OX Security is an application security company that helps development and security teams find and fix the risks that matter in their software, from the moment code is written, increasingly by AI coding tools, to the moment it runs in the cloud. Its platform is built for organisations swamped by scanner findings that cannot tell which issues are exploitable in production.
Its mission: “Accelerate the transition to software that secures itself.”
At A Glance
| Vendor | OX Security |
|---|---|
| Category | Application security and ASPM |
| Identities covered | Secrets and PII exposed in code |
| Deployment | SaaS platform, with an on-premises option |
| Agentic AI | OX VibeSec, OX Agentic Pentester and Agent OX fixes |
| Customers | eToro, SoFi, IBM, Microsoft, Intel |
| Founded | 2021 |
| Market classification | Application Security |
What OX Security Does
Most application security programmes produce far more alerts than anyone can work through, and the alerts are disconnected from where risk is created, in code, and where it becomes visible, in the cloud. OX calls its answer “Prompt to Runtime Security”: pinpoint each risk at its exact point of creation and remove it at the source.
The platform is code-first and embeds detection and response across the software development lifecycle. It acts as an application security orchestration (ASOC) layer and a single source of truth, pulling in results from OX’s own engines and third-party scanners, correlating them with business context and showing developers only the issues that are exploitable, reachable and impactful.
Products
OX VibeSec
VibeSec is for teams adopting AI coding assistants who do not want those tools to introduce vulnerabilities. It applies security while the code is being generated, preventing flaws in AI-generated code from the first line.
OX Code And ASPM
OX Code and the ASPM layer give security teams one view of risk across code and pipelines. They aggregate and correlate code-level findings with business context, prioritise the exploitable, reachable and impactful issues, and provide maturity assessment and compliance tools. The platform keeps a full inventory of applications and of build and production infrastructure through auto-discovery, and generates a pipeline bill of materials (PBOM) for every version. For teams that want penetration-style testing informed by the code itself, OX Agentic Pentester runs white-box assessments of those applications using source code analysis.
OX Cloud
OX Cloud secures cloud infrastructure at runtime and traces exposures back to where they were created. It maps every resource and service to find vulnerabilities and misconfigurations, and monitors which libraries are actually loaded, so a vulnerability in code that never runs can be ranked lower.
How It Works
| Component | What it does |
|---|---|
| Connectors | The platform connects to source control, CI/CD pipelines, container registries, cloud environments and third-party scanners through native integrations. It runs as SaaS, and an on-premises deployment option is available. |
| Aggregation | Findings from OX and from external scanners are aggregated and deduplicated into a single view. |
| Context | Cloud context, from OX Cloud or integrated cloud security tools, adjusts issue severity, and remediation is tracked against SLAs. |
| Remediation | Fixes are delivered into developer tools such as Jira and Slack. Agent OX, an AI assistant, generates custom code fixes for vulnerabilities that developers apply with a single click, and ChatGPT is built in as an AI AppSec Advisor. |
Identities And Systems Covered
| Secrets and PII | Secret and PII scanning in code, through OX and integrated detectors such as GitHub Secret Detection, GitLab Secret Detection, Semgrep Enterprise, Fortify and HCL AppScan |
|---|---|
| AI-generated code | Code produced by AI coding tools, through VibeSec |
| Kubernetes | AKS and EKS clusters |
| Applications and infrastructure | Applications, build infrastructure and production infrastructure discovered automatically |
Integrations
| Area | Integrations |
|---|---|
| Source control | GitHub, GitLab, Bitbucket Cloud, Bitbucket Data Center, Azure Repos, Azure TFS, Gerrit, AWS CodeCommit |
| CI/CD | Azure Pipelines, CircleCI, Drone CI, GitHub Actions, GitLab CI/CD, Jenkins |
| Cloud context | Microsoft Defender for Cloud, Oligo, Orca, Prisma Cloud, Qualys, Sysdig, Tenable, Wiz, Upwind |
| Registries | Amazon ECR, Azure Container Registry, Docker Hub, Google Artifact Registry, Harbor, JFrog Artifactory, Red Hat Quay |
| Scanners | Checkmarx, Coverity, Veracode, Snyk, Black Duck, Sonatype, SonarQube, JFrog Xray |
| Logs | Splunk, Logz.io |
Company Background
| Founded | 2021, by Neatsun Ziv and Lior Arzi |
|---|---|
| Leadership | Neatsun Ziv, co-founder and CEO; Lior Arzi, co-founder and CPO; Anandabrata Pal, CTO |
| Funding | A $60 million Series B led by DTCP, with IBM Ventures, Microsoft, Swisscom Ventures, Evolution Equity Partners and Team8 participating; IBM Ventures also made a separate strategic investment, and M12 and Rain Capital are among its backers |
| Recognition | Included in the 2026 Gartner Magic Quadrant for Software Supply Chain Security |
Note: This overview is compiled from OX Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.