CyberAudit
Runs on Frontier Foundry's own system · For Banking, Government and Defense
Source-code security audit for institutions that cannot send their code anywhere. CyberAudit checks a codebase against a local knowledge base of about 290,000 CVEs, makes every finding survive an adversarial challenge before it is reported, and hands your security officer a report that opens with a verdict. In production it runs on Frontier Foundry's own system, entirely on your hardware: no code egress, no cloud APIs, no per-scan fees.
Every finding has to survive a challenge.
Generic code review flags whatever looks risky. CyberAudit grounds each finding in real vulnerabilities, then tries to disprove it. Rule-based recognizers for well-understood patterns, such as JWT algorithm confusion, SQL parameterization and hard-coded fallbacks, settle those cases outright, so judgement is spent where it is needed.
-
1 · Auditor
Reads the codebase and proposes candidate findings, each tied to the vulnerability classes and real CVEs it resembles in the local knowledge base.
-
2 · Challenger
Tries to knock every candidate down before it reaches you: false-positive triage, recognition of defenses already in the code, schema checks, and rejection of anything ungrounded.
-
3 · Overnight diagnostics
An optional deeper pass for architectural defects that file-by-file scanning misses, with a triage queue and a health signal for the engagement.
A report your security officer can sign.
A deep scan ends in a 25–30 page report written for the CSO, plus the machine-readable findings behind it.
-
A Verdict First
An executive summary that opens with NOT READY, CONDITIONAL or READY, then the findings by severity and CWE.
-
Every Finding Explained
Per-finding cards with the evidence, the fix, and cross-references to OCC 2023-35, NYDFS Part 500, the FFIEC IT Handbook and NIST SP 800-53.
-
What It Dismissed, and Why
Near-miss analysis of serious findings the Challenger demoted, and the false positives it rejected, so a reviewer can disagree with the tool.
-
Machine-Readable Too
Structured JSON findings per file, a run log, and a systemic-patterns file that lifts defects repeated across the codebase.
On an 814-file production codebase.
A financial-crime compliance platform in Go, Python, Rust and TypeScript, about 250,000 lines, audited twice with only the pipeline changed between runs. Runtime was the same both times.
-
2.24×
more findings upheld after adversarial review than the previous pipeline, same codebase
-
~30% → ~84%
estimated precision of upheld findings
-
0
lines of code, embeddings or results that leave your environment
-
$0
per-scan or API fees
A self-hosted command-line tool and services on Linux or macOS, on a workstation-class GPU or Apple Silicon machine, including fully air-gapped installs. CyberAudit is a scanning aid for audit teams, not unattended assurance: reviewers mark each finding true or false positive, and that ledger calibrates the next scan to your codebase.
See it inside your environment.
CyberAudit walkthroughs are available under NDA. Schedule a deployment assessment to see a scan, the Challenger's reasoning and a full CSO report run against a codebase you choose.