Correlation & the ASPM Brain
apPosture is an ASPM platform, not a pile of scanners: findings from DAST, SAST, SCA, container, IaC and secrets collapse into one risk-weighted posture. The correlation engine is the brain that makes that happen.
Unit of work: the Vulnerability
Every issue becomes one Vulnerability record - the "unit of work". Findings from different scanners that describe the same root cause merge into it, so you fix once, not per tool.
Source-aware fingerprinting
Deduplication uses a source-aware fingerprint (a single formula would be wrong - DAST and SCA are different shapes):
| Source | Identity key |
|---|---|
| SCA / dependency | cve | component (merges our SCA + an imported report on the same CVE) |
| SAST / code | vuln_class | file:line |
| DAST / dynamic | vuln_class | normalized_url | parameter |
| Site-wide passive | name | host |
All versioned, so the fingerprint scheme can evolve without losing history.
Risk scoring & bands
Each Vulnerability gets a deterministic risk score from severity + exploitability + number of sources + business criticality (weighted), mapped to a risk band. More sources confirming the same issue → higher confidence and score.
SLA
Per severity, from first-seen: Critical 7d / High 30d / Medium 60d / Low 90d / Info 120d (configurable - see SLA Policy).
What it powers
- Dedup - no duplicate work across scanners.
- Reachability - runtime-reachable code (DAST × SAST) is prioritised.
- Noise reduction - FP feedback penalises similar findings.
- Attack chains - correlated issues become exploit paths.
- Posture - the deterministic 0-100 score.
This is the layer that turns "500 findings" into "12 that matter, with proof".