Vulnerabilities in what actually runs.

AWS Inspector reports hundreds of CVEs, most of them on ECR images that no longer run. Pathos keeps the findings of the images you really deploy on ECS, EKS or Lambda, shows what is new since the last scan, and turns the rest into a triage your team can finish.

Deploy Pathos Talk to Apalala

Self-hosted, one Docker image
Free to use, including in production
Read-only AWS access

Scan · eu-west-3Illustrative data

Findings reported by Inspector1 284
On images in use (ECS, EKS, Lambda)312
New since the previous scan9
Debt: still to triage or mitigate41

The other 271 are mitigated, false positives, not exploitable or accepted.

Three questions, answered after every scan

Pathos reads the findings of AWS Inspector, and of Microsoft Defender if you use it, then keeps the history of every decision. Each view answers one question a security team asks every week.

Which CVEs hit what really runs?

An image counts when Inspector sees it running on ECS or EKS, or when a Lambda function executes it, which Inspector does not count and Pathos resolves itself. You can still import everything.

One line per deployed image, with the artefact that carries each package: war, jar, binary, OS package.
Every package filed in a layer, OS, container or application, so each finding goes to the team that can fix it.
Printable image report and CSV exports protected against formula injection.

ImagesIllustrative data

Image	Runs on	Layer	Open
`orders-api:4.12`	ECS · 6 tasks	application	14
`billing-web:2.3`	EKS · 3 pods	container	9
`lambda/invoice-pdf`	Lambda · alias prod	OS	5
`orders-api:3.9`	not deployed		—

Which ones are new since the last scan?

The differential compares the last two successful scans of the same region and scope: new findings, findings that disappeared, and changes in usage. Scans run on a schedule, catch up at start-up, or on demand.

New critical findings stand out the morning after a deployment.
Findings that disappear show what an upgrade really fixed.

DifferentialIllustrative data

New9

Gone23

Usage changed4

+CVE-2026-1043 openssl · billing-web:2.3Critical
+CVE-2026-0871 netty-codec · orders-api:4.12High
−CVE-2025-4417 libxml2 · fixed by base imageMedium

How much is left to triage?

The debt counts what remains to triage or mitigate; everything else is mitigated, a false positive, not exploitable or accepted. A quick-triage queue ranks it by urgency, and every decision keeps its author, date and justification.

Dashboard indicators with targets, per severity or label, also served by GET /api/v1/kpis.
Treatment report of all decisions over a period, printable as PDF for your auditors.

DebtIllustrative data

To triage or mitigate41

CVE	Severity	Status
`CVE-2026-1043` new	Critical	untriaged
`CVE-2026-0871`	High	to mitigate
`CVE-2025-3392`	High	not exploitable

Evidence before every decision

A CVE in a library says nothing about your exposure until you know whether your code calls the vulnerable function. Pathos looks, and shows what it found.

CVE-2026-0871Illustrative data

Pathos proposes To mitigate

90%confidence

Image: orders-api:4.12, ECS
Package: netty-codec 4.1.94 in /app/app.jar/BOOT-INF/lib/
Layer: application
Searched: vulnerable function HttpObjectDecoder.decode, bytecode of the embedded jar
Found: called from OrderGateway.java:88

lambda/invoice-pdf: library embedded, used by no classnot exploitable · 85%

Usage in your source code

Link each ECR repository to its SonarQube, GitLab or Gitea project. Pathos reads the code and analyses it with ast-grep: function called, call possible, imported, declared but not imported, absent. Each occurrence links to the line.

Usage in your binaries

When the library sits inside a Java archive, Pathos fetches only the image layer that holds it and reads the bytecode of every class: which classes use the library, which members they call, and on which line.

Pre-triage you can audit

Rules, not a language model, turn that evidence into a proposal with a confidence rate. Above a threshold you set, the proposal becomes the decision, signed by Pathos. A human decision is never replaced.

