The Cidra platform
Four operational paths. One honest finding ledger.
Start with an inventory, release binary, API contract or authorised public URL. Cidra turns each supported observation into evidence, a remediation decision and a reproducible rescan—without pretending planned scanners are already coverage.
A module is live only when it executes, records evidence and participates in rescan closure.
Unsupported, unresolved and unavailable inputs stay visible instead of becoming clean results.
Packet-generating and executing modules remain disabled until isolated-runner controls exist.
OPERATIONAL NOW
Choose the evidence you already have.
Each module is deliberately narrow enough to explain exactly what it did—and what it could not establish.
Composition analysis
Upload CSV, TSV, CycloneDX or SPDX. Resolve identities, match versions and keep unknowns visible.
Inventory → affected rangeExplore module →02OperationalNative binary assurance
Inspect PE, ELF and Mach-O hardening, signature structure and redacted high-confidence secret signals.
Artifact → hardening evidenceExplore module →03OperationalAPI contract audit
Audit OpenAPI and Swagger transport, authentication, inventory and resource-limit declarations without traffic.
Contract → policy gapsExplore module →04Passive liveWebsite testing
Assess one authorised public page and bounded redirects for transport, headers, cookies and limited HTML signals.
URL → passive observationsExplore module →ONE REMEDIATION SYSTEM
Different evidence. The same decision surface.
Automated observations are deduplicated by scanner and target. Human workflow state survives rescans, while a previously resolved weakness reopens when it returns.
What needs attention now
Operational scanner results, one prioritised queue.
CND-1042Missing Content Security PolicyWebsiteHighCND-1043DEP is not enabledBinaryHighCND-1044Anonymous API operationAPI contractMediumEVALUATION DETAIL
The numbers an evaluation actually turns on.
Accepted input, the execution bound each module runs under, what it produces and — the column most datasheets omit — what it cannot establish.
| Module | Input | Execution bound | Produces | Cannot establish |
|---|---|---|---|---|
| Composition analysis | CSV, TSV, CycloneDX, SPDX · 12 MB | No agent, no repository access | OSV applicability, KEV, EPSS, SSVC band | Whether a vulnerable path is reachable in your build |
| Native binary assurance | PE, ELF, Mach-O · 25 MB | 0 bytes executed · 0 network requests · upload discarded | 15 checks · 8 MB string scan | Code-signing trust, malware safety, runtime behaviour |
| API contract audit | OpenAPI 3.x, Swagger 2.0 · 10 MB | 0 network requests · servers and $refs never contacted | 13 checks across 4 families | BOLA, business-flow abuse, live rate enforcement |
| Website testing | 1 authorised URL | ≤3 redirects · 512 KB read · 10 s timeout | 9 observations, WSTG-referenced | Anything behind authentication, or any active payload |
The final column is the one worth reading twice. Every scanner publishes what it finds; in an evaluation the useful question is what it cannot see, because that is the part still left to cover some other way.
CWE
Weakness classification on binary and API findings
CWE-20CWE-119CWE-319CWE-354CWE-494CWE-598CWE-693CWE-798CWE-1104OWASP WSTG
Web observation methodology references
WSTG-ATHN-01WSTG-CONF-07WSTG-CONF-12WSTG-CONF-14WSTG-INFO-08WSTG-SESS-02Mappings are attached to findings by the scanner itself, not added afterwards by a report generator. A check with no defensible mapping carries none, which is why the lists above are shorter than a coverage claim would be.
THE APPROACH
Evidence before confidence.
Cidra separates observation, interpretation and remediation so a technical signal never silently becomes an exploit claim.
- 01Bound the input
Validate identity, byte size, target authority and execution mode before assessment.
- 02Run one named technique
Each module has a finite parser or request budget and a stated evidence boundary.
- 03Persist the finding
Stable deduplication, provenance and redacted evidence feed one remediation ledger.
- 04Verify the fix
A complete rescan updates or resolves only findings that technique conclusively reassessed.
CURRENT BOUNDARY
Static and passive modules are live. Intrusive testing is not.
Authenticated crawling, API fuzzing, network probing, dynamic binary/mobile sandboxing and attack-path validation remain on the gated roadmap. They are not included in current execution coverage.