Continuous Authorization Platform

Stay authorized
while you ship.

REAEGIS turns every commit, scan, and approval into signed evidence, so the package your Authorizing Official reviews matches the system that is running today.

Request a demo See how evidence is verified

ORION-1 / Command Center

ISSO view

Command Center

FedRAMP High

Authorization posture for ORION-1,
4 systems in boundary

Authorization readiness

+6 in 30 days

82of 100

Continuous monitoring88
Active cyber defense74
Secure software supply chain84

Open findings

3 past SLA

Critical2
High9
Moderate18
Low12

POA&M items

5 awaiting production confirmation

Evidence freshness

96%

current, signed, attributed

Live remediation

Stage 6 of 8

Critical vulnerability in base image

api-gatewaySI-2RA-5

Find
Fix
Build
Push

Verify
Deploy
Confirm
ATO

Fix merged by pull request #482. Verification passed. POA&M closes after production confirmation.

Pull request #482

Approved

Rebuild api-gateway on a hardened image

Maya Reyes approvedReviewer is not the author

Evidence record

Verified

Control: SI-2 Flaw remediation
Change: Pull request #482, approved by a second reviewer
Checks: Finding absent. No regressions. Gate passes.
Signed: Cosign signature valid
Anchored: Rekor transparency log, index 142907098

sha256:07ad3c91e2f4…5b192026-10-08 14:31Z

Signed, live

RAMPART14:02:11Zgate.evaluatedsha256:e3f1…92c6
ADVERSARIUS14:02:39Zfinding.openedsha256:41b7…c0d3
ARE14:19:05Zchange.approvedsha256:5d90…1be2
ARE14:21:47Zpr.mergedsha256:c8e0…77fa
ARE14:31:52Zscan.verifiedsha256:07ad…5b19
PHAROS15:04:20Zpoam.closedsha256:9f2c…a41e
AXIOM15:04:21Zpackage.updatedsha256:b21c…0e7d
RAMPART15:06:02Zgate.evaluatedsha256:6a9e…f310

Fixed by pull requestFindings are remediated in your repository, behind a human approval gate.
Signed and verifiableEvery record is signed and anchored, so any assessor can check it independently.
Generated from live stateOSCAL and eMASS outputs come from the running system, not from a document.

Supports

FedRAMP Rev 5 and 20x
NIST SP 800-53 Rev 5
NIST SP 800-171 Rev 2 and 3
CMMC Levels 1 to 3
DoD RMF
IL2 to IL5

Works with

GitHub
GitLab
Bitbucket
Azure DevOps
Jira
SonarQube
Trivy

Your system changes
every day.Your authorization
package does not.

Packages age the moment
they are signed
Nothing ties a commit to the control it affects, so the package describes a system that no longer exists.
Evidence is moved by hand
Scan results and screenshots are copied into the system of record every monitoring cycle.
Findings never become proof
Scanners raise alerts. They do not show an assessor that the fix reached production, or who approved it.

The full cycle,
on every change.

stages: 8; stages
engines: 6; engines
evidence model: 1; evidence model

Control baseline

AXIOM

FindADVERSARIUS
FixARE
BuildARE
- Iron Bank
PushARE
VerifyRAMPART
DeployARE
ConfirmPHAROS
ATOCHRONICLE
- eMASS

drift reopens

Follow one finding, from scan to signed evidence.

114:02

Detect

REAEGIS

Scan results become one mapped finding.

