Lifecycle phase 6 of 13
Security: AI tools
Finding and fixing vulnerabilities in code and dependencies.
18 tools list this as the main phase, and 12 more tools cover it. Each claim is the vendor's own words, and every fact on a tool's page links to its source.
Main phase
Aikido SecurityAikido Security“Continuous, autonomous security for what developers build, ship and run: code, dependencies, containers, cloud and AI pentests.”
ApiiroApiiro“Secures everything coding agents build, use and ship: a Guardian Agent on an AppSec data fabric that prevents risk before code exists.”AppSecAIAppSecAI“Turns findings from any code scanner into validated, tested code fixes your security team delivers; nothing fixed, nothing owed.”
ArmorCodeArmorCode“Agentic AI platform for unified exposure management: an independent control plane where AI agents find, prioritise and fix vulnerabilities.”ChainguardChainguard“Trusted open-source artifacts for every layer of the stack: hardened containers, language libraries and VMs with SLA-bound CVE patching.”
Checkmarx OneCheckmarx“Agentic application security platform: hybrid scanning plus AI agents that deliver merge-ready fixes at the point of code creation.”
CodeAnt AICodeAnt AI“Exploit-based agentic security platform: AI agents reason across code, infrastructure and runtime to prove what is exploitable and fix it; also AI code review.”
CorgeaCorgea“Finds, triages and fixes vulnerabilities across code, packages, infrastructure and containers.”
DryRun SecurityDryRun Security“AI-native SAST agents: an independent security check on human and AI-generated code, with no rules and fast PR feedback.”
Endor Labs (AURI)Endor Labs“Agentic application security platform for AI-generated and human-written code: prioritises and fixes what is reachable.”
Legit SecurityLegit Security“AI-native ASPM platform to detect, fix and prevent AppSec risk from AI-generated code, across the software factory.”
MobbMobb“Automatically fixes code vulnerabilities found by your scanners and secures AI-generated code at the source.”
PixeePixee“Automates vulnerability triage and remediation across your scanners: clears up to 95% of false positives and fixes the rest as merge-ready PRs.”
SemgrepSemgrep“AI-assisted SAST, SCA and secrets detection: learns your code context to cut false positives and prioritise reachable vulnerabilities.”
Snyk AI Security PlatformSnyk“Secures the code AI writes, the agents that write it and the AI apps teams build: SCA, SAST, IaC and container scanning.”
SocketSocket“Blocks zero-day software supply chain attacks before they reach a developer's machine, CI or production.”
VeracodeVeracode“Application risk management platform combining decades of security research and AI-driven analysis to find and fix flaws.”ZeroPathZeroPath“AI-native SAST and AppSec platform that finds broken authentication, logic bugs and outdated dependencies, then fixes them.”
Also covers this phase
Tools whose main phase is another one.
Amazon Q DeveloperAmazon Web Services“AI coding assistant that writes, debugs and refactors code natively in your IDE and across AWS.”
CodemodCodemod“Code intelligence and automation platform that gives agents compiler-aware context for framework upgrades, migrations and org-wide fixes.”
CodeRabbitCodeRabbit“Governance and control for agentic development: independent AI code review, PR triage, change explanations and continuous checks.”
Datadog (Bits AI)Datadog“Cloud monitoring and security platform; Bits AI runs incident tasks, writes postmortems and, as Bits AI Dev Agent, suggests tests for uncovered code.”
DeepSourceDeepSource“The AI code review platform: automates code reviews, catching security issues and improving code health before production.”
DynatraceDynatrace“Observability built for the age of AI: deterministic AI and AI agents that prevent problems and coordinate action across clouds.”
GitHub CopilotGitHub (Microsoft)“Your AI coding agent, every step of the way from an open issue to reviewing and merging a pull request, in the editor, terminal or github.com.”
GitLab Duo Agent PlatformGitLab“Custom AI workflow automation across the software lifecycle: specialised agents for planning, coding, security and deployment.”
HarnessHarness“The Autonomous SDLC Platform: agents for your software factory across CI, CD, testing, security and runtime protection.”
KorbitBoost Security“AI code reviewer for GitHub and Bitbucket, enabling faster review cycles and fewer bugs in production.”
ModerneModerne“A deterministic layer between your agents and your code: agents drive OpenRewrite recipes to make provably correct changes across whole business units.”
SonarQubeSonar“AI code review and verification: consistent quality gates on every PR and pipeline, from IDE to CI/CD, for human and agent-written code.”