ZeroPath is an application security company that helps engineering and security teams find and fix exploitable vulnerabilities across code, cloud and runtime. Its scanner is built around large language models, which lets it reason about what code is meant to do and catch flaws such as business logic bugs and authentication bypasses that rule-based tools tend to miss.
It is meant for teams that want fewer, better findings and want them fixed, so a finding can move from detection to a ready pull request in one workflow.
At A Glance
| Vendor | ZeroPath |
|---|---|
| Category | AI-native application security (SAST, SCA, secrets, IaC, DAST) |
| Identities covered | Secrets and credentials in code |
| Deployment | Hosted service on AWS, with CLI, IDE plugins and REST API |
| Agentic AI | LLM-based detection, AI Inventory, AI-BOM, MCP server, Zero agent |
| Customers | Aptos Labs, NetSPI, Riskified, Aquanow |
What ZeroPath Does
Traditional static analysis matches code against rules, which produces many false positives and misses flaws that depend on intent. ZeroPath was built from scratch around LLMs rather than adding AI on top of a rule engine. Models, combined with AST analysis, understand code context and developer intent, and they check each potential vulnerability before it is flagged, which cuts false positives and surfaces deeper issues.
Each scan is steered by a threat model of the application that admins can review and edit, so triage, validation and prioritisation reflect how the application is really used. The other testing types feed into the same policy, risk and fix workflow.
Products
SAST And PR Reviews
The SAST engine performs AI-native static analysis across more than 15 languages, looking for logic bugs as well as conventional security flaws. PR Reviews run diff-focused scans on every pull request and post inline comments and check statuses, so developers see issues before they merge.
SAST Autofix
Autofix uses the same models to write code patches for detected vulnerabilities and opens pull requests automatically, leaving developers to review the change rather than write it.
SCA
Dependency scanning adds reachability and exploit intelligence from CISA KEV and FIRST EPSS, so teams can focus on vulnerable packages that are reachable and actively exploited. It also tracks licence compliance in the SBOM.
Secret Detection, IaC Security And Container Scanning
Secret Detection finds exposed credentials and checks whether they are valid. IaC Security catches infrastructure misconfigurations before deployment, and Container Scanning checks built images for vulnerabilities.
Dynamic Testing
The DAST product discovers live applications, confirms whether an issue can be exploited at runtime and verifies that a fix works.
Policy Engine And Risk Management
Security teams write custom rules in natural language with the Policy Engine, and track vulnerabilities and trends over time with Risk Management analytics.
How It Works
ZeroPath connects to source repositories and scans the code in its hosted service, with results flowing back to pull requests, tickets and downstream tools.
| Component | What it does |
|---|---|
| CLI | Teams scan locally or from CI/CD and export results as SARIF for any downstream tool. |
| API and SDK | A REST API and an official TypeScript SDK support custom integrations. |
| Hosting | The service runs in the AWS US-West-2 region. |
| Data handling | Code is kept for 30 days to support patch generation, Q&A and quick re-scans, then deleted. Customer code is never used to train or improve AI models. |
Identities And Systems Covered
| Secrets | Credentials exposed in code, found and validated. |
|---|---|
| AI components | The AI parts of an application, inventoried from its code. |
| Code and infrastructure | Application code, dependencies, IaC and container images. |
Agentic AI Capabilities
| AI Inventory and AI-BOM | AI Inventory discovers AI components in code across 17 component kinds, and AI-BOM turns the results into a CycloneDX bill of materials covering models, datasets, agents and AI SDKs. |
|---|---|
| MCP server | The ZeroPath MCP Server connects the platform to AI coding assistants such as Claude and Cursor. |
| Zero agent | Announced in May 2026, Zero is an AI agent designed to run an entire application security programme, learning from the organisation’s policies and prior decisions and acting on them rather than only reporting. |
Integrations
| Area | Integrations |
|---|---|
| Source control | GitHub, GitLab, Bitbucket, Azure DevOps Services, Gerrit |
| Ticketing and chat | Jira, Linear, Slack |
| Security tools | Security Compass |
Company Background
| Founded | June 2024, in Y Combinator’s S24 batch. |
|---|---|
| Headquarters | San Francisco, United States. |
| Leadership | Dean Valentine, Co-Founder and CEO; Raphael Karger, Co-Founder and CTO; Nathan Hrncirik, Co-Founder. |
| Funding | Seed round led by SurgePoint Capital, with Y Combinator taking part. |
| Recognition | Selected as a finalist in the RSAC 2026 Innovation Sandbox. |
| Security | SOC 2 Type II. |
Note: This overview is compiled from ZeroPath’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.