Jit is an application security company whose Open ASPM Platform gives development teams automated security across code, pipelines, cloud and runtime. It is aimed at engineering organisations that want security checks in place quickly without a dedicated team stitching tools together.
The problem it solves is tool sprawl. Instead of installing, tuning and watching a separate scanner for every layer of an application, teams switch on a security plan and Jit runs a curated set of open-source and cloud-native tools for them, ranks what matters and suggests fixes inside the pull request.
At A Glance
| Vendor | Jit |
|---|---|
| Category | Application security posture management (ASPM) |
| Identities covered | Secrets in code, and cloud accounts in AWS, Azure and GCP through posture scanning |
| Deployment | SaaS, with scans run in Jit’s environment, or self-hosted runners |
| Customers | ShopMonkey, LinearB, JunoJourney, HouseRX, LoudNClear |
| Market classification | Application Security; also Cloud Security |
What Jit Does
Jit organises product security as a set of plans, each covering a layer of a cloud application, and orchestrates the tools and processes that each plan needs. Teams connect their source control, activate tools across every repository in one click and from then on every code change is scanned. Findings are filtered by context about production, so developers see a short list of real problems rather than every alert from every scanner. Developers and DevOps staff work with the results inside their pull requests, while an administrator, known in Jit as the security champion, chooses the plans and tracks progress.
Products
Security Plans
Plans are the way customers choose coverage. The Minimum Viable Security plan “covers the key product security bases with minimal effort”, bundling static analysis, dependency scanning, IaC scanning, Kubernetes scanning and CI/CD security for early-stage teams. Larger organisations can move to a SOC2 Plan for teams preparing for a SOC 2 audit, a Cloud Security Plan, a Maximum Viable Security Plan or a custom plan.
Code And Pipeline Scanning
This layer looks for flaws before code ships, across 14 programming languages:
- SAST, SCA and secrets detection
- IaC and Dockerfile scanning
- CI/CD checks, licence detection and SBOM generation
Cloud And Runtime
For running systems, Jit adds cloud security posture management across AWS, Azure and GCP and dynamic testing of web applications and APIs, so teams can see misconfigurations and exposed endpoints next to code findings.
Context Engine
The Context Engine ranks risks using runtime signals such as production exposure and internet access, and traces each issue from code to cloud. It narrows results to what Jit puts at “the top 3-6% of security risks that are exploitable in production”, which keeps developer queues short.
Remediation And Reporting
Developers get suggested fixes they can commit straight from the pull request and security champions can apply bulk fixes from the Actions page. Centralised reporting, DevSecOps metrics and Jit Teams show who owns which issues. Jit’s AI agents, built on its knowledge graph, work in Slack and in pull requests to take on routine AppSec tasks.
How It Works
Jit is a hosted service connected to the customer’s source control and cloud accounts.
| Component | What it does |
|---|---|
| Source control connection | Customers connect GitHub or GitLab and activate tools across repositories, with daily scanning also available for Bitbucket and Azure DevOps codebases. |
| Scanning environment | Scans run in Jit’s environment rather than in the customer’s CI, which takes load off build pipelines. Self-hosted runners and deployment-based scanning are available for teams that need scans inside their own environment. |
| Pull request check | Results show up as a single “Jit Security” check in each pull or merge request, with code review comments consolidated into one comment. |
| Orchestration framework | Under the hood Jit runs open-source scanners including Semgrep, Gitleaks, OSV-Scanner, Trivy, Syft, OWASP ZAP, KICS, Prowler, Legitify, Gosec, Trufflehog, NPM-audit, Kubescape, Chain-bench and Nancy, plus its own Jit BP-checker, and can add other open-source, commercial and cloud-native tools. |
| Administration | Accounts can use SSO, role-based access and audit logs. |
Identities And Systems Covered
| Secrets | Hard-coded secrets in source code. |
|---|---|
| Cloud accounts | Posture of AWS, Azure and GCP environments. |
| Kubernetes | Cluster and manifest configuration. |
| Source control | GitHub and GitLab repositories and organisation settings. |
| Applications | Web applications and APIs under dynamic testing. |
Integrations
| Area | Integrations |
|---|---|
| Developer tools | VS Code, Cursor |
| Ticketing | Jira, Linear, Shortcut, Monday.com |
| Collaboration | Slack, Microsoft Teams |
| Cloud security | Wiz, Orca Security, Upwind Security, Sweet Security |
| Commercial scanners | Checkmarx, Semgrep Pro, Bright Security, Invicti, StackHawk |
| Data security and compliance | Cyera, Drata |
| SIEM | Splunk, Google Chronicle |
Company Background
| Founded | 2021 in Tel Aviv, Israel. |
|---|---|
| Founders | David Melamed (CTO), Aviram Shmueli, Gil Zimmermann, Ron Zalkind and Tsahy Shapsa. |
| Funding | A $38.5 million seed round in June 2022, led by boldstart ventures with Tiger Global Management and strategic angel investors. |
Note: This overview is compiled from Jit’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.