CYBO/attest
Everything you need to secure and ship your release.
From commit to approval, Attest scans every release and Explainable AI hands your developers the exact fixes. Every security check in one place, signed off by a person you trust.
30-day free trial. No credit card required. Cancel anytime.
Security checks on every release
What you get
From push to a signed decision. Attest does the checking and the explaining. A person makes the call.
Connect and scan
Connect a GitHub or GitLab project. Attest runs 7 scanners and 12 checks on every release.
Fix what it shows you
Explainable AI explains each finding from the evidence and hands your developers the exact update, ranked so the first change clears the most.
A person decides
Some checks block the release outright. The rest go to a named reviewer, who accepts each with a written reason or sends it back. Authorize unlocks only when every item is resolved.
7 months about 2 hours
Army Cyber (ARCYBER), March 2026: software authorization went from 7 months to about 2 hours on the pipeline Attest is built on.
containers a week cleared by one reviewer. It used to take 2.5 people 30 days to clear 60.
Built with Army Cyber, inside the U.S. government, to run in IL5 and higher environments.
One question, whoever is asking. Who approved this release, and on what evidence?
Department of War and defense contractors
An ATO, continuous ATO, or CMMC evidence. Every release checked, every exception decided by your Security Control Assessor, every decision ready for your Authorizing Official.
Financial services, telecom, healthcare and software teams
SOC 2 and ISO 27001 evidence, answers for examiners and regulators, and enterprise customer security reviews passed with a record, not a spreadsheet.
The record supports SOC 2, ISO 27001, CMMC and ATO evidence: what was found, what was fixed, what was accepted, on what basis, and who decided.
Each role sees the question it has to answer. All three read the same record.
What is blocking my release, and exactly how do I fix it?
- Where the build is, from built to authorized
- What blocks submission, in plain words
- Ranked fixes: the first change clears the most
- What needs a written justification
- Submit for review when it is clean
A fix, not a ticket.
What needs my decision, and can I trust the evidence?
- The queue, shared across the team
- The verdict, and only the items that need a call
- The evidence, with its Explainable AI write up
- Accept with a written basis, or reject and send it back
- The trace from commit to controls
Decisions, not dashboards.
Where is our risk across every application, and what are we accepting?
- Open CVEs across assessed builds, authorized and current, pending authorizations, mean time to authorize, open risk decisions
- CVE exposure by severity
- Risk by CCI control
- A build impact assessment: the risk of accepting each proposed build
Every figure is a count, ratio or mean of recorded decisions.
Proof, not promises.
Seven scanners, twelve checks, every release. Some block outright. The rest go to a person, who decides in writing.
Your code
Static analysis of your source for insecure patterns.
Blocks the release
- Open static analysis findings block submission.
Needs a person to decide
- A finding you judge safe is justified by rule id, in writing.
Maps to NIST 800-53 SA-11 and the DISA CCIs under them
Live secrets
Credentials in the image, checked against the service to see whether they are live.
Blocks the release
- A verified live credential blocks. Revoke it, rotate it, remove it.
Needs a person to decide
- An unverified pattern is justified by file.
Maps to NIST 800-53 IA-5, AC-6 and the DISA CCIs under them
Dependencies and OS packages
An SBOM of every component in the image, matched against the public vulnerability list.
Blocks the release
- A Critical CVE is fixed, never mitigated.
- A High with a fix available is fixed.
Needs a person to decide
- A High with no fixed release, and any Medium or Low, can carry a written justification.
- A vulnerability database older than 30 days at scan time.
Maps to NIST 800-53 RA-5, SI-2 and the DISA CCIs under them
Malware
Every file in the image scanned for malicious code signatures.
Blocks the release
- Any signature match blocks. It cannot be justified.
Maps to NIST 800-53 SI-3 and the DISA CCIs under them
Dockerfile
Your Dockerfile checked against build best practice.
Blocks the release
- Dockerfile errors block.
Needs a person to decide
- Warnings go to a person; a rule can be justified by its code.
Maps to NIST 800-53 CM-6 and the DISA CCIs under them
Base image and user
The image starts FROM an approved base image and runs as a non root user.
Blocks the release
- An unapproved base image blocks.
- A root user blocks at staging and production.
Maps to NIST 800-53 CM-6, AC-6 and the DISA CCIs under them
The running app
A dynamic scan of the running application.
Needs a person to decide
- Every open alert needs a decision, or a written reason to skip it.
Maps to NIST 800-53 RA-5 and the DISA CCIs under them
Pipeline health
Every scan stage finished, your CI jobs passed, and your tests cover the code.
Blocks the release
- A scan stage that did not finish blocks.
Needs a person to decide
- Failed CI jobs and low test coverage go to a person.
Maps to NIST 800-53 RA-5, CM-6, SA-11 and the DISA CCIs under them
Every decision traces to the commit. Every check maps to DISA CCIs and NIST 800-53.
Open any finding and follow it back: the source commit, the pipeline run, the scanner that produced the evidence, the rule that raised it, and the controls it satisfies. The record shows who accepted what, on which evidence, and why.
- Source commit
- Pipeline run
- Scanner
- Rule
- Controls
- Named reviewer
Explainable AI explains. People decide.
Explainable AI does
- Explains each finding in plain language, from the scan evidence
- Tells your developers the exact update to make
- Drafts a justification for an engineer to edit and sign
- Shows its evidence; a narration that cannot cite it is not shown
It never
- Decides pass or block. Fixed rules do that.
- Proposes a basis for accepting a risk
- Records a decision or signs one
A named reviewer signs under their own verified identity.
One price per organization. Early access for the first 100 teams.
Attest
Early access priceFirst 100 organizations
$199 per organization per month
- Up to 10 users
- Every container in your pipeline
- Explainable AI on every check and finding
- GitHub and GitLab projects
- Early access rate kept for as long as you stay
30-day free trial. No credit card required. Cancel anytime.
Managed review
Your pipeline, our reviewers
- Everything in Attest
- Ulap reviewers review and sign off on your queue
- Your people can take any decision back
Program
Dedicated deployments, by agreement
- Dedicated tenancy in your environment, including IL5 and higher
- AWS GovCloud for the Department of War
- Policy authored to your control set
Questions people ask.
How is this different from our scanner?
Scanners hand your team a list. Attest runs seven of them on every release and then does what they do not: Explainable AI explains each finding from the evidence and gives your developers the exact update to make, ranked so the first change clears the most. Serious failures go back to engineering automatically. What remains goes to a named person, who accepts it in writing or sends it back. Keep the tools you already run.
What do we need to start?
A container your team builds in a GitHub or GitLab project, and a few minutes to sign up. Our engineers connect your first application with you, run the first scan, and work your first review with your reviewer on a call.
Does the AI approve anything?
No. Fixed rules decide pass or block. Explainable AI explains the finding and drafts the reasoning with its evidence cited, and a narration that cannot cite its evidence is not shown. It never proposes a basis for accepting a risk, never records a decision and never signs. A named reviewer signs under their own verified identity.
What happens when the trial ends?
Your organization turns read only. Everything you recorded stays, and your team can still sign in and see it. Start the subscription at $199 per organization per month to keep working; nothing is deleted. You can subscribe any time during the trial.
Can we run it in our own environment?
Yes, on the Program plan: dedicated tenancy in your environment, including IL5 and higher, with policy authored to your control set. Dedicated deployments for the Department of War can run in AWS GovCloud. Talk to us.
Know what blocks your release today.
Connect a project, run the scans, and get the exact fixes. Your reviewer signs off with the evidence attached.
30-day free trial. No credit card required. Cancel anytime.