Our mission
Keep the reasoning. Check it as software changes.
A security decision depends on the software someone reviewed. The code changes. The configuration changes. The reasons behind the decision may need another look.
We want to make that reasoning reusable and keep it connected to the evidence that supports it. That is our ambition for continuous software assurance.
Working today
We are starting with scanner findings.
ICTX takes supported scanner output and attaches evidence from code and configuration. It applies deterministic rules where the evidence supports a decision. When a finding needs review, the missing evidence is stated.
Proposed next step
What if a decision could tell you when it needs another look?
Can we preserve a reviewed decision and identify the changes that require it to be reviewed again?
A finding might be dismissed because a caller validates its input. If a new caller bypasses that validation, the earlier conclusion may no longer hold. We want to show what changed and why it matters to that decision.
This is proposed work. Today's product does not track those changes or revalidate earlier decisions. We are talking with teams to learn whether this is the right next step and what would make it useful.
Longer-term direction
Keep software aligned with important constraints.
The same approach could eventually support security reviews, privacy requirements, and architectural constraints. Developers and coding agents could use current, scoped reasoning where changes are proposed and reviewed.
Each extension needs its own evidence and evaluation. Static code evidence cannot establish runtime behavior, complete privacy compliance, or overall software safety.