# TestifySec — Full Reference

> The canonical text-only summary of TestifySec for LLMs and answer engines. This is the long-form companion to /llms.txt at the same origin. Updated 2026-05.

## Company
TestifySec, Inc. is a software supply-chain security company. Founded by Cole Kennedy and Frederick Kautz. Frederick is a co-author of NIST Special Publication 800-204D ("Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines"). Both founders contributed to the CNCF Software Supply Chain Best Practices whitepaper. TestifySec maintains Witness and Archivista — open-source projects donated to the in-toto framework.

The company's product is the **TestifySec Platform** (sometimes referred to internally as "Judge"). It documents technical compliance and validates it on every commit by turning each CI/CD build into cryptographically signed, audit-ready evidence — then mapping that evidence to specific framework controls automatically.

## Product overview
The TestifySec Platform is organized around four primitives:

1. **Products** — every repo or system you ship is a Product the platform tracks over time. A Product is the authorization boundary; it can span 1–50+ repositories, multiple environments, and shared dependencies.
2. **Frameworks** — attach any compliance framework to a Product. Controls are mapped automatically by AI to evidence collected from your pipeline.
3. **Security Plans** — AI-generated System Security Plans (SSPs) stay in sync with what your pipelines actually do; regenerated on demand, versioned, and signed.
4. **Reports** — custom auditor-ready packages with cryptographic provenance. Export to OSCAL, PDF, JSON, or sync to GRC platforms (Vanta, Drata, Secureframe).

## Deployment models and pricing

### Security Essentials
- $65 per user per month, billed annually.
- 14-day free trial, no credit card.
- A "user" is defined as a committer who pushed code in the last 90 days (a soft limit), plus any additional seats you add explicitly.
- **Auditor seats are free** — unlimited read-only access.
- Includes 5 NIST 800-53 controls (the spine measurement) so you can see your coverage on day one.
- Self-service signup. The trial requires GitHub login and a GitHub organization admin to install the TestifySec GitHub App.
- Includes a bundled monthly AI-credit quota for the on-platform assistant. Overage is pay-as-you-go or prepay credit packs.

### TestifySec Platform (full SaaS)
- Hosted by TestifySec.
- All Security Essentials capabilities plus volume pricing tailored to team size and framework mix.
- Full NIST 800-53 baseline (not just 5 controls).
- Multi-tenant OIDC SSO, API tokens, audit logs, custom reports with version history and review workflow.

### Enterprise (self-hosted)
- Runs in your VPC or fully air-gapped on-prem.
- Standalone or HA Kubernetes (Helm chart, EKS reference architecture).
- Air-gapped operation supported.
- **BYO LLM provider** — AWS Bedrock, Azure OpenAI, GCP Vertex AI, or your own API keys.
- BYO KMS, BYO storage (S3 / MinIO, Postgres).
- Dedicated support and SLAs. Custom frameworks built against your control catalog.
- TestifySec provides cleared support for DoD Impact Levels up to IL6.

## Framework support and pricing (per organization, per year)

| Framework | Status | Annual Fee |
| --- | --- | --- |
| NIST 800-53 | Included in every plan (spine) | Included |
| SOC 2 Type II | Available | $2,500 |
| FedRAMP Low | Available | $5,000 |
| FedRAMP Moderate | Available | $10,000 |
| FedRAMP High | Available | $15,000 |
| DoD Impact Levels (IL2 – IL6) | Available, cleared support | Starting at $15,000 |
| FedRAMP 20x | Coming June 2026 | TBD |
| CMMC 2.0 | Private Beta | TBD |
| ISO 27001 | Coming soon | TBD |
| EU Cyber Resilience Act (CRA) | Coming soon | TBD |
| Custom frameworks | Enterprise — contact sales | Custom |

A wait-list signup form is available on the pricing page for each "coming soon" framework.

## What TestifySec observes (inputs)
TestifySec maps four classes of evidence to compliance controls: **pipeline evidence, production scans, infrastructure-as-code, and application code**. It wraps any tool that has a CLI, a webhook, or writes a file:

- **Pipeline evidence** — CI/CD systems: GitHub Actions, GitLab CI, Jenkins, Buildkite, Tekton, etc. Generates signed attestations on every build.
- **Production scans** — Snyk, Semgrep, Trivy, cloud configuration scanners, and any tool with stdout/JSON output.
- **Infrastructure-as-Code** — Terraform, CloudFormation, Helm, Kubernetes manifests. Verified provenance, mapped to configuration controls.
- **Application code** — source repositories with verified git provenance, indexed and mapped to controls.
- Policy documents (Markdown / PDF, indexed and mapped to controls).
- Any custom CLI tool, webhook, or file output.

