Thrust is a small security company in Barcelona. We audit applications and code by hand, and we build the platform that keeps checking them after we leave.
Read-only access. We never ask for write permissions.
Pentests, code reviews and audits, done by hand by our own engineers on an agreed scope.
Scanners on every change, turned into a short list of real, verified problems.
Whatever we find, by hand or by scanner, is tracked in the same workspace until it’s fixed.
Hire our engineers for an audit, subscribe to the platform, or both. You don’t have to choose up front.
An engagement
A person tests your application or reads your code by hand, on an agreed scope and under formal authorization.
A subscription
Scanners run on every change, and the platform turns their output into a short list of real, verified problems.
Audits
No hundred-page reports full of scanner output. We validate every finding, tell you what it means for your business and which to fix first, and work with your team until the fix is confirmed. Whatever you need tested, we scope it with you.
Web apps, APIs and external exposure, tested by hand on an agreed scope.
An engineer reads the code that matters most, before a launch, a funding round or an acquisition.
What you depend on and ship, with the risk explained. For a release, a client or due diligence.
An app, system or process checked against ISO 27001, ENS, PCI-DSS or OWASP ASVS, with an action plan.
Not on the list? Tell us what you need and we’ll tell you honestly whether we’re the right people for it.
Whether or not you use the platform afterwards.
Need it for compliance? On request, we map the findings to the controls of the framework you report on.
The rules behind every engagement and every scan.
AppSec platform
Thrust cuts the noise from your security tools down to the problems that are real, proves them against your code and tracks them until they’re fixed. Our engineers’ findings go through the same funnel.
What our engineers find in an audit goes into the platform and through the same tools as what the scanners find. Same deduplication, same AI checks, same tickets, same history.
Our engineers by hand
Platform scanners automatic
Thrust
Same tools, whoever found it
One list. Same format, same tickets, same SLAs.
Our engineers test the agreed scope. Each finding is validated before you see it.
The report, and every finding in your workspace: prioritised, verified and ready to assign. The re-test of your fixes is included.
Subscribe, and the scanners keep testing every change. New findings join the ones from the audit, in the same list.
Stop after step 2 and you have a complete audit. Step 3 only adds continuity.
Every finding, from a scanner or from our engineers, follows the same steps. Each one leaves a record of what caused it: a tool, the AI or a person.
Read-only repo access, or a CI step
Open source engines in sealed, throwaway containers
Same issue, one finding, even when lines move
Your rules decide what’s worth fixing
AI checks it’s exploitable and attaches proof
Ticket in your tracker, with an owner and SLA
Only when every tool re-scans clean
Comes back? It’s reopened, history intact.
From the first commit to production, and the audit on top.
What’s in the code you ship?
What do you depend on and ship?
What does an attacker see from outside?
Spans every stage. What can you show an auditor?
Coming later: artifact signing, deployment policy gates and on-premise scan workers.
An agent reads the code around each vulnerability and decides whether it can really be exploited. You set the policy: what the AI looks at, and what happens with every verdict.
3 · What happens with each verdict
Shown with our defaults, where nothing is closed without a person. Try changing them: each project can have its own policy, and every automatic action is logged and can be undone.
You pay for the AI you consume, nothing flat.
A ceiling you choose yourself to keep your spend under control. No surprises.
Turn off sending code to the AI at any time.
See exactly how many tokens each task used, down to every single analysis.
The work already recorded in Thrust maps to the controls your auditor asks about.
The AI proposes mappings. A person on your side approves them.
Pick how we see your code. Tickets go to your tracker.
or
No write permissions in either mode. Thrust never pushes code or changes settings.
You’re giving a security vendor access to your code. Every scan runs inside four walls.
Separation enforced in the database itself.
Stored credentials encrypted with a key unique to you.
The minimum scope needed to read code.
Every action by a tool, the AI or a user. No edits after the fact.
Tell us what you need tested and we’ll scope an audit with you. Or we’ll walk you through the platform on an example project. You can always add the other later.
Or write to hello@thrustsecurity.com