Pixee is an application security company that helps development and security teams deal with the backlog of findings their scanners produce. It separates the findings that matter from the noise and turns them into fixes developers can review, so a security backlog shrinks instead of growing.
The Pixee Platform is aimed at teams whose code output, increasingly written by AI coding tools, has outgrown the people available to triage and fix it.
At A Glance
| Vendor | Pixee |
|---|---|
| Category | Application security, automated triage and remediation |
| Deployment | Pixee-hosted, self-hosted in a customer VPC, air-gap ready |
| Agentic AI | AI fix generation, exploitability analysis, coding agent plugin |
| Customers | NTT Data, Nippon Steel, HCL Technologies, Oracle, MoneyGram |
| Certifications | SOC 2 Type II, ISO 27001 |
| Founded | 2023 |
| Market classification | Application Security |
What Pixee Does
Security scanners generate far more findings than developers can work through, and many of them are not exploitable in practice. Fixing them by hand takes engineering time that teams rarely have, so the backlog grows with every release.
Pixee does not replace the scanners a team already runs. It sits on top of them, decides which results are real, and does the remediation work up to the point of review. A human still approves and merges every change. The same approach is applied earlier in the lifecycle too, at the design stage, where a security requirement costs least to meet.
Products
Triage And Fix (VulnOps)
VulnOps is for security and engineering teams buried under scanner output. It traces execution paths to prove which findings can actually be exploited, then turns those findings into ready-to-merge pull requests.
- Triage of SAST, SCA, DAST and secrets scanning findings
- Exploitability analysis and execution path tracing
- Convention-aware fix pull requests that pass CI before they open
- An audit trail for every finding
- An AI Scanner that looks for vulnerabilities in code directly and plans each scan from the repository’s threat model
Design-Stage Security (Foresight)
Product and architecture teams often learn about security requirements only after code is written. Foresight reviews PRDs and design specs before that point, so the fixes are cheaper.
- Extraction of explicit and implicit security promises and misuse cases
- Security requirements pushed into tickets during planning
- Drift detection between the design and the pull request, linked back to the originating spec line
- A dashboard that scores every PRD by risk
How It Works
Pixee connects to a team’s scanners, source control and CI pipeline, and learns from what reviewers do with its output. A context graph built from policies, code, exploit verification and each merge or reject decision shapes later fixes, and teams can also give feedback in plain language.
| Component | What it does |
|---|---|
| Pixee-hosted | Pixee runs the instance, and onboarding is through a GitHub App. |
| Self-hosted | The platform runs inside a customer VPC or an air-gapped environment with zero data egress, so code never leaves the customer’s perimeter. Custom model finetuning on the customer’s code is available in this mode. |
Agentic AI Capabilities
Coding Agent Plugin
Pixee ships as an installable plugin for coding agents, including Claude Code, Codex, GitHub Copilot, Copilot CLI, VS Code and Cursor. A coding agent can ask Pixee for a triage verdict and apply its patches, giving proof that agent output was actually inspected. Authentication uses a device flow with short-lived tokens, and the agent acts only within the developer’s existing Pixee permissions.
Model Choice
Foresight runs on the customer’s own model provider: Azure OpenAI, OpenAI or Anthropic.
Integrations
| Area | Integrations |
|---|---|
| Scanners | Black Duck, Checkmarx, CodeQL, Datadog, GitHub Advanced Security, JFrog Xray, Semgrep, Snyk, SonarQube, Sonatype, Veracode |
| Source control | GitHub, GitLab, Bitbucket, Azure DevOps |
| CI/CD | Jenkins, CircleCI, GitHub Actions, GitLab CI, Azure Pipelines |
| Design and ticketing | Confluence, Notion, Jira, Linear, DevRev |
Company Background
| Founded | 2023, with seed funding |
|---|---|
| Founders | Surag Patel (Co-Founder and CEO) and Arshan Dabirsiaghi (Co-Founder and CTO) |
| Investors | Decibel, Wing, TEDCO and Primeset |
| Recognition | Winner of the SantanderX competition in 2024 |
Note: This overview is compiled from Pixee’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.