Why it exists
Provenance started as the tool its authors needed for their own estate, which spans servers in several countries and data centres. Before it, answering “what do I own, and is any of it exposed” meant a spreadsheet and an afternoon of work.
The hardware register, the dependency lists and the deployment record usually sit with different teams in different tools. Each works on its own, but together they cannot answer the question that comes up during an incident: “a vulnerability was published in this library. Do we ship it, and is it running?”
Answering it means joining three things by hand, under time pressure, from systems that were never designed to be joined. provenance exists to turn that join from an afternoon's work into a lookup.
Both of these are real categories doing real work. Neither does what is described above, and the reasons are worth stating precisely.
| Category | What it is very good at | What it leaves to you |
|---|---|---|
| Vulnerability scanners | Finding what is wrong with a host or an image, in depth, continuously. | The inventory the findings hang off. A list of findings per machine does not tell you “which of our releases ships this, and which are live”. |
| Cyber asset attack surface management | Federating what your other systems already know (cloud accounts, directory, scanners) and reconciling the overlaps. | The record of what you can evidence. A reconciled view of other tools only shows what those tools hold, and an assessor asks what you published and when. |
There is no agent to install, no list of connectors to configure before the first useful screen and no sales call needed to see the product. The trade-off is that nothing appears in the register until you or your pipelines add it.
Every count on this platform is scoped to what you actually run, so findings in releases nobody deploys do not inflate the numbers you act on.
Trying it is free, in a small workspace of your own, with no time limit. Because the audit log is hash-chained and its recipe is published, you can recompute it yourself.
provenance does not sweep your network to find assets, apply patches or watch a live host for configuration drift. It is a register of record, with evidence that the record is intact. Wherever this site gives a count, it says which population was counted.
provenance is for the people who answer for the estate: systems and platform engineers with more machines and services than they can keep in their heads, security engineers who need exposure ranked by what is actually running, and whoever has to hand an assessor something they can check.
A scanner answers "what is wrong with this host". provenance answers "what do I own, what is in it and where is it running", and ranks what is wrong by that. You notice the difference during an incident. A scanner gives you a list of findings per machine, when what you need to know is which releases contain a named library and which of those are live. Answering that takes a join across the inventory.
CAASM tools connect to your cloud accounts, directory and existing scanners, and reconcile what those systems already know. provenance is a register of record: it holds the SBOM your build actually published and the device your custodian actually holds, with a hash-chained history of every change. The two complement each other, since a CAASM tool reports what your other tools believe and provenance holds what you can evidence.
No. There is nothing to install on a host. Software enters the register when your CI publishes a CycloneDX SBOM against a release, and hardware enters it through the API or the register screens. We avoided agents because an agent is a privileged process on every machine you own, and agents are the largest single reason inventory projects stall.
Trying it is free, with no time limit, in a small workspace of your own that nobody else can see. Its limits are on the pricing page. We want engineers to be able to run it on their own machines before they recommend it for anyone else's.
provenance does not discover assets by scanning your network, patch anything for you or watch a running host for configuration drift. It records what you tell it and what your build publishes, and makes that record verifiable.
Yes. The platform runs on its own register, including the components of the page you are reading. That means we find the screens that are unpleasant to use before you do.
Personal use is free and includes the whole platform. If you run an estate for somebody else, the enterprise conversation starts with what you actually have.