One place for every finding

Inspector is the starting point. Pathos brings the other sources of your estate into the same triage, and fits the way your organisation is run.

Microsoft Defender: Read-only import of machines (Defender Vulnerability Management) and container images (Defender for Cloud), with a scope of groups, tags and name patterns.
SBOM from your CI: A pipeline step posts the CycloneDX SBOM of what it built; Pathos keeps its history and checks components against OSV.dev.
Machines: Servers found on private networks or declared by hand, read over SSH without ever writing: OS, packages, containers, checked with Trivy or OSV.dev.
Several organisations: Customers or subsidiaries in one instance, kept apart by row-level security in PostgreSQL, each with its members, profiles and entities.
Your directory: LDAP or Active Directory and OIDC (Keycloak, Entra ID), with groups mapped to profiles at every sign-in.
API and exports: Scoped API tokens, an OpenAPI 3.1 description, CSV and JSON exports of the triage.

Built like a security tool should be

Pathos holds your vulnerability data and credentials to your cloud. It runs on your infrastructure, and nothing leaves it without your say.

Container	Distroless, no shell, user 65532, read-only file system, no capabilities, `no-new-privileges`, about 66 MB.
Cloud access	Read-only: `inspector2:ListFindings`, plus Lambda and ECS listing rights. IAM Identity Center sign-in from the interface, no AWS CLI.
Accounts	Argon2id passwords, server-side sessions, `HttpOnly` and `SameSite=Strict` cookies, CSRF token on every change, sign-in throttling.
Secrets at rest	Encrypted with XChaCha20-Poly1305 under the instance key, never sent back by the interface or the API.
Audit log	Every sign-in, page, API call, change and refusal, chained and signed with Ed25519; a modified, deleted or inserted line is reported by number.
Browser	Strict Content Security Policy with no inline script or style, `frame-ancestors 'none'`, HSTS behind HTTPS.
Outbound calls	Advisory lookups send CVE identifiers only; update checks read tag names only. Both can be switched off. Diagnostic reports are never sent automatically.

Running in a few minutes

You need Docker Engine with the docker compose plugin and outbound access to ghcr.io. The image is public: no account, no docker login. It carries its own deployment files.

Get the deployment files

$ mkdir pathos && cd pathos
$ docker run --rm ghcr.io/apalala-sprl/pathos:2.0.4 compose     > docker-compose.yml
$ docker run --rm ghcr.io/apalala-sprl/pathos:2.0.4 env-example > .env
$ docker run --rm ghcr.io/apalala-sprl/pathos:2.0.4 gen-key > db-password && chmod 644 db-password

Fill in .env

Set at least PATHOS_SECRET_KEY (from gen-key), PATHOS_ADMIN_PASSWORD and your AWS access: IAM Identity Center, temporary STS keys, or the standard chain of the container (ECS task role, EC2 instance role, EKS web identity).
Start it
```
$ docker compose pull
$ docker compose up -d
$ docker compose ps   # healthy after about 15 s
```
The interface listens on 127.0.0.1:8090. For network access, put it behind a TLS reverse proxy and set PATHOS_PUBLIC_URL.

Behind a corporate proxy, set HTTPS_PROXY and mount your CA with PATHOS_EXTRA_CA_FILE. Coming from Pathos 1.x, the image also ships a one-command upgrade to PostgreSQL that keeps the old setup next to the new one.

Free to use, supported when you need it

Pathos is published by Apalala, a Belgian software company. Use it on your own, or let us set it up and stay at your side.

Pathos

Free

Every feature, in companies and in production
Public image, no account, no licence key
Updates announced in the interface to administrators

Deploy Pathos Licensed under the PolyForm Shield License 1.0.0: you may not use it to offer a product or service that competes with Apalala.

Apalala services

On quote

Installation on your infrastructure
Configuration of AWS access, Defender, code sources and directories
Support through our help desk
Coaching your team on triage

Ask for a quote Write to info@apalala.be or open a ticket on helpdesk.apalala.be.