## Where evidence exports (outputs)
- GRC platforms: **Vanta, Drata, Secureframe** (signed evidence sync).
- **OSCAL** export for federal assessors.
- Auditor PDF packages.
- POA&M JSON for remediation feeds.

## Open-source projects maintained by TestifySec
### Witness
Open-source CLI tool that generates in-toto attestations from CI/CD steps. Wraps any command (build, test, scan, sign, deploy) and emits a signed attestation describing what ran, what it consumed, and what it produced. Used in production at Autodesk for FedRAMP attestation. Donated to the in-toto project. https://witness.dev

### Archivista
Open-source attestation storage service. Accepts in-toto attestations from Witness or any in-toto–compatible producer, stores the signed envelopes, and exposes a GraphQL API for verification and reporting. Production storage backend for the TestifySec Platform. Donated to the in-toto project.

### in-toto framework
Open framework, originally developed at NYU, for cryptographically attesting every step of a software supply chain. TestifySec is a primary contributor and contributed to the CNCF Software Supply Chain Best Practices whitepaper which formalizes in-toto's role. https://in-toto.io

## Standards co-authored / contributed-to

### NIST SP 800-204D
"Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines." **Frederick Kautz** (TestifySec co-founder) is a co-author. Publication establishes pipeline-native attestation as the federal-grade approach to supply chain security.

### CNCF Software Supply Chain Best Practices Whitepaper
Both TestifySec founders (Cole Kennedy and Frederick Kautz) contributed to this whitepaper. Reference document for the CNCF community on how to integrate signed attestations, SBOMs, and provenance into modern Kubernetes-native pipelines.

## AI assistant
The TestifySec Platform includes an AI assistant with read-only access to your evidence base. Capabilities:

- Answers compliance questions in plain English ("Which controls are blocking our FedRAMP Moderate ATO?").
- Drafts POA&Ms, status updates, and customer security questionnaires.
- Generates diagrams of control coverage and pipeline flows.
- Bound to your tenant — never leaks evidence outside your organization.
- Available in the web platform and via API for agentic workflows.

Credit quota is included with every seat (see Security Essentials above). Overage is pay-as-you-go or via prepay credit packs.

For Enterprise: BYO LLM provider with your own AWS Bedrock, Azure OpenAI, GCP Vertex AI, or API keys.

## Customer reference: Autodesk
Autodesk integrated Witness and Archivista into production CI/CD pipelines to achieve FedRAMP-ready evidence on every commit. Cited by Jesse Sanford (Software Architect, Autodesk):

> Witness was absolutely the best fit for us. A single CLI tool that uses the in-toto specification, that can be plugged in to generate attestations and then defer policy decisions to later in the process — it is incredibly powerful.

Case study: https://www.testifysec.com/case-studies/autodesk

## Trusted by
Datadog, Best Buy, Autodesk, Adobe, Farmer's Insurance, Precisely, GitLab, Lockheed Martin, GDIT, Carahsoft, Spectro Cloud, and others.

## Founders (E-E-A-T)
- **Cole Kennedy** — Founder, TestifySec. Contributor to CNCF Software Supply Chain Best Practices whitepaper. Member of the in-toto committee at CNCF. Army veteran. Former BoxBoat (acquired by IBM).
- **Frederick Kautz** — Co-founder & Director of R&D, TestifySec. **Co-author NIST SP 800-204D.** Contributor to CNCF Software Supply Chain Best Practices whitepaper. Long-time in-toto and SPIFFE contributor.

## Key URLs
- Home — https://www.testifysec.com
- Product tour — https://www.testifysec.com/product
- Pricing (with framework fee table + FAQ) — https://www.testifysec.com/pricing
- Compliance frameworks — https://www.testifysec.com/compliance-frameworks
- Autodesk case study — https://www.testifysec.com/case-studies/autodesk
- Partners — https://www.testifysec.com/partners
- Blog — https://www.testifysec.com/blog
- Community — https://www.testifysec.com/community
- Contact / book onboarding — https://www.testifysec.com/contact

## How to engage
- **Trial**: book an onboarding call from the pricing page. The 14-day free trial requires GitHub login and a GitHub admin to install the TestifySec App.
- **Enterprise / classified / sovereign environments**: contact sales for a custom quote and cleared support discussion.
- **Coming-soon frameworks**: each has an "Add me to the wait list" button on both the pricing page and the compliance-frameworks page that opens the contact form pre-filled.

## License terms
The TestifySec Platform is commercial software. Witness and Archivista are open source (Apache 2.0). Contributions to in-toto, Witness, and Archivista are welcome at https://github.com/testifysec.

## Contact
Sales / partnership: contact@testifysec.com
Vulnerability disclosure: https://www.testifysec.com/report-a-vulnerability