Find real weaknesses. Fix what matters. Keep testing.

Frequently asked questions

What is SecureGraph?

SecureGraph helps small teams find real weaknesses, keep testing, and fix what matters.

The front door is vulnerability assessment and penetration testing (VAPT). Growth adds continuous security, remediation guidance, and reports that use only verified findings. Asset inventory, risk, and optional compliance or SOC depth sit on the same platform. You get one subscription and you can leave modules off.

Your security records live in a database you control. We never treat your production business systems as a playground. We never invent vulnerabilities. AI explains what the engines already found.

Where does my security data live?

Security evidence lives in a dedicated PostgreSQL database that you provision and control. The evidence includes assets, tests, findings, and risks. You choose the host. SecureGraph connects to that store and writes into it.

We do not park your vulnerability history in a shared multi-tenant lake next to another organization’s data. We do not read your ERP, CRM, or customer production data. On the platform side we keep what runs the organization: identity, roles, billing, and configuration.

If you leave, you keep your security data. It was never ours to hold hostage.

Is the Free plan really free?

Yes. You do not need a card, and there is no countdown trial.

Free is the entry surface. Create your organization, use dual control and MFA, inventory assets within fair-use caps, run light hygiene checks, and export basic formats. You get a one-time 500 AI credits, then free open-source models if enabled.

Full VAPT campaigns, continuous testing, deep cloud and SOC packs, and board PDF packages are on Starter and Growth. Free helps you know your surface before you spend. It does not replace a paid assessment plan.

Do I need a demo before I can start?

No. Create a free account and use the product straight away. You do not need a call or a card.

Book a demo if you want us to show how SecureGraph fits your environment, your team, or your procurement process. Larger organizations that need SSO, custom contracts, SLAs, or a private deployment can talk to sales from the Enterprise plan.

How is this different from buying a scanner?

A scanner puts issues on your desk. You still need someone to retest, prioritize, fix, and explain them to leadership.

SecureGraph starts with scoped VAPT. It verifies what is real, guides remediation, and can keep testing continuously on Growth. All of this occurs in one place. You can add compliance mapping and SOC depth when you need them. They are not the reason to buy.

The other difference is ownership. Your security database stays yours.

Will AI invent fake vulnerabilities?

No. Agents can only work with what the engines already stored. They help write findings, suggest fixes, and plan investigations. They do not create findings, change scores, or bypass dual control.

Reports emphasize verified material. Unverified noise stays quarantined. Your board should only see what you can stand behind.

Can we use this without a full security team?

Yes. SecureGraph is built for the one-person security team. This person is often the engineer or operations lead who also owns security.

It inventories assets continuously, separates verified issues from noise, tracks fixes, and produces board-ready reports. You do not write them from scratch at midnight.

Do you support Nigerian companies and NDPA?

Yes. Privacy is a foundation. Security data stays in infrastructure that you choose. AI paths prefer controlled models, and we audit all actions.

We help you prepare evidence for privacy and security conversations. Formal certification such as ISO or SOC 2 remains your responsibility. We are the tool that helps you build the case. We are not the auditor.

What if I need a full human penetration test?

Engagements put SecureGraph practitioners on the same platform that you use each day. They scope, run, and report inside your environment, so findings follow the same verification path as your internal assessments.

Ask us about full VAPT, complex application testing, mobile dynamic testing, and guided board reporting.

How do I get started?

Click Get started free, create your organization, and connect a security database. You can bring your own Postgres, or ask about hosted options when available.

Add a small set of assets and run your first assessment on Free. Move to Starter when you need full VAPT and verified reports, and to Growth when you need continuous testing. You do not need a card to begin.

Can I connect SecureGraph to GitHub CI/CD?

Yes. Install the GitHub App on the repositories you want reviewed, or connect GitLab or Gitea, and SecureGraph reviews pull requests and new commits as they arrive. Review runs against the changed files, so the findings land where your team already looks: the pull request. You can also report on a branch (Continuous PR) and, where it is switched on, have SecureGraph open a fix PR rather than a ticket. Provider webhooks and CI webhooks from other pipelines are supported too.

Does a finding tell me which file and line the problem is on?

For code findings, yes. Each result carries the repository path, the line number and the rule that fired, so you can open the file at the exact place. Findings from network and web testing point at the asset and the request/response instead, because there is no source line to quote. The location is stored on the finding, so it survives into the report and into the ticket your team works from.

Can it scan compiled binaries?

Not native binaries. SecureGraph does not decompile or fuzz ELF or PE executables today. It does analyse source code, dependencies and container image contents, mobile packages (.apk and .ipa) statically, and infrastructure-as-code. If what you ship is a binary, scan the source and the dependency manifest before the build — that is where the fixable issues are, and where a fix can actually be merged.

Can I scan a repository that contains two or three languages?

Yes, and you do not configure it per language. SecureGraph works out which languages are present from the files it is given and runs the right analyser for each: Python with Bandit, Go with gosec, JavaScript and TypeScript with ESLint plus the general engine, PHP with PHPStan and Psalm when the project has Composer, C# and legacy .NET including .aspx with DevSkim, and OpenGrep across all of them. A monorepo is one scan, not three, and no file is analysed twice.

Can I export a report as CSV or PDF?

Yes, both are built in. One report can be produced as PDF, DOCX, XLSX, HTML, Markdown, JSON or CSV from the same findings — no conversion step, and every plan includes the formats. You choose the format on the report itself.