ADVERSARIUS
AXIOM

ORION-1 / Findings

41 open

Open findings for ORION-1, newest first
Severity	Finding	System	Controls	SLA	Status
Critical	Vulnerability in container base image	api-gateway	SI-2RA-5	30 days	New, just now
High	TLS 1.0 enabled at ingress	platform-config	SC-8	12 days	In remediation
High	Unsigned image admitted to cluster	cluster-policy	SI-7	9 days	Verifying
Moderate	Quarterly access review overdue	identity	AC-2	21 days	Open
Moderate	Audit log retention below policy	logging	AU-11	44 days	Open
Low	Login banner missing on bastion	bastion	AC-8	160 days	Open

CriticalNew, just now
Vulnerability in container base image
api-gatewaySI-2RA-5SLA 30 days
HighIn remediation
TLS 1.0 enabled at ingress
platform-configSC-8SLA 12 days
HighVerifying
Unsigned image admitted to cluster
cluster-policySI-7SLA 9 days
ModerateOpen
Quarterly access review overdue
identityAC-2SLA 21 days

214:19
Remediate
- Iron Bank
- REAEGIS
Rebuilt on a hardened image. Sent as a pull request for a second person to approve.
- ARE
ORION-1 / Remediation / pull request #482
Approved
Rebuild api-gateway on a hardened image
Opened by REAEGIS for finding 0482SI-2orion-1/api-gateway
Dockerfile
# runtime baseRemoved: FROM node:20.11.0Added: FROM registry1.dso.mil/…/nodejs20:20.11.1WORKDIR /appCOPY --chown=node:node . .
Why this fix
Rebuilds on a hardened, signed base image from Iron Bank. No application code changes.
Approval gate
Prepared by
REAEGIS
Reviewer
Maya Reyes
Merged
14:21
Enforced
AC-5 Reviewer is not the authorCM-3 Change recorded
ORION-1 / pull request #482
Approved
Rebuild api-gateway
on a hardened image
Opened by REAEGIS for finding 0482
SI-2orion-1/api-gateway
Dockerfile
# runtime baseRemoved: FROM node:20.11.0Added: FROM registry1.dso.mil/…/nodejs20:20.11.1WORKDIR /app
Why this fix
Rebuilds on a hardened, signed base image from Iron Bank. No application code changes.
Approval gate
Prepared by
REAEGIS
Reviewer
Maya Reyes
Merged
14:21
Enforced
AC-5 Reviewer is not the authorCM-3 Change recorded
314:31
Prove
- REAEGIS
Three checks pass, or the finding stays open.
- ARE
- RAMPART
ORION-1 / Remediation / pull request #482 / verification
3 of 3 passed
Pipeline
Stage 6 of 8, deploying
Find
Fix
Build
Push
Verify
Deploy
Confirm
ATO
- Finding absent from re-scan
  The original vulnerability no longer appears in the rebuilt image.
  Grype, Trivy: 0 matches
- No new findings introduced
  The regression gate compares the new scan against the previous one.
  0 new findings
- Original gate passes
  The gate that failed at 14:02 is evaluated again on the fix.
  RAMPART: pass
Fails closed: any failed check stops the pipeline and keeps the finding open.
ORION-1 / Verification
3 of 3 passed
PULL REQUEST #482
Pipeline
Stage 6 of 8, deploying
Find
Fix
Build
Push
Verify
Deploy
Confirm
ATO
- Finding absent from re-scan
  The original vulnerability no longer appears in the rebuilt image.
  Grype, Trivy: 0 matches
- No new findings introduced
  The regression gate compares the new scan against the previous one.
  0 new findings
- Original gate passes
  The gate that failed at 14:02 is evaluated
  again on the fix.
  RAMPART: pass
Fails closed: any failed check stops the pipeline and keeps the finding open.
415:04
Authorize
- REAEGIS
- eMASS
POA&M and evidence sent to eMASS as files. Signed in Rekor.
- PHAROS
- CHRONICLE
ORION-1 / POA&M / item 0117
Closed
Base image vulnerability, api-gateway
Phase 1Fix verified14:31
Phase 2Production confirmed15:04
Package updated
OSCAL POA&MOSCAL assessment resultseMASS export
Authorization readiness
84of 100
2 after closure
Evidence record
Verified
Control
SI-2 Flaw remediation
Change
Pull request #482
Signed
Cosign signature valid
Anchored
Rekor index 142907113
sha256:9f2c41d07be3…a41e
Base image vulnerability, api-gateway
Phase 1Fix verified14:31
Phase 2Production confirmed15:04
Package updated
OSCAL POA&MOSCAL assessment resultseMASS export
Authorization readiness
84of 100
2 after closure
Evidence record
Verified
Control
SI-2 Flaw remediation
Change
Pull request #482
Signed
Cosign signature valid
Anchored
Rekor index 142907113
sha256:9f2c41d07be3…a41e
ORION-1 / Export / eMASS adapter
Sending 2 of 3
REAEGIS
15:04
POAM_ORION-1.xlsxItem 0117 closedDone
evidence_0117.zipScan, pull request, signatureIn progress
SI-2_result.jsonControl test resultWaiting
EMASS ADAPTER
sha256:9f2c41d07be3…a41e
evidence_0117.zip2.4 MB, signed
eMASS
System record
ORION-1
POA&M item 0117Completed, 15:04Done
Artifact arrivingevidence_0117.zip, 62% receivedIn progress
Control SI-2Waiting for artifactWaiting
REAEGIS
15:04
POAM_ORION-1.xlsxItem 0117 closedDone
evidence_0117.zipScan, pull request, signatureIn progress
SI-2_result.jsonControl test resultWaiting
EMASS ADAPTER
evidence_0117.zip2.4 MB, signed
sha256:9f2c41d07be3…a41e
eMASSSystem record
ORION-1
POA&M item 0117Completed, 15:04Done
Artifact arrivingevidence_0117.zip, 62% receivedIn progress
Control SI-2Waiting for artifactWaiting

