Your security decisions have a shelf life.
Scanners tell you what they found. Adjudica records what you decided, what evidence you relied on, and tells you when that evidence stops being true.
Built by an AppSec analyst. Shaped with input from AppSec practitioners, including a design partner who leads an AppSec program. Scanner-agnostic.
14 May 2026 · Not exploitable · analyst
The deserialization sink in payment-api is only reachable through middleware.ts which enforces authenticated sessions. Unauthenticated callers are rejected at the route boundary before the vulnerable code path executes. Accepted as not exploitable in the current deployment configuration.
Fromfindingtodefensibledecision.
Works out what proof each finding needs.
ThereasoninglivesinJira.Thedecisionclosedyearsago.
Findings get marked false positive. The analyst who understood the codebase moves teams. The reasoning that justified that call was in a Jira comment and a Slack thread. Both are gone.
So teams re-litigate settled findings, because nobody can reconstruct what the original call was based on. Or a decision quietly stops being correct while the ticket stays closed, because nobody was watching the premises.
Detection is not the constraint anymore. Every AppSec team has more findings than they can act on. The constraint is knowing which closed findings are still valid.
Adjudicaworksoutwhatproofeachfindingneeds
Adjudica determines what a finding needs
Before a decision is recorded, Adjudica determines what evidence the finding requires. Each requirement carries a result: SUPPORTED, CONTRADICTED, or UNKNOWN. Open requirements stay open with an explicit prompt describing what would close them. Nothing is silently dropped.
Machine proposals, human dispositions
On ingestion, Adjudica runs a triage step that proposes a disposition and stores it in a separate table, not as a recorded decision. The analyst can request a rationale draft conditioned on the full finding context. For SCA findings with a fix available, Adjudica generates an upgrade recommendation. When a fix is blocked, it generates short-term mitigations labeled with residual risk. Every machine output is labeled by provenance.
Import from your existing scanners
Import directly from Semgrep Supply Chain, Semgrep SAST, and Snyk Open Source JSON output. Paste the output or upload the file. Re-ingesting the same finding is idempotent. The internal record shape is normalized from any source.
Checkswhethertheproofholds
Upload a screenshot, Adjudica reads it
Upload a screenshot as evidence and Adjudica reads it. AI vision analysis runs against the finding context and returns a verdict on whether the image supports the claim. The transcription and verdict are stored with the record and included in the export.
Machine and analyst work are always separate
Every assessment on the record is labeled: analyst-written, AI-drafted, AI-drafted-then-edited, or system-generated. Machine assessments are stored separately and never presented as equivalent to analyst dispositions.
The record shows who approved what
When the analyst name matches the evidence submitter, the record is flagged as self-approved. The flag is stored with the disposition and visible in the audit history. Separation of duties is on the record.
Disagreements are on the record
A developer can contest a recorded disposition. The challenge is stored as a submission and the finding enters a contested state. The analyst re-decides with the contest on the record. One round per finding. The original decision, the challenge, and the resolution are all visible in the history.
Tellsyouwhenthereasonstopsbeingtrue
Decisions watch their own premises
A decision records what was true when it was made. When a signal is updated, Adjudica compares the new value against what the decision relied on. KEV status, EPSS score, CVSS score, and reachability are each tracked. When the code path the decision cited is re-validated, Adjudica checks whether those flow nodes still resolve at their reported locations. When either check finds a change, the decision reopens and the trigger is named on the record.
Every disposition is written once
Each disposition record is written once and never edited. Amendments append a new version with an incremented version number. The full disposition history is ordered by version and exported together with evidence submissions, system events, and audit trail.
How your team decided this before
When you open a finding, Adjudica shows prior decisions on the same CVE in your workspace: what was decided, by whom, on what evidence, and whether that decision was later reopened. A prior call that drift reopened appears as reopened, not as settled precedent. In testing, three of four prior Log4Shell decisions had been reopened after the fact.
Affirm related findings together
After a disposition is recorded, Adjudica surfaces related undecided findings across services. Up to 200 instances can be affirmed in a single operation. Each receives its own disposition record with a shared batch reference.
PDF and Markdown download
The full record exports as PDF or Markdown. Both formats include the disposition history, evidence submissions, system events, and audit trail.
WhatAdjudicaisn't
Sits downstream of your existing tools. Semgrep and Snyk Open Source exports work today. Scanner-agnostic by design: the internal finding shape is normalized from any source, so adding a new scanner does not change how decisions work.
Drift detection tells you the specific code a decision relied on has changed at the location it referenced. That is a prompt to re-examine, not a claim about exploitability. Adjudica never executes exploits and never makes the call for you.
Adjudica proposes, a human disposes. Machine assessments are labeled everywhere they appear and kept in their own record. Insufficient evidence returns UNKNOWN plus what is still needed, not a guess dressed as a verdict.
Analysis runs inside the customer boundary and emits structured evidence only. No source files leave your environment. Each workspace is isolated at the database layer through row-level security — one workspace's decisions, findings, and evidence are invisible to another. Per-workspace repo credentials are in progress; everything else works on your findings today.
Commonquestions
How is this different from my ASPM platform?
ASPM platforms model risk posture across your portfolio. Adjudica models the decision itself: what was decided, what evidence it rested on, and whether that evidence is still true. A concrete test: open a closed finding in your current tooling and try to answer "what would have to change for this to reopen?" If the answer requires a human to reconstruct context, Adjudica covers the gap.
Do I have to replace my scanners?
No. Adjudica sits downstream of your existing scanners. Semgrep Supply Chain, Semgrep SAST, and Snyk Open Source JSON output work today. The internal finding shape is normalized from any source, so switching or adding a scanner does not change how decisions work.
What happens on a re-scan?
Re-ingesting the same finding is idempotent. The record is not overwritten or re-opened automatically. Premise re-validation is explicit: it runs when you request it or when a monitored signal changes (KEV status, EPSS, CVSS, flow reference). The distinction between "scanner found it again" and "the decision premise changed" is intentional.
Who is this for?
Small AppSec teams that close more findings than they can document, and regulated organizations that need audit-ready rationale for disposition decisions. If you have one person doing AppSec across multiple engineering teams, or a compliance requirement that asks "why was this closed," Adjudica is built for that.
What stage is it at?
Working software. The core disposition workflow, evidence structure, append-only record, and premise drift detection are built and running. This is a design partner stage. Access is hands-on and limited. One person is building it; the roadmap is shaped by what users need, not by a VC deck.
Can I bring my own private repos?
Not yet. Per-workspace repository credentials are in progress. In the meantime, code-flow analysis works against public repos and the hosted fixture repo. Everything else (disposition, evidence, drift detection on KEV/EPSS/CVSS) works on your findings today without repo access.
Bringonefindingyouarguedabout.
Access is hands-on and limited while it is early. We walk through it with you.