A Security Cockpit Where Unknown Is Never Green
AI writes applications faster than anyone can review them. We built posture management for a portfolio of roughly 35 AI-generated apps, on one rule: a blind spot is displayed as a blind spot, never as an all-clear.
Venture portfolio operator · ~35 production apps
software!The Need
A portfolio of roughly 35 AI-generated applications was running in production on managed backend and hosting platforms. Generation had outpaced review: nobody could say, on any given morning, which repositories had branch protection, which had secret scanning switched on, which databases had world-readable tables, or which production deployments were carrying preview-scoped credentials. Commercial posture-management tooling was priced and scoped for a different shape of organisation. The failure mode that worried the team most was not a missed finding but a dashboard that showed green because a sensor had quietly failed to read something.
The Approach
We built a bespoke application security posture management cockpit around one invariant: unknown is not the same as clear. Five independent sensors run on a weekday schedule — repository health, per-repository control posture, open alert counts by severity, row-level-security posture across every database project, and production deployment and credential-scope state. Each sensor emits its own feed; a thin aggregation layer correlates, ranks and bands them into a single triage view rather than re-scanning. Any sensor missing its credential fails honestly to hazard instead of silently reporting clear, and a calm all-clear appears only when every sensor has been read and nothing is unknown. Each run stores one complete sweep, so history is free and the cockpit can diff the latest sweep against the prior one to surface regressions since the last look.
