo connects Heeler to your repos and cloud. Six dimensions come together in minutes, not weeks. From there, prioritization, remediation, and workflows all read from the same shared model — with none of the sensors, tagging, or build changes typical of legacy platforms.