5Next day, 09:12

Watch

REAEGIS
Repeats

PHAROS checks again every day. Drift reopens the finding.

PHAROS
RAMPART

ORION-1 / Monitoring

Next run 04:00 UTC

Controls current

401of 410

Evidence freshness

96%current

Drift checks

14days, 1 drift

Monitoring jobs for ORION-1
Job	Cadence	Last run	Result
Vulnerability data sync	Daily, 04:00 UTC	04:00	Done
Drift detection	Every push	09:12	1 drift
POA&M milestones	Daily	04:01	2 due this week
Evidence freshness	Hourly	09:00	96% current

Drift detected on api-gateway

Base image changed outside the pipeline. Finding reopened.

Back to step 1

ORION-1 / Monitoring

Next run 04:00 UTC

Controls current

401of 410

Evidence freshness

96%current

Drift checks

14days, 1 drift

Vulnerability data sync
Daily, 04:00 UTCLast run 04:00
Done
Drift detection
Every pushLast run 09:12
1 drift
POA&M milestones
DailyLast run 04:01
2 due this week
Evidence freshness
HourlyLast run 09:00
96% current

Drift detected on api-gateway

Base image changed outside the pipeline.
Finding reopened.

Back to step 1

Back to step 1. The loop runs on every change.

Code or infrastructure.
Each fix takes
its own path.

A vulnerable package and a misconfigured cluster are not fixed the same way. Each one goes to the right repository, the right checks, and the right approver.

Code remediation

Packages, base images,
application flaws

Application repository

01
Finding
Vulnerable package or base image
FINDING 0482 · SI-2
02
Change
REAEGIS
Pull request to the
application repository
Dockerfile
Removed:FROM node:20.11.0
Added:FROM registry1.dso.mil/…/nodejs20:20.11.1
03
Check
Iron Bank
Rebuilt on a hardened image
Re-scanned before review
04
Approval
AC-5
Maya Reyes approves
Reviewer is not the author
05
Verification
RAMPARTPHAROS
Re-scan passes. Gate clears.
Confirmed in production

Infrastructure remediation

Cloud settings, cluster policy, STIGs

Infrastructure repository

01
Finding
TLS 1.0 enabled at ingress
FINDING 0519 · SC-8
02
Change
REAEGIS
Pull request to the
infrastructure repository
ingress.tf
Removed:min_protocol_version = "TLSv1_0"
Added:min_protocol_version = "TLSv1_2"
03
Check
Plan and policy check before apply
1 TO CHANGE · 0 TO DESTROY
04
Approval
CM-3
Change control board approves
Boundary change recorded
05
Verification
RAMPARTPHAROS
Applied. Drift cleared.
Confirmed on the next sync

One signed record, whichever path the fix took

CHRONICLE

POA&M item closed
Evidence signed
Anchored in Rekor

What your program
gets back.

