What Ghost is
Ghost Security provides external API first DAST scanning combined with integrations for API discovery. They're leaning more into agentic AI for discovery and fixing. The vendor site is ghostsecurity.com. This profile is an entry in the oneNorma directory, not a vendor landing page.
What Ghost covers
Ghost is in the catalog for these capabilities. Categories: DAST and API Security. Catalog tags: Best for MidMarket and Best for Startups.
How to evaluate Ghost in a security program
Use Ghost as a stack candidate, not as diligence evidence. The oneNorma score for Ghost is 4/10 (percentile 15). If the real gap is in DAST and API Security, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what ghostsecurity.com publishes. Contrast it with pentesting and Security Cloud & Compliance.