Snyk AppRisk

Overview

The Snyk AppRisk integration connects the Praetorian Guard Platform (PGP) with your Snyk AppRisk environment, importing application assets, risk scores, and coverage gaps directly into your attack surface inventory. Snyk AppRisk provides Application Security Posture Management (ASPM) by discovering developer assets across your software development lifecycle and evaluating which repositories, packages, and applications have adequate security coverage. PGP imports this data so you can correlate application security posture with your broader external attack surface.

This integration is ideal for organizations using Snyk AppRisk to manage application security at scale. Rather than switching between PGP and the Snyk console to understand where coverage gaps exist, this integration brings application asset inventories and risk classifications into a single view alongside your infrastructure assets, vulnerabilities, and threat intelligence. Security teams gain unified visibility into which applications are covered by security tooling and which represent unmanaged risk.

What the Integration Does

When connected, PGP performs a read-only import from the Snyk AppRisk API:

• Application Assets: Each application asset discovered by Snyk AppRisk — including repositories, container images, and packages — is imported as a PGP asset. Asset metadata such as repository URL, programming language, and business criticality are captured alongside each asset record.

• Risk Scores and Classifications: Snyk AppRisk risk scores and risk factor breakdowns are imported as risk metadata on each asset, allowing you to prioritize remediation based on application-level risk context within PGP.

• Coverage Gaps: Assets identified by Snyk AppRisk as lacking security tool coverage (e.g., no SAST scanner, no SCA scanner) are flagged, giving you visibility into where your application security program has blind spots.

• Policy Violations: Policy evaluation results from Snyk AppRisk are imported, surfacing applications that violate your organization's security policies.

Data flows one direction only — from Snyk AppRisk into PGP. The integration never writes back to Snyk, modifies asset classifications, or changes policies.

Prerequisites

Before setting up the integration, you need a Snyk API token with access to AppRisk data:

1. Log in to the Snyk Web UI

2. Click your account avatar in the bottom-left corner and select Account Settings

3. Under the General tab, locate the Auth Token section

4. Click Generate Token (or copy your existing token)

5. Record the API Token — it will be used to authenticate PGP

6. Ensure your Snyk organization has Snyk AppRisk enabled and that the token has access to the organization(s) you want to import

The API token must belong to a user or service account with sufficient permissions to read AppRisk asset and issue data across your target organizations.

Setup

1. Go to Integrations, then Application Security, then Snyk AppRisk in the Guard Platform

2. Enter your Snyk API token and organization details in the setup form

3. Click Connect — PGP will validate your credentials by attempting to fetch your application assets before saving

If validation fails, verify that your API token has access to the specified organization and that Snyk AppRisk is enabled for that organization.

What Data Is Synced

Application Assets

Each application asset discovered by Snyk AppRisk creates a PGP asset with:

• Asset name: Derived from the repository name, package name, or container image identifier

• Asset type: Application asset

• Metadata: Repository URL, source control manager, programming language, business criticality, asset class, and discovery source

Risk Scores

Risk score data is attached to each application asset:

Coverage Gaps

Assets missing security tool coverage are imported with gap indicators:

Policy Violations

Policy results from Snyk AppRisk are imported as risks associated with the relevant application asset, including the policy name, severity, and violation details.

API Endpoints Used

Base URL: https://api.snyk.io (or https://api.eu.snyk.io for EU tenants)

All requests are authenticated using an Authorization: token {api_token} header over HTTPS. The integration uses the Snyk REST API (versioned) and paginates through all results during each sync.

Troubleshooting

Security and Data Handling

• Read-only access: The integration only reads data from Snyk AppRisk. It never creates, modifies, or deletes assets, policies, or configurations in your Snyk environment.

• Credential handling: Your Snyk API token is stored as an encrypted credential within PGP and is never exposed in logs or the UI after initial entry.

• Authentication: The API token is transmitted via HTTPS in the Authorization header for every request.

• Data filtering: Imported assets pass through PGP standard filtering rules, allowing you to control which application assets and risk data are included in your attack surface.