Loading
An AI security platform where every finding names the control you will be audited against, not just a severity score.
Security tools are good at telling you something is wrong and bad at telling you what it means. A dashboard reports a high-severity issue; the auditor sitting opposite you asks which control it touches, what the exposure was, and what you did about it. Those are different questions, and most scanners answer only the first.
White Defender is an AI security platform built the other way round. It runs four kinds of analysis — a security advisor you can paste code or logs into, a code and dependency scanner, a passive web reconnaissance scanner, and a SOC log analyser — and every finding it produces carries the NIST SP 800-53, PCI-DSS or ISO/IEC 27001 control it affects, the reason it matters, and the fix. Security findings mapped to compliance controls is the whole point, not a reporting add-on.
The detection rules are deliberately transparent signatures rather than an opaque model, so any finding can be explained line by line to an engineer, an auditor or a board. Where AI helps is in the work people are worst at: reading a large unfamiliar codebase quickly, and turning a long list of technical findings into something a non-technical committee can act on.
WMAD’s role
White Defender is developed and owned by WMAD Pvt. Ltd. The four analysis engines are live at whitedefender.thewmad.com and free to try today — the code and dependency scanner, the web recon scanner and the SOC log analyser need no account. Persistence, accounts and role-based access are still being built. It is a white-hat defensive tool — it is not a penetration test, and it does not replace a qualified security assessor.
Paste code, configuration or logs and ask what an attacker would do with it. Answers come back with prioritised, specific fixes rather than general advice.
A code security scanner for hardcoded secrets, injection, weak crypto, unsafe randomness and more. Scan a snippet, a folder, or a GitHub repository.
A passive web security scan of headers, TLS posture and exposed files such as .env or .git. It reads what a server already tells every visitor.
SOC log analysis over access and authentication logs: brute force, reconnaissance sweeps, and SQL injection, cross-site scripting and path-traversal probes.
Whether it is a snippet or a whole repository, each scan passes through the same sequence before a result is shown.
You choose what is examined — a snippet, a folder, a GitHub repository, a public URL, or a log file. Nothing is discovered or touched without you naming it.
Dependencies, build output, lockfiles and binaries are excluded before anything is read, so the scan covers the code you actually wrote.
Transparent signature rules run across the content. Each rule is readable, so a finding can always be traced to the pattern that raised it.
Every finding is tied to the NIST, PCI-DSS or ISO 27001 control it affects — the language your assessor already works in.
Results are ranked by severity, and each one states the remediation rather than only the flaw.
Hand the findings to the advisor for a plain-language executive summary that a non-technical committee can read.
These are not settings you can turn off. They are how the scanners are built.
Every web check is passive. It reads what a server volunteers to any visitor and never attempts to exploit anything. Scanning requires you to confirm you are authorised.
Repositories are read through the GitHub API. Nothing is cloned, nothing is executed, and only source files are read.
A GitHub token, if you supply one for a private repository, is used for that single request and never stored.
Private, loopback and link-local addresses are refused, and the check is repeated after the address resolves, so a public name pointing inward is rejected too.
Explainable by design
Detection uses readable signature rules rather than a black-box model, so you can show an auditor exactly why something was flagged — and argue with it when it is wrong.
Control mappings
Findings carry the specific NIST SP 800-53, PCI-DSS or ISO/IEC 27001 control they touch, so remediation work can be evidenced against an obligation rather than a score.
Data boundaries
The code, web and log engines are self-contained and run without any external model. Only the optional advisor and summaries use one, so sensitive material need never leave at all.
Remediation first
Each rule carries the specific corrective action — rotate this key, parameterise this query, replace this algorithm — because a list of problems without fixes is a backlog, not a result.
Authorisation
A web scan cannot run without confirming you own or are authorised to test the target, and the tool refuses addresses it should not be reaching.
Moving pattern
The design borrows from a starling murmuration: check order is randomised and the scanner's session fingerprint rotates, so the tool itself presents no stable pattern — a small, honest nod to moving-target defence rather than an evasion claim.
Building compliance platforms taught us what the hard part of security reporting actually is. Finding the problem is comparatively easy. Proving months later which obligation it touched, what you did, and when — that is the part organisations fail, and it is the part generic tooling leaves to a spreadsheet.
It is built for the same industries as the rest of our regulated work: banking and financial services, government and defence, energy, healthcare and telecom. The stance matches our other products — the AI does the reading and the drafting, and a person decides what reaches anything that matters.
No, and we would rather be blunt about that. White Defender is white-hat and defensive: it analyses code, reads the headers and files a web server already exposes publicly, and reviews logs you give it. It never attempts to exploit anything. It does not replace a penetration test or a qualified assessor, and WMAD does not hold security certifications of its own — see our Trust & Security page for exactly where that line sits.
Not for the scanning. The code, web and log engines are self-contained and run without any external AI provider, so for sensitive material nothing needs to leave. The AI advisor and the one-click executive summary are the only parts that use a model, and they are optional — you choose when to use them.
A typical scanner says 'hardcoded secret, high severity'. White Defender says that, and adds that it affects NIST 800-53 IA-5, PCI-DSS requirement 8.2.1 and ISO 27001 A.9.4.3. That matters because your auditor does not ask how many high-severity issues you have; they ask how you satisfy a named control. Findings written in that language can be evidenced directly.
Hardcoded secrets and API keys, AWS access keys, embedded private keys, SQL built by string concatenation, use of eval, command injection, unsafe innerHTML, weak cryptography, insecure random number generation, wildcard CORS, disabled TLS verification, debug flags left on, and JWTs accepting the 'none' algorithm. The rules are signatures rather than a model, which keeps every result explainable.
Yes. You supply a personal access token, which is used for that one request and never stored. The repository is read through the GitHub API — nothing is cloned and nothing is executed. Dependencies, build output and binaries are filtered out before any file is read.
Not today, and that is deliberate rather than an oversight. Scanning a server's filesystem means giving an application credentials with access to it, which is a much higher-stakes trust boundary than a scoped, revocable API token. We are choosing between two safer designs — a lightweight agent you run yourself that sends results out, or key-based SSH initiated per scan and never persisted — and we would rather decide that against a real environment than ship it blind.
It is live at whitedefender.thewmad.com — the code scanner, web recon scanner and SOC log analyser work today with no account. Accounts, scan history and role-based access are still being built, so treat it as an early-access tool rather than a finished product. Tell us what you are trying to secure and we will walk through it with you.
Open White Defender and run it directly — no account needed for the scanners. Tell us what you are trying to secure and we will walk through the results with you.