TestifySec is a software supply chain security and compliance company. It gives engineering and compliance teams signed proof of how software was built and tested, whether the code was written by developers or by AI agents, and it blocks changes that arrive without that proof.
As agents take on more of the coding, teams can no longer review every step by hand. TestifySec lets them keep the same standards by making evidence, not trust in the author, the condition for code entering a repository.
At A Glance
| Vendor | TestifySec |
|---|---|
| Category | Software supply chain evidence and repository gating |
| Deployment | Hosted, or a customer operated software appliance |
| Agentic AI | Agent enrolment and an agent sandbox for agent written code |
| Customers | Autodesk, Lockheed Martin, GDIT, Carahsoft |
| Standards | in-toto |
| Market classification | DevSecOps |
What TestifySec Does
Auditors and security teams want to know that a release went through the required builds, tests and scans, and that nobody skipped a step. TestifySec records that work as signed evidence while it happens, checks the evidence against policy at the moment code is pushed, and links the results to compliance controls. A team keeps its existing build, test and scanning tools, because the evidence is captured around the commands it already runs rather than through a new pipeline. The same rules apply to a human developer and to an AI agent.
Products
CI/lock
CI/lock is enterprise attestation tooling built on in-toto. It produces signed attestations from the builds, tests and scans a pipeline already runs, with attestors that let a team choose exactly what is recorded. Attestations can be verified against a policy and uploaded to the TestifySec platform. Quickstarts cover GitHub Actions and GitLab CI.
Pushgate
Pushgate is a gate in front of the repository that requires evidence before a push is accepted. It checks signatures and commit bindings, then accepts or refuses the push; a refusal comes with a reason and the next step to fix it. AI agents are enrolled when a repository is set up, so their pushes face the same evidence requirements as a developer’s, and a dedicated agent sandbox defines the boundary around agent execution.
TestifySec Platform
The platform is where products, repositories, policies, gates and evidence are managed together, including gates across many repositories. A check library supplies the requirements assigned to each repository, and test results, recovery tests, remediation checks and configuration checks are connected to compliance controls. Evidence can be mapped to FedRAMP, NIST 800-53, SOC 2, ISO 27001 and the EU CRA, and teams can keep their documents in a separate GRC system if they prefer.
Open Source Tooling
TestifySec works with the open source projects Witness and Archivista for recording and storing supply chain evidence. Autodesk adopted Witness for its own software supply chain evidence.
How It Works
Evidence moves through five steps. A developer or agent runs a workflow and CI/lock captures observations. Those observations become signed evidence, stored where a verifier can retrieve it. The platform evaluates the evidence against the selected policy release, Pushgate enforces the decision at the Git push boundary, and an accepted push is forwarded to the upstream Git host. Delivery to the host is recorded separately, because accepting a push does not by itself prove it arrived.
Upload authority and signing authority are kept separate, and each policy is identified by an immutable version, so a gate always applies a known release. Self-hosting customers run the platform as a software appliance in their own environment, with their own trusted roots, signing services and evidence storage. Signatures establish attribution and integrity under that trust model; as TestifySec puts it, “A valid signature cannot make a false statement true”, so the trusted collector itself must stay outside an agent’s control.
Company Background
| Expertise | The team includes in-toto maintainers, a co-author of NIST SP 800-204D and contributors to a CNCF supply chain whitepaper. |
|---|---|
| Self-hosting | Offered for regulated environments through the software appliance. |
| Open source | Projects published in the testifysec GitHub organisation. |
Note: This overview is compiled from TestifySec’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.