Agentic Development Security Security Tools

Aikido provides everything the average startup to mid-market company needs for security in a box - every code and cloud security scanner under the sun without much feature compromise, alongside a surprisingly robust runtime application solution for things like bot prevention. A no-nonsense replacement for a lot of more "specialized" solutions that tend to slow developers down.

Cycode offers a holistic all-in-one ASPM tool with their in house scanners alongside the ability to import third party findings. They offer about every scanner and feature you could need out of an AppSec tool.

AI-powered endpoint security platform that gives teams control over everything running on their endpoints so they can adopt AI safely.

Pluto is a leading AI security solution that specializes in securing endpoints and agentic building solutions like Lovable and Base44

Bloom discovers and governs AI agents, extensions, IDE plugins, and MCP servers on endpoints with contextual risk assessments.

Depthfirst offers AI native application security functionality from threat modeling to scanning tools.

Corgea provides a robust bundling of AI first scanning tools - from AI SAST to SCA and Secrets scanning. Corgea's especially strong at discovering vulnerabilities via AI scanning, and AI based prioritization for false positive analysis.

An AI-native application security platform that unifies various scanning and enforcement tools, identifies real vulnerabilities, reduces false positives, and generates contextual fixes integrated into developer workflows.

Endor Labs stands out in their granularity and reachability analysis for open source packages. They've also added back ported patches and automatic fix suggestions based on function changes between patch versions. They offer basic SAST capabilities via opengrep for companies that need it.

Ox provides an all-in-one application security solution that provides their own scanners combined with the ability to import third party findings. They also have a robust API for managing the data in the tool.

Escape is doing amazing things with their approach to DAST. They thoroughly discover your APIs and schemas by searching your frontend code, and then test those APIs from the outside. They have great scanning support for modern languages, and also in depth testing configurations.

Clover provides a platform for doing continuous AI threat modeling and design review. By connecting to organizational data sources, they can help map your application architecture and accelerate your threat modelling process. They then continuously enforce these decisions through AI code review of pull requests and AI code generation.

Checkmarx has adapted well to the DevSecOps model, offering a lighter weight scanner in the Checkmarx One platform, that integrates well into the larger stack. They don't have all the latest features of some newer companies, but they certainly get the job done for diverse enterprises. I would not suggest venturing off Checkmarx One though.

Arnica is a holistic application security solution that focuses primarily on providing a strong developer experience. They have robust policy and attribution engines to build detail oriented workflows getting the right finding to the right person at the right time.

Phoenix security is more on the vulnerability management side of ASPM, but they offer their own SCA and DAST options alongside existing scanners. Due to the emphasis on management & orchestration, they offer a wide variety of contextualizations and in depth vulnerability data. An especially great fit for enterprises.

XBOW deploy AI agents that continuously map an application's attack surface, chain and execute exploits, and independently validate findings to eliminate false positives. Testing triggers on application changes, and its agents reached #1 on the US HackerOne leaderboard.

For what Snyk offers in usability across functions, SemGrep excels in customization. Their tool offers extensive customizations and rule sets, and their reachability analysis, a critical aspect of SCA, beat Snyk to market. Also, their open source tooling is powering many other tools on this list.

DryRun provides a flexible platform for AI code analysis, covering custom and out of the box use cases for in depth code analysis.

Corridor provides a holistic approach to securing AI generated code by helping secure developer endpoints, bringing organizational security context to coding agents, and doing in pipeline security code review.

Aisle provides AI native code security scanning covering SCA and SAST.

Amplify security leverages multi-AI Agents to generate relevant and accurate fixes, alongside SAST scanning capabilities. This approach replicates the process of developers and security engineers working together to fix issues so both teams are happy. Amplify tries to make the code fixes look as if the developer themselves wrote the fix, emphasizing the contextual nature of the code.

Ophion gets the closest I've seen to a realistic automated pentest, and are essentially offering ongoing recon as a service. They aren't just running DAST scanners against your endpoints, but are instead doing a very realistic reacon of your public facing assets. One small example illustrating the difference is looking at the public commit history of your company employees on public GitHub repos.

Inspectiv has built a bug bounty platform focused on the customer experience of managing the reports and payouts on your behalf, eliminating some of the mundane work of running a bug bounty program.

HackerOne is the standard for bug bounty programs. It's questionable if you can use them to check the box for a pentest, so check with your auditor before doing so; however, a bug bounty program can be much more useful than a pentest in many cases. Keep in mind the heavy maintenance cost of auditing reports from people who want bounties for minor findings.

DevArmor provides automated threat modelling and design reviews, using AI to examine changes happening across your code and planning documents to continuous security reviews.

Intent-aware workspace security platform that uses on-device AI reasoning to read human, AI, and app activity and intervene before risky actions complete.

Governance capabilities for MCP servers, skills, and AI agents with threat detection, fine-grained permissions, and full observability.

Automated security design reviews and threat models across the SDLC.

Pi is an agentic product security platform that builds an institutional security memory to autonomously triage, remediate, and prevent recurring vulnerability classes across the SDLC.

Staris built a platform for open box pentesting powered by GenAI. They look at your code and your application, build a PoC exploit of findings as a code test, and give you the fixed code. The workflow is wrapped as a pentest - which offers a glimpse into what the future of pentesting will undoubtedly look like. Staris uses GenAI to help find exploits from SAST to runtime.

Agentic AI offensive security platform running continuous, human-overseen penetration testing across web apps, APIs, networks, and AI systems.

Proprietary offensive-security AI model that continuously pentests web apps, mobile apps, APIs, and external attack surfaces.

Seezo turns design docs into security requirements.

Dam Secure combines AI SAST capabilities with natural language guardrails for AI generated code.

Ethiack is a combination DAST scanner and pentesting platform, using customized scanners to detect issues and working with hackers for either validation or manual pentesting.