VulcanSTIG-Ready Security Guidance
Streamline the creation of STIG documentation and InSpec validation profiles
Skip to content
STIG Process Modeling
Manage the complete workflow between vendors and sponsors for STIG creation
InSpec Integration
Write and test validation code locally or across SSH, AWS, and Docker targets
Control Management
Track control status, revision history, and relationships between requirements
Collaborative Authoring
Multiple authors can work on control sets with built-in review workflows
Cross-Reference STIGs
Look up related controls across all published STIGs for consistency
Enterprise Security
Database encryption, flexible authentication with OIDC, LDAP, and GitHub
Quick Start
bash
# Clone the repository
git clone https://github.com/mitre/vulcan.git
cd vulcan
# Generate secure configuration
./setup-docker-secrets.sh
# Start the application stack (Vulcan + PostgreSQL)
docker compose upSee the Quick Start guide for the compose-file-only setup and first steps.
Latest Release
Current Version
v2.4.2 - Released August 2026
Full SRG-component export and spreadsheet re-import parity with STIG components, a project-page component lock indicator, and session-timeout fixes (restored the 1-hour default; corrected VULCAN_SESSION_TIMEOUT suffix parsing). View Release Notes →
Why Vulcan?
Vulcan bridges the gap between security requirements and practical implementation, enabling organizations to:
- Accelerate STIG Development: Reduce time from months to weeks
- Ensure Consistency: Maintain alignment with DISA standards
- Automate Validation: Generate InSpec profiles alongside documentation
- Collaborate Effectively: Built-in workflows for multi-team environments
- Track Compliance: Full audit trail and revision history
Technology Stack
Backend
- Ruby 3.4.10 with Rails 8.1.3.1
- PostgreSQL 18
Frontend
- Vue 2.7.16
- Bootstrap 4.6.2
- Turbolinks 5.2.0
DevOps
- Docker optimized images
- GitHub Actions CI/CD
- Kubernetes ready
Part of MITRE SAF
Vulcan is a core component of the MITRE Security Automation Framework (SAF), a comprehensive suite of tools designed to automate security validation and compliance checking.
InSpec
Compliance automation framework
Heimdall
Security results visualization
SAF CLI
Command-line security tools