Merito is an authorized Saltworks reseller and services partner. Saltworks is a single-product vendor, and its SaltMiner platform handles application security posture management (ASPM) and unified vulnerability management. Merito installs SaltMiner, integrates the SAST, SCA, DAST, IAST and pentest tools a program already runs, authors the normalization rules and configures the executive dashboards.
Saltworks portfolio
SaltMiner brings scanner and pentest findings into one deduplicated AppSec backlog.
Saltworks is a single-product vendor focused on SaltMiner, the Application Security Posture Management platform that aggregates findings across SAST, SCA, DAST, IAST, and manual pentesting. Merito integrates the tools a program already runs and sets up the executive dashboards that sit alongside the technical backlog.
Why Merito for Saltworks
Connecting every scanner and writing the deduplication rules is most of what makes SaltMiner work.
Saltworks builds SaltMiner. The platform consumes findings from disparate AppSec scanners (Coverity Static, SonarQube, Checkmarx, Semgrep, Snyk, Sonatype, Veracode, manual pentest output, and the long tail of niche tools), correlates and deduplicates results across them, and produces a unified vulnerability backlog plus executive trending dashboards. Penetration testing management is built into the platform alongside the scanner aggregation, which most ASPM platforms keep separate.
SaltMiner is a focused product. It works with the SAST and SCA scanners a program already runs instead of replacing them, adding the aggregation, correlation, and reporting layer on top. Programs running multi-vendor AppSec stacks use SaltMiner as the consolidation surface where findings normalize and prioritize.
Running SaltMiner well is mostly integration and rules work. We integrate the customer's scanner inventory, author the deduplication and prioritization rules, configure the executive dashboards against the customer's reporting cadence, and stand up the operating model that consumes the consolidated backlog. Compliance dashboards map findings to the regulatory frameworks the customer needs evidence for.
The Saltworks toolchain
One product, SaltMiner, covering ASPM, executive reporting and pentest management
Application Security Posture Management
SaltMiner is the single Saltworks product. ASPM aggregation, correlation, executive reporting, and pentest management under one platform.
ASPM
SaltMiner
Application Security Posture Management platform that aggregates findings from SAST, SCA, DAST, IAST, and manual pentest tools. Correlation and deduplication, executive dashboards, REST API integration, and built-in penetration testing management.
What drives SaltMiner pricing
SaltMiner is a subscription licensed by application count and by the number of security tools it ingests, with SaaS and on-premises deployments sold separately. Its value comes from the integration work around it, connecting each scanner, writing normalization rules and building the executive dashboards. ASPM makes sense once a program runs findings from several scanner vendors.
| Product or tier | What drives the price |
|---|---|
| Applications | The application surface in scope |
| Integrated tools | The SAST, SCA, DAST, IAST and pentest sources SaltMiner ingests |
| Deployment | SaaS and on-premises editions are sold separately |
Merito services
SaltMiner services from Merito
01Service
Implementation
SaltMiner deployment (SaaS or on-prem), scanner integration onboarding, normalization rule authoring, and executive dashboard configuration.
02Service
MAPS Assessment
AppSec program scoping for SaltMiner adoption alongside Black Duck Software Risk Manager, Apiiro, Cycode, and other ASPM platforms.
03Service
DevOps Consulting
SaltMiner integration into developer ticketing systems (Jira, Azure Boards, ServiceNow) and CI/CD scanner orchestration.
04Service
Premium Support
Named engineer, priority SLAs, and release-window coverage for SaltMiner programs Merito implements.
05Service
Managed Services
Scanner connections maintained as tools are added, deduplication rules retuned, dashboards refreshed before each executive review, and pentest engagements tracked in SaltMiner.
06Service
Training and Enablement
ASPM fundamentals and deduplication rules for AppSec architects, dashboard walkthroughs for security executives, and compliance evidence views for compliance leaders.
07Service
Staff Augmentation
Merito-placed AppSec engineers and SaltMiner specialists embedded on long-running ASPM programs.
Saltworks licensing
Buy Saltworks SaltMiner from the partner that authors the rules and runs the integrations.
SaltMiner is only as good as the scanners it connects and the rules that deduplicate their findings. Decide between SaaS and on-premises first, since the two are sold separately.
Related solutions
Where Saltworks connects to the rest of the Merito program
Application Security
SaltMiner as the reporting layer over Semgrep, Black Duck, Checkmarx, Snyk and Sonatype scanners.
DevOps Toolchain
Consolidated AppSec findings inside developer workflows alongside scanner output.
Frequently Asked Questions
Saltworks FAQs
Consultation request
Talk to Merito about Saltworks
List the AppSec scanners you run and what executives need to see. A Merito Saltworks specialist follows up within one business day.
Single-product focus
SaltMiner is the portfolio
Saltworks is a single-product vendor focused on ASPM. The depth comes from a focused product rather than a broad catalog.
MAPS-driven scoping
AppSec program scoping by Merito
MAPS Assessment sizes the ASPM program before SaltMiner implementation begins, including scanner inventory and reporting cadence.
Next step
Consolidate the multi-vendor AppSec stack with SaltMiner.
A Saltworks conversation with Merito starts with the scanner inventory and the executive reporting cadence. Multi-vendor programs running three or more analysis tools see the most value from ASPM consolidation.