Other
Dec 2025ZeroPath said it detected a real attacker probing its scan infrastructure; the company described the activity as unsuccessful but publicly discussed it as a security incident shaping later research.
SourceAutomatically find and fix your software vulnerabilities
Company research
Public company, workplace, funding, and market signals
Overview
ZeroPath is a 2024-founded, San Francisco-based AI-native application security company that uses AI plus AST/taint analysis to find, verify, and auto-fix real vulnerabilities—especially business-logic and authorization flaws—while reducing false positives and speeding remediation.
Primary product
AI-native AppSec / SAST platform
Founded
2024
Headquarters
San Francisco, California, United States
Team size
1-10
Work style
Flexible
Industry
Computer and Network Security
Sub-industry
Application Security / AI-native SAST
Business model
B2B SaaS
Subscription software
Enterprise software
Funding
Stage
Seed
Total raised
$12.5M
Latest round
Seed · Feb 2026
Latest amount
$5M
People & investors
Leadership
Co-Founder & CEO
Co-Founder & CTO
Co-Founder & COO
Co-Founder
Vice President Marketing
Work & culture
Small, founder-led, high-ownership team with a research-heavy, fast-moving engineering culture; the company emphasizes deep security analysis, direct customer interaction, and shipping quickly with strong autonomy.
Work style
Flexible
Compensation
Publicly described as offering a strong base salary plus meaningful equity; no public salary bands were found.
Benefits
Competitive base salary
Meaningful equity
Full health coverage
Dental coverage
Vision coverage
Product & market
Pricing
Team plan starts at $1,000/month plus $60 per developer per month; Enterprise is custom-priced; a usage-based credits plan is coming soon.
Differentiators
- —AI-native SAST that focuses on real exploitable vulnerabilities rather than pattern matches
- —Business-logic and authorization flaw detection
- —Exploitability validation to suppress false positives
- —One-click AI-generated patches / autofix
- —Repository-context-aware validation
- —Natural-language policy engine
- —Unifies SAST, SCA, secrets, IaC, PR reviews, and threat modeling
- —Fast setup with minimal configuration and developer-friendly workflows
Technology
SvelteKit
Python
PostgreSQL
Prisma
tRPC
Datadog
Pino
PostHog
Kubernetes
Pulumi
AWS
GCP
GitHub
GitLab
Bitbucket
Azure DevOps
Slack
Linear
Customers
Aptos Labs
Commenda
NetSPI
MESH
HitPay
Aquanow
Riskified
Thoropass
GYG
Stacksync
Risotto
Dust
Competitors
Semgrep
Snyk
Checkmarx
SonarQube
Veracode
Fortify
Synopsys
Aikido
Scale & contact
Estimated revenue
≈$5M estimated ARR
Estimated monthly visits
41.2K
Traffic estimate as of