Hours go to risk review
Evidence arrives mapped, signed, and current. Nobody copies it into the system of record.
Findings close with proof
Every fix is verified, then confirmed in production, before its POA&M item closes.
The package matches production
Your Authorizing Official decides on the system as it runs today, not on last quarter.

Autonomous where
it is safe. Human
where it matters.

REAEGIS does the repeatable work and stops at every decision that belongs to a person. The approver is never the initiator, and a failed check keeps the finding open.

AC-5 Separation of dutiesCM-3 Change control

REAEGIS does on its own

Maps every finding to its controls
Prepares the fix and opens the pull request
Re-scans and verifies each fix
Signs and records every event
Updates the POA&M and the package

Then stops, and waits for a person

approval gate

A person decides

CODE REVIEWERApproves every change before it merges
CHANGE CONTROL BOARDReviews boundary changes
in change control
ISSOValidates each POA&M closure
AUTHORIZING OFFICIALAccepts risk and makes the authorization decision

CHRONICLE

Do not take our word
for it. Verify it.

Every compliance event is signed with Cosign and anchored to the Sigstore Rekor transparency log. An assessor or Inspector General can check any record with public tooling, without access to REAEGIS.

270,525

records anchored to the public transparency log so far

Rekorpublic transparency log

Verify an evidence record

cosign verify-blob finding-0482.json \

--key reaegis.pub \

--bundle finding-0482.bundle

Verified OK

rekor-cli get --log-index 142907113

Index:142907113

IntegratedTime:2026-10-08T15:04:20Z

Body:hashedrekordsha256:9f2c41d0…a41e

# control SI-2, change #482, approved by a second reviewer

Public tools. No REAEGIS account required.

Fits the pipeline you already run.

See every integration

Source control

pushpull request

GitHub
GitLab
Azure DevOps
Bitbucket

Scanners

scan results

Grype
Trivy
OpenSCAP
SonarQube
ACAS

Hardened images

hardened base image

Chainguard
Iron BankPlatform One

REAEGIS

RAMPARTGates every push
ADVERSARIUSScans and validates
AXIOMMaps every control
PHAROSWatches for drift
CHRONICLESigns every event
AREFixes by pull request

1. Find
2. Fix
3. Build
4. Push
1. Verify
2. Deploy
3. Confirm
4. ATO

Systems of record

POA&M, evidence

eMASS
Jira

Public transparency log

signed record

Rekor

Authorization package

OSCAL

OSCAL SSP
OSCAL POA&M

Three boundaries.
You choose where
REAEGIS runs.

Compare the three models

REAEGIS cloud

REAEGIS runs outside and connects to your pipeline.

Runs in: REAEGIS cloud
Crosses the boundary: Findings and pull requests
Sign-in: SAML 2.0, OpenID Connect

In your boundary

REAEGIS runs inside, next to your pipeline.

Runs in: Your IL4 or IL5 environment
Crosses the boundary: Nothing
Sign-in: CAC and PIV

Air-gapped

REAEGIS runs inside. The network link is cut.

Runs in: Your enclave
Crosses the boundary: A signed update kit, inbound only
Sign-in: CAC and PIV

Start from where you sit.

Authorization is not a destination. It is a system property.

Request a demo and we will walk one finding from detection to signed evidence.

Request a demo See the platform

Federal programs
Invitation only, with CAC and PIV.
Request access
Commercial teams
Self-register with single sign-on.
Create a workspace
Pricing
Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.
See pricing

Stay authorizedwhile you ship.

Your system changes every day.Your authorization package does not.

Packages age the moment they are signed

Evidence is moved by hand

Findings never become proof

The full cycle, on every change.

Follow one finding, from scan to signed evidence.

Detect

Remediate

Prove

Authorize

Watch