Xygeni is an application security company that protects the software supply chain, from the code developers and AI assistants write to the pipelines and dependencies that turn it into running software. It is built for AppSec and DevSecOps teams that need to keep up with code shipped faster than they can review it.
Its focus is the whole path from source to release, so a vulnerable library, a leaked key or a tampered build artefact is treated as part of one supply chain problem rather than a finding in a separate tool.
At A Glance
| Vendor | Xygeni |
|---|---|
| Category | Application security, software supply chain security, ASPM |
| Identities covered | Secrets and credentials in code, pipelines, containers and repositories |
| Deployment | SaaS or on-premises, with EU-hosted and air-gapped options |
| Agentic AI | DevAI IDE agent and an MCP server layer, plus CoreAI |
| Customers | Fintonic, Adaion, bkool, metricool, arexdata |
| Investors | Investing PROFit Wisely (IPW) |
| Market classification | DevSecOps |
What Xygeni Does
Code written with AI help reaches production faster than security teams can review it, and the tools around it multiply findings. Xygeni’s answer is a single control plane across code, CI/CD, dependencies, IaC, containers and AI assets. Findings from its own scanners and from third-party tools are deduplicated and correlated, then ranked by exploitability, reachability and business impact, so teams work on what can actually be attacked. Fixes are generated automatically and checked so that an upgrade does not break the build.
Products
Application Security Testing
The scanning layer covers AI Security, SAST, SCA, DAST and API Security, plus IaC and CI/CD security for pipeline and build protection. The SAST engine pairs precise analysis with AI remediation, and SCA adds reachability, malware detection and safe dependency updates, so developers see which vulnerable libraries their code really calls.
Secrets Security
Leaked credentials are a common way into cloud accounts and pipelines. Secrets Security finds secrets in files, images and repositories, from pre-commit to production. Pre-commit and pre-push hooks block or flag commits that contain a secret, findings are prioritised by secret type, frequency, location and validity, and built-in playbooks revoke exposed keys on platforms such as AWS, Slack and GitLab.
ASPM
Application Security Posture Management gives security leaders a single risk view, an asset inventory and compliance reporting across every application and scanner. Its Dynamic Funnels do the ranking, and Remediation Risk analysis checks each proposed fix for breaking changes before it is offered.
Malware Defense, Anomaly Detection And Shield
Malware Defense stops malicious open-source packages before they enter a build, including ones with no known signature yet. A dependency firewall and real-time alerts sit alongside an ML-assisted behavioural engine that spots typosquatting, dependency confusion and hostile install scripts. Anomaly Detection and Shield sit in the same advanced threats group and watch the supply chain for unusual activity.
Build Security
Build Security proves that what was deployed is what was built. It generates SLSA attestations automatically, supports custom in-toto attestations, produces SBOMs in SPDX and CycloneDX, and uses keyless signing with ephemeral keys, with security gates in CI/CD pipelines.
How It Works
Xygeni runs as SaaS or on premises, with EU-hosted and air-gapped options, and connects to source control and CI/CD systems such as GitHub, GitLab, Jenkins and Azure DevOps. Scan results flow into the control plane, pass through correlation and ranking, and come back to developers as fixes in the IDE or as pull requests. Build evidence is collected with a minimal pipeline change and stored in whichever registry the customer chooses. Alerts and tickets go to Slack, email and Jira.
Identities And Systems Covered
| Secrets and credentials | Exposed secrets in code, pipelines, configurations, container images and repositories. |
|---|---|
| Cloud and SaaS keys | Credentials for AWS and other platforms that the revocation playbooks can rotate. |
| Signing keys | Ephemeral keys used for keyless signing, so teams do not hold long-lived signing keys. |
| AI-generated code | Output from AI coding agents such as Copilot, Junie, Cursor and Windsurf. |
Agentic AI Capabilities
DevAI
DevAI is an agent that helps engineers find and fix vulnerabilities interactively inside VS Code, IntelliJ, Cursor and Windsurf. It works through the built-in Copilot or agent chat and runs continuously as developers type, analysing only the code that changed.
MCP Server
DevAI draws on Xygeni’s MCP layer, which holds the knowledge of risk, policies and guardrails. Every detection, fix and recommendation is checked against it for risk, policy and breaking-change impact, and the same layer verifies code produced by AI coding agents. CoreAI provides risk intelligence and orchestration across the platform.
Company Background
| Leadership | Co-founders Jesús Martín (CEO) and Luis Rodríguez (Chief Security Research Officer), with Félix Álvaro Carnicero (CTO). |
|---|---|
| Funding | 4 million euros in 2023, led by Investing PROFit Wisely (IPW). |
| Recognition | Global InfoSec Awards (2024), Top Infosec Innovator Awards (2026) and DevOps Dozen finalist (2023). |
Note: This overview is compiled from Xygeni’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.