Analysis Engine

Platform

Analysis is not one check, and not one score.

The capture is the raw input and the reports are the output; analysis is the step in between. The analysis engine profiles the code, the traffic, the payloads, the entities and the infrastructure, and every report in the toolkit is built from what it finds.

A single application in SCVue produces more context-rich findings than any one analyst could, reading through a capture file alone. It is organized, provenanced, and actionable from the start.

The engine has been designed to ask the right questions of the application: what its own defenses are, what the code does once it is run on the client's machine, what information flows out, what is referenced but never called, and what is recognized rather than unknown.

Analysis runs automatically when a capture is imported and re-runs on demand. Re-running replaces its previous results cleanly rather than accumulating duplicates, so the report you are reading is always the current view of the capture you are looking at.

SCVue risk factors report, showing findings graded High, Warning and Info with category, detail, originating host and URL for each.
Each finding carries its category, a plain description of what was found, and the host and address it came from.

What the engine looks for

  • What it declares about its own defenses

    Content security policies read for missing baselines, inline execution and wildcard sources, with well-configured policies credited rather than only omissions flagged. External resources checked for integrity fingerprints, cookies for the attributes that decide whether they can be stolen.

  • What the code does once it runs

    How code loads other code, from ordinary imports to injected page elements and code built and run from text. Two combinations escalate: fetch-and-execute, and decode-and-execute, which is how a deliberately obfuscated payload normally works.

  • What leaves for somewhere else

    Form submissions and uploads read for personal information, device fingerprinting and cross-site tracking. Tracking hidden in images and media: invisible pixels, embedded user identifiers, and cache-defeating techniques that guarantee every view is counted.

  • What it names without ever calling

    Everything named inside captured content: email addresses, network addresses, and the communication mechanisms a page can open, such as persistent sockets and background transmission. These move data outside the request-and-response pattern most monitoring watches.

  • What is recognized, and what is not

    Every asset carries an indicator based on its content fingerprint and its publisher: Known, Registered, Unknown, or Unchecked when nothing was stored to check. Alongside it, which delivery networks serve the traffic and how concentrated it is.

A script that fetches remote content and executes it means the behavior of your site is being decided somewhere else, at a moment you do not control, by a party who can change it at any time without telling you.

Findings are evidence, not verdicts

Every finding traces back to a specific recorded call with its address, headers, content and timestamp. Nothing asks to be taken on trust.

Overview

One capture is enough to start

Capture a session in the browser, import it, and read what comes back. A free community account is available immediately.

Start Free Request a Demo