What the industry sells
A vertical stack of scanners and an ASPM to collect their outputs. Each tool has its own idea of what a "finding" is. Correlation is a manual job that never finishes.
Product · Category
Softinel is the ontology of your software.
Everything else is a query.
Security tools scan software. Softinel builds a canonical, connected, versioned model of it — and every question a security tool, a verifier, an auditor, or an architect can ask becomes a query against that model. This is not another entry in the ASPM aisle. This is the layer that was always missing underneath it.
The category problem
Every tool in this market answers a question.
None of them owns the thing being questioned.
SAST answers "is this line dangerous?" DAST answers "does this endpoint break?" SBOM answers "what did you ship?" ASPM answers "where are all the previous answers?" AI review answers "does this diff look reasonable?"
Every one of them is an output. None of them is the model the output should be derived from. Which is why buying more of them makes your dashboard bigger but your understanding smaller.
What was missing underneath
A single, canonical, queryable model of the software itself — files, symbols, calls, data flows, contracts, dependencies, deployments, evidence, history — all connected. Softinel is that layer.
What we mean by ontology
It's a load-bearing word.
"Ontology" is not decoration. It is the specific claim that distinguishes Softinel from every scanner-plus-dashboard company in this market. Four properties, all mandatory:
01
Canonical
One representation of the software, not one per tool. A file, a symbol, a call edge, a data-flow, a dependency, a policy, a piece of evidence — each exists once and has one identity.
02
Connected
Everything relates to everything. A CVE resolves to the exact call sites that reach it. A finding resolves to the architectural boundary it violates. A deployment resolves to the semantic delta that made it different.
03
Queryable
Every insight the platform surfaces — and every one you can imagine surfacing later — is expressible as a query against the model. Not a script that scrapes a scanner's output.
04
Versioned & evidence-bearing
Every node and edge in the model carries where it came from, when, at what confidence, and how it changed. The model has a history. The findings are consequences of that history.
Everything else is a query
One model. Every question.
Here are the questions companies buy an entire product to answer. In Softinel, every one of them is a query against the same underlying model. That's the whole point.
Question
Is this snapshot safe to deploy?
Resolves as
Verification query — evaluates policy against model + evidence.
What people buy: a verification tool.
Question
Which files reach the auth boundary?
Resolves as
Graph query — walks the call graph from a boundary node.
What people buy: an architecture linter.
Question
What secrets leaked, and where do they flow?
Resolves as
Data-flow query — sources → sinks across the model.
What people buy: a secrets scanner.
Question
Which dependencies land inside PCI scope?
Resolves as
Reachability query — dependencies × PCI-tagged subgraph.
What people buy: an SBOM + compliance tool.
Question
What did this deployment change semantically?
Resolves as
Diff query on the digital-twin snapshot pair.
What people buy: change intelligence tooling.
Question
Does this PR violate our SBOM policy?
Resolves as
Policy query — dependency delta × policy predicates.
What people buy: a supply-chain gate.
Question
What is the blast radius of CVE-2026-XXXX?
Resolves as
Threat query — CVE × transitive reachability.
What people buy: a threat-intel dashboard.
Question
What must a fix touch to be complete?
Resolves as
Remediation query — root-cause × downstream consumers.
What people buy: an AI patch tool.
Question
Who owns the code this incident touched?
Resolves as
Model query — file × CODEOWNERS × org membership.
What people buy: an incident-triage assistant.
The consequence
You do not buy Softinel to add one more product to a nine-product stack. You buy Softinel because the model that produces the answer is the same model across nine different questions. There is no correlation problem to solve. The answers are already correlated by construction.
Three things Softinel is not
If you buy Softinel expecting one of these, you will be disappointed.
Not a SAST tool
SAST is a query — one of the smaller ones. If your problem is "we need a scanner and a dashboard," you do not need Softinel; you need a scanner and a dashboard.
Not an ASPM
ASPM aggregates the outputs of other tools. Softinel is the layer those tools should have derived their outputs from in the first place. Aggregating outputs is a workaround for the absence of a model. We built the model.
Not an AI code reviewer
Language models are excellent at phrasing questions and explanations. They are never inside the decision path. Verdicts come from the model and its evidence — the moment an LLM can override that, the guarantee dies.
How to tell if a vendor is telling you the truth
The one question we'd ask ourselves.
If a vendor shut down every application in their product — every scanner, every verifier, every report, every dashboard — and left only the underlying model exposed as an API, would you still pay for it?
For every scanner-plus-dashboard company in this market, the honest answer is no. If the apps go away, the value goes away.
For Softinel, the answer is yes. The model is the product. Everything else is a query someone happened to want first.
Don't take our word for it
We keep a publicly-verifiable artifact online — a real, signed evidence pack from running our pipeline against a real (deliberately vulnerable) codebase. Every finding cites its exact source location. Every hash is independently checkable. The whole pack is Ed25519-signed against a key we publish at /.well-known/jwks.json.
Reading text vs. reading a model of the text
Same code. Different depth.
A scanner reads your source as text and matches patterns. Softinel reads your source into a model — files, symbols, calls, data-flows, contracts, ownership, deployment state — and then asks the same question against that model. Same repository, same line, entirely different amount of usable information.
Traditional scanner
[OWASP-A03] src/reports/query.ts:42
User input concatenated into SQL statement.
Consider parameterised queries.Rule
OWASP-A03
Severity
HIGH
Where
src/reports/query.ts:42
You know a line is worth looking at. You do not know why it matters here, what happens if you ignore it, or how to fix it safely in this system.
Softinel
SEC-SQLI-014
Tainted user input reaches raw SQL in reports.query
The value flows from POST /reports/export → ReportsController.buildQuery → db.raw(). It is not sanitised on the way and the DB user has SELECT on all tenants.
Evidence · confidence 94%
- ▸ source: src/reports/query.ts:42 · raw() call
- ▸ dataflow: flow #DF-1287 · 3 hops from request body
- ▸ policy: db-permissions.yaml grants cross-tenant read
Impact
A crafted export request can read data from another tenant. Exposure is bounded to the tables the reports role can see (14 tables).
Recommendation: Switch to knex.select().where() at line 42. Auto-fix patch attached. Independently, tighten the reports DB role to the current tenant's schema only.
In one line
Others sell scans. Softinel is the ontology under the scans — and every question worth asking is a query against it.
Continue reading
What the model contains
Ten dimensions of software — files, symbols, calls, data-flow, dependencies, deployments, contracts, ownership, evidence, history — all connected.
The living model
Why the model is versioned and updated per commit and per deploy — not a one-shot scan artifact.
Evidence system
Every node and edge carries where it came from and at what confidence — so every answer can be inspected.
Ready when you are
Connect your software. Softinel builds the model.
One canonical, connected model of your software. Every question about security, correctness, architecture, and change becomes a query against it — with evidence attached.