RealGround

AI apps change constantly (prompts, tools, models, routes). A one-off pen test goes stale fast, and dumping raw scanner output on a security owner is hard to triage. Teams needed a repeatable path from configure → scan → prioritized fixes.

Fewer highly custom exploits in exchange for faster coverage and a report people can actually triage across providers.

• Exporting raw results from a single scanner, too noisy for owners who need a clear next action.
• Hand-writing every attack from scratch, slower coverage and harder to keep up with new model providers.
• Treating SBOM/CVE checks as a separate spreadsheet workflow, which never stayed in sync with the live app.

A React + Vite web app where you configure a target and run a scan. The FastAPI backend orchestrates Promptfoo and Garak probes, maps permissions and routes, generates an SBOM with Syft, checks CVEs with Grype, and talks to OpenAI, Bedrock, or Ollama depending on the environment. Results are normalized into one severity-ranked report with remediation guidance. Services ship in Docker on AWS ECS/ECR.

• The ranked remediation report is a product feature, not an after-the-fact spreadsheet.
• Support multiple model providers without changing how an operator starts a run.
• Keep SBOM and CVE scanning in the same pipeline as behavioral probes so one run covers both.

• One path from configure → scan → prioritized fixes instead of stitching tools by hand.
• Consistent reports across OpenAI, Bedrock, and Ollama targets.
• Deployable scanner stack on AWS ECS/ECR with Dockerized services.