# Security: AI tools > From the AI SDLC Landscape (https://aisdlclandscape.org/phases/security). CC-BY-4.0. Data as of 2026-10-26. Finding and fixing vulnerabilities in code and dependencies. 18 tools list this as the main phase, and 12 more tools cover it. ## Main phase - [Aikido Security](https://aisdlclandscape.org/tools/aikido.md) (Aikido Security): "Continuous, autonomous security for what developers build, ship and run: code, dependencies, containers, cloud and AI pentests." - [Apiiro](https://aisdlclandscape.org/tools/apiiro.md) (Apiiro): "Secures everything coding agents build, use and ship: a Guardian Agent on an AppSec data fabric that prevents risk before code exists." - [AppSecAI](https://aisdlclandscape.org/tools/appsecai.md) (AppSecAI): "Turns findings from any code scanner into validated, tested code fixes your security team delivers; nothing fixed, nothing owed." - [ArmorCode](https://aisdlclandscape.org/tools/armorcode.md) (ArmorCode): "Agentic AI platform for unified exposure management: an independent control plane where AI agents find, prioritise and fix vulnerabilities." - [Chainguard](https://aisdlclandscape.org/tools/chainguard.md) (Chainguard): "Trusted open-source artifacts for every layer of the stack: hardened containers, language libraries and VMs with SLA-bound CVE patching." - [Checkmarx One](https://aisdlclandscape.org/tools/checkmarx.md) (Checkmarx): "Agentic application security platform: hybrid scanning plus AI agents that deliver merge-ready fixes at the point of code creation." - [CodeAnt AI](https://aisdlclandscape.org/tools/codeant.md) (CodeAnt AI): "Exploit-based agentic security platform: AI agents reason across code, infrastructure and runtime to prove what is exploitable and fix it; also AI code review." - [Corgea](https://aisdlclandscape.org/tools/corgea.md) (Corgea): "Finds, triages and fixes vulnerabilities across code, packages, infrastructure and containers." - [DryRun Security](https://aisdlclandscape.org/tools/dryrun.md) (DryRun Security): "AI-native SAST agents: an independent security check on human and AI-generated code, with no rules and fast PR feedback." - [Endor Labs (AURI)](https://aisdlclandscape.org/tools/endor-labs.md) (Endor Labs): "Agentic application security platform for AI-generated and human-written code: prioritises and fixes what is reachable." - [Legit Security](https://aisdlclandscape.org/tools/legit.md) (Legit Security): "AI-native ASPM platform to detect, fix and prevent AppSec risk from AI-generated code, across the software factory." - [Mobb](https://aisdlclandscape.org/tools/mobb.md) (Mobb): "Automatically fixes code vulnerabilities found by your scanners and secures AI-generated code at the source." - [Pixee](https://aisdlclandscape.org/tools/pixee.md) (Pixee): "Automates vulnerability triage and remediation across your scanners: clears up to 95% of false positives and fixes the rest as merge-ready PRs." - [Semgrep](https://aisdlclandscape.org/tools/semgrep.md) (Semgrep): "AI-assisted SAST, SCA and secrets detection: learns your code context to cut false positives and prioritise reachable vulnerabilities." - [Snyk AI Security Platform](https://aisdlclandscape.org/tools/snyk.md) (Snyk): "Secures the code AI writes, the agents that write it and the AI apps teams build: SCA, SAST, IaC and container scanning." - [Socket](https://aisdlclandscape.org/tools/socket.md) (Socket): "Blocks zero-day software supply chain attacks before they reach a developer's machine, CI or production." - [Veracode](https://aisdlclandscape.org/tools/veracode.md) (Veracode): "Application risk management platform combining decades of security research and AI-driven analysis to find and fix flaws." - [ZeroPath](https://aisdlclandscape.org/tools/zeropath.md) (ZeroPath): "AI-native SAST and AppSec platform that finds broken authentication, logic bugs and outdated dependencies, then fixes them." ## Also covers this phase - [Amazon Q Developer](https://aisdlclandscape.org/tools/amazon-q-developer.md) (Amazon Web Services): "AI coding assistant that writes, debugs and refactors code natively in your IDE and across AWS." - [Codemod](https://aisdlclandscape.org/tools/codemod.md) (Codemod): "Code intelligence and automation platform that gives agents compiler-aware context for framework upgrades, migrations and org-wide fixes." - [CodeRabbit](https://aisdlclandscape.org/tools/coderabbit.md) (CodeRabbit): "Governance and control for agentic development: independent AI code review, PR triage, change explanations and continuous checks." - [Datadog (Bits AI)](https://aisdlclandscape.org/tools/datadog-bits.md) (Datadog): "Cloud monitoring and security platform; Bits AI runs incident tasks, writes postmortems and, as Bits AI Dev Agent, suggests tests for uncovered code." - [DeepSource](https://aisdlclandscape.org/tools/deepsource.md) (DeepSource): "The AI code review platform: automates code reviews, catching security issues and improving code health before production." - [Dynatrace](https://aisdlclandscape.org/tools/dynatrace.md) (Dynatrace): "Observability built for the age of AI: deterministic AI and AI agents that prevent problems and coordinate action across clouds." - [GitHub Copilot](https://aisdlclandscape.org/tools/github-copilot.md) (GitHub (Microsoft)): "Your AI coding agent, every step of the way from an open issue to reviewing and merging a pull request, in the editor, terminal or github.com." - [GitLab Duo Agent Platform](https://aisdlclandscape.org/tools/gitlab-duo.md) (GitLab): "Custom AI workflow automation across the software lifecycle: specialised agents for planning, coding, security and deployment." - [Harness](https://aisdlclandscape.org/tools/harness.md) (Harness): "The Autonomous SDLC Platform: agents for your software factory across CI, CD, testing, security and runtime protection." - [Korbit](https://aisdlclandscape.org/tools/korbit.md) (Boost Security): "AI code reviewer for GitHub and Bitbucket, enabling faster review cycles and fewer bugs in production." - [Moderne](https://aisdlclandscape.org/tools/moderne.md) (Moderne): "A deterministic layer between your agents and your code: agents drive OpenRewrite recipes to make provably correct changes across whole business units." - [SonarQube](https://aisdlclandscape.org/tools/sonar.md) (Sonar): "AI code review and verification: consistent quality gates on every PR and pipeline, from IDE to CI/CD, for human and agent-written code." Claims are each vendor's own words. Every fact on a tool's page links to its source.