Core concepts

Organization

An organization is the workspace boundary for users, assets, groups, scans, findings, integrations, API keys, and reports. API keys and MCP sessions are normally scoped to one organization.

Asset

An asset is a canonical technical object known to Alkonos. The same object can belong to more than one asset group without being duplicated.

Alkonos records these asset types:

  • DNS name — a hostname such as api.example.com.

  • IP address — an IPv4 or IPv6 host.

  • Port — a discovered service such as tcp://api.example.com:443.

  • Repository — a source repository on GitHub, Bitbucket, or Forgejo.

  • Branch — a scannable branch under a repository.

  • Autonomous system — network ownership context discovered from IP data.

The product UI centers on hosts and repositories. Ports are the scannable children of hosts; branches are the scannable children of repositories.

Asset group

An asset group is an organization-owned collection of hosts and repositories. Use groups to represent a security boundary, product, environment, customer deployment, or any set you want to recon, scan, score, and report together.

Membership is separate from the canonical asset:

  • Removing an asset from a group removes only that membership.

  • Deleting a group removes its memberships.

  • The asset remains available through other groups that contain it.

Seed

A seed is a host supplied as a starting point for recon. DNS seeds enable subdomain discovery. Alkonos strips schemes and ports during normalization; an IP address remains an IP seed.

A manually added host does not have to be a seed. Use Mark as seed — discover subdomains only when Alkonos should expand outward from that hostname.

Recon

Recon builds the asset inventory. It can discover subdomains, DNS records, IPs, open ports, HTTP responses, TLS certificates, technologies, screenshots, and URLs.

Recon answers: what exists and is reachable? A scan answers: what security problems exist on a selected service or branch?

Scan

  • DAST tests a live service port. A scan may crawl the application, use stored credentials, and run one or more enabled security agents.

  • SAST tests source code on a repository branch. Pull-request scans review the changed branch and PR context.

A whole-group DAST run fans out into scans across the selected hosts.

Vulnerability

A vulnerability is a finding attached to a scanned target. It carries severity, status, affected URL, evidence, remediation, and supporting metadata such as CVSS, CWE, or CVE when available.

Report

A report is a generated PDF for an organization, asset group, asset, scan, or selected vulnerabilities. Reports are asynchronous: wait for Completed, then download the file.