Nullify is a product security company. Its AI agents find, prove and fix vulnerabilities across a codebase and its APIs, then route each fix to the right owner and keep working on it until it merges, so engineering teams get a product security programme without hiring a large security staff.
The problem it targets is the backlog: scanners raise far more findings than security teams can confirm or fix. Nullify validates findings with real exploits, prioritises by what is reachable and matters to the business, and writes merge-ready fixes, with a person keeping final approval on every merge.
At A Glance
| Vendor | Nullify |
|---|---|
| Category | Product security and DevSecOps |
| Identities covered | Exposed credentials and API keys in code, checked against the issuing provider |
| Deployment | Hosted service installed into source control, including a self-hosted GitHub App option |
| Agentic AI | AI agents for code analysis, API pentesting, triage and remediation |
| Customers | DAZN, Fox Sports, SmithRx, nib, Hireup |
| Market classification | DevSecOps |
What Nullify Does
Nullify runs product security as a continuous programme rather than a series of scans, allocating AI capacity to the highest-impact work at any moment. The work follows the path a security engineer would take: find a weakness in code or a running API, prove that it can be exploited, decide whether it matters given what is reachable and what the business depends on, then write the fix and see it through to merge. Every step draws on a shared model of how the customer’s systems fit together, so findings and fixes reflect real architecture and ownership.
Products
Vault
Vault is the context engine, a unified ontology that captures how the customer’s environment works. The other products draw on it to judge reachability, find the owner of a service and shape a fix to the code around it.
Code Security
Code Security is AI-native static analysis that also catches business-logic flaws. It covers languages including C, C++, C#, Go, Java, JavaScript, TypeScript, Kotlin, PHP, Python, Ruby, Rust, Swift and Solidity, and analyses dependencies across supported ecosystems.
Secrets Detection
Secrets Detection finds exposed credentials during code review, using Git history as evidence, and checks which keys are still live by authenticating with the provider that issued them. Known formats are matched by pattern and free-form secrets by NLP, and findings fall into five categories, including PII. Rotation stays with the provider: Nullify recommends creating a replacement key and deactivating the leaked one.
Continuous Assessments (AI Pentest Agent)
The AI Pentest Agent runs continuous, multi-stage tests against REST and GraphQL APIs. Each finding includes full HTTP traffic, reproduction steps and fix guidance. A run can be stopped from the dashboard at any time, and mutation testing only happens with explicit consent.
Exploit Validation, Triage And Remediation
Exploit Validation proves each vulnerability with a reproducible exploit against the deployed service, so teams fix what is real. Triage ranks findings by reachability, exploitability and business impact, and Remediation turns them into merge-ready fixes routed to the owner. When a build fails, remediation agents read the logs and push follow-up commits until the checks pass.
How It Works
| Component | What it does |
|---|---|
| Installation | Customers use an installation or invitation link for their organisation, with tenant provisioning coordinated by the Nullify team, and sign in through their own identity provider. Install guides cover GitHub, a self-hosted GitHub App, GitLab, Bitbucket and Azure DevOps. |
| Configuration | There is no file to add to repositories; CI and pull request gating, ticket thresholds and SLA policies are managed in the dashboard or through the admin API. |
| Connections | A proof of value uses read-only connections to code repositories and to AWS, GCP, Azure or Kubernetes. Cloud and runtime assessments each need their own connections, targets, credentials and authorisation. |
Identities And Systems Covered
| Credentials and keys | Exposed secrets in code and Git history, verified against AWS, GCP, Azure, GitHub, GitLab, Stripe and Slack |
|---|---|
| Sensitive data | Confidential data detection, including PII, when enabled |
| Code | Repositories in GitHub, GitLab, Bitbucket and Azure DevOps |
| Cloud and runtime | AWS, GCP, Azure and Kubernetes |
Agentic AI Capabilities
The product is an AI harness for product security, and its agents carry out the work end to end. Specific to how the AI is run:
| Model mix | Routine tasks go to cheaper models and harder ones to stronger models. |
|---|---|
| Auditable usage | Every token used is tracked and can be audited. |
| Human approval | A person keeps final approval before any fix merges. |
Integrations
| Area | Integrations |
|---|---|
| CI | Buildkite, Jenkins, CircleCI |
| Chat and ticketing | Microsoft Teams, Jira, Linear |
| Ownership and context | Compass, Wiz |
Company Background
| Legal entity | Nullify Holding Corporation. |
|---|---|
| Offices | Sydney, Australia, and San Francisco, United States, with remote staff across the United States and Australia. |
| Funding | A reported $12.5 million seed extension. |
Note: This overview is compiled from Nullify’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.