Build truth, ranked risk, and signed evidence — from what actually compiled and linked.
01 · Build truth
Strig watches compile and link: every input, flag, toolchain, and artifact. That signed record is the foundation for risk, SBOM, and the gate.
Open Build Truth
02 · Ranked risk
Architecture context first drops or lowers feasibility. Damage scenarios then revise impact on this product. Risk is those two together. Code reachability is the most others do. You tell us the exposure model once — what is exposed, what an attacker can reach. Strig does not invent your architecture.
Open Risk Posture
03 · Signed evidence
Policy on signed build evidence. Pass or fail is deterministic. The audit pack — SBOM, provenance, findings, verdict — travels with that exact artifact.
Open the release gate
In the product
Each tab is a view of the same build record.
How it works
Strig watches the build, then funnels findings through the Risk model.
1 · Before
Issues in source and config while the product is still code.
2 · During
What compiles and links — flags, toolchain, vendored code.
3 · After
The shipped image, once the evidence of the build is gone.
Outcome
What customers actually run
Strig
Feasibility and impact, from architecture. That combination is the risk.
01
The whole build: every compile, link, dependency & flag.
02
Real artifacts checked against your policy.
03
Architecture context: feasibility first, then impact. Risk is both.
04
Cryptographically seal the evidence.
05
Deterministic pass / fail in your pipeline.
One signed evidence package per build
A Security Findings Report, a ground-truth SBOM, SLSA provenance, and a machine-readable gate verdict.
Fast
Delta checks only
Light
Seconds of overhead
Yours
On-prem & air-gap
Differentiators
Signals package manifests and generic scanners never see.
CycloneDX from source and binaries — not package manifests. What compiled is what counted.
Catch forks and patched embeds that package managers never see.
Flag components of concern by origin policy and your denylist.
Verify compiler and linker versions. Catch stale and untrusted toolchains.
Architecture context drops or lowers feasibility, then revises impact from damage scenarios. Risk is both — not a reachable finding of low impact.
Detect suspicious compile and link invocations before they ship into the artifact.
Cross-check composition against known-malicious package intelligence.
AI advises. Gate decides.
AI ranks findings and drafts remediations. The release gate runs on policy and signed evidence only.
Request access. Strig runs during compilation. No pipeline rewrite.
