Get a clear view of your entire application at runtime with our dynamic SBOM.
We gather all potential vulnerabilities from custom code, and open source and third party packages.
We then trace application flows from the internet-facing API to the vulnerable line of code, and determine which packages are loaded and in-use, and which ones are not. Oxeye ignores those that are never used.
Oxeye fetches configuration data from the Cluster, Container and Cloud layers to understand the internet-accessibility risk factor, then adds additional risk factors such as extra permissions to get a more refined view.
Oxeye recalculates severity by focusing on the exploitable vulnerabilities, to help prioritize remediation efforts.