How Sightline works: attack paths for SaaS and fintech startups
A walkthrough of Sightline: one asset graph, agentless open-source scanning, findings ranked by blast radius, AppSec review and SOC 2 evidence.
Sightline is cloud and application security for fast-growing SaaS and fintech startups without a dedicated security team. It maps your code, sites and cloud into one graph and ranks every finding by how short the path is from the internet to your sensitive data. Here is how it works.
1. Connect a repo, a domain and your cloud
You connect your sources: repositories, public URLs and domains, and cloud accounts. Sightline then scans on a schedule.
2. One asset graph
Sightline joins repos, services, domains, cloud resources and data stores into one map. Sensitive data stores, such as a payments database with card tokens and PII, are marked as crown jewels.
3. Scanning without agents
Nothing is installed on your servers. Open-source scanners run in a sandbox, covering code, infrastructure, dependencies and live URLs in one run:
- Static analysis: Semgrep, Bandit, gosec.
- Secrets: Gitleaks, and TruffleHog with live verification of found keys.
- Infrastructure as code: Trivy, Checkov.
- Dockerfiles: Hadolint.
- Bill of materials and dependencies: Syft, OSV, and Grype with EPSS.
- Supply chain package checks.
- WordPress plugins and core.
- Live URLs from outside: Nuclei.
4. Findings ranked by what they reach
A scanner report lists findings by the severity a tool printed. Sightline scores findings by blast radius on the graph and by distance from the internet.
An example path: anyone on the internet reaches a debug route on the API, which leaks a cloud key that TruffleHog verifies is live, and that key can read the payments database. Three hops to a crown jewel, so this path tops the queue, even if each finding looks moderate on its own.
5. A fix in plain English, approved by a person
Each finding comes with a plain-English explanation, a CVSS score and a drafted fix. The AI work is split: a reader model reads the code with no tools and no network, and an agent uses tools but never sees the code.
A Thinkiyo application security engineer reviews and approves every finding before it reaches you. You do not need your own security team to use Sightline.
6. Close the path, keep the evidence
After a fix, such as rotating the key and removing the route, the next scan confirms the path is gone and keeps the evidence.
7. Evidence for security reviews
Sightline maps findings to SOC 2 Trust Services Criteria and ISO 27001 Annex A controls, such as CC6.1 logical access, CC8.1 change management, A.8.24 use of cryptography and A.8.28 secure coding. It produces reports you can use as evidence in customer security reviews. Your auditor still issues the audit opinion.
8. A threat feed matched to your stack
New advisories are matched to each repo's bill of materials the same morning, showing which services are affected and the version to upgrade to.
A week with Sightline on
An example at a payments startup with one CTO:
- Monday. Connect in an afternoon.
- Tuesday. Hundreds of raw findings become a short, reviewed list.
- Wednesday. The one path that matters gets closed.
- Thursday. An advisory drops, and the answer is ready.
- Friday. The questionnaire goes back with evidence.
Your code stays yours
- Runs in your own cloud account or self-hosted, with your own database. Findings stay in your tenancy.
- Source code exists only in a temporary checkout during a scan and is deleted after. Secrets are masked before a finding is stored.
- Every finding is reviewed by an application security engineer.
- A Thinkiyo team connects your sources and works findings with you.
Works with other Thinkiyo products
- Mosaic: Sightline flags any path that reaches your customer profiles.
- Rapport: Sightline watches who and what can reach your CRM records.
- Momentum: agent conversations and their keys stay inside your perimeter.