You can get a basic application security posture view for free: export scanner results in a shared format such as SARIF, load them into one tracker with owners and due dates, and rank by known exploitation. It works for a few repositories. It strains on deduplication, ownership mapping, audit trail and the time to maintain it.
ASPM, application security posture management, is an analyst term for tools that gather findings from many scanners into one prioritised, owned list. It does not scan anything by itself.
What can you assemble for free?
A shared format. SARIF is an OASIS standard for static analysis results, version 2.1.0. Because it is a common format, results from different tools can be combined into one view without handling each tool's own output. For inventories, CycloneDX and SPDX serve the same purpose.
One list. An issue tracker or spreadsheet with columns for source scanner, asset, finding, severity, exploitation evidence, owner, due date and status. It is dull and it works.
Free scanners. Many scanners have free or open source editions. A free in-browser scan at gold.safeguard.sh/scan checks a manifest or SBOM of up to 100 dependencies against the Gold corpus, with no login.
Free prioritisation inputs. CISA's Known Exploited Vulnerabilities catalogue and FIRST's EPSS scores are public. Together they let you rank without paying for a feed.
Where do free setups stop?
Deduplication. The same library flaw shows up in several scanners and several repositories. A spreadsheet will count it five times, and someone must merge them by hand.
Ownership. Mapping a finding to a team needs a code ownership source and upkeep. Free setups usually leave this manual.
Scale. At a few repositories you can review weekly. At hundreds, imports, matching and stale tickets become a job.
Evidence. Auditors ask who accepted a risk, when and until when. A tracker can hold that, but only if people fill it in.
Coverage gaps. An aggregate view is only as good as the scanners feeding it. If nothing scans your containers, your posture view will not show them.
Support and maintenance. Free tools break on upgrades, and nobody is paid to fix your import script.
What does a weekly routine look like?
Keep it to thirty minutes. Import the latest scanner exports, sort by known exploited first, then by EPSS score, and check that every row has an owner. Close rows that are fixed, move accepted ones to an exceptions tab with an expiry date, and look at the five oldest open items. Write one line on what changed. That single line, repeated weekly, becomes the trend your leadership asks for.
When is it time to pay?
Move when the manual work costs more than a licence: roughly when you spend regular time merging duplicates, chasing owners or building reports for audits. A paid platform is also worth a look when multiple teams need different views or when you need workflow approvals.
Do not buy to fix a process gap. If nobody owns findings today, a dashboard will not change that.
What to do
- List the scanners you already run and confirm each can export SARIF or another open format.
- Create the single tracker with the columns above.
- Add KEV status and EPSS score to each row and sort by them.
- Assign every repository an owner, and review the list weekly.
- Track how many hours the process takes each month.
- Reassess when hours or repository counts pass a threshold you set.
Quick check
Does ASPM replace my scanners?
No. It aggregates and prioritises results from scanners. If no scanner covers an area, ASPM cannot show it.
What is SARIF?
An OASIS standard format, version 2.1.0, for the output of static analysis tools, which lets results from different tools be combined.
Sources
- OASIS: SARIF v2.1.0
- CISA: Known Exploited Vulnerabilities Catalog
- FIRST: EPSS
- Safeguard Gold: free dependency scan
Last reviewed: 18 October 2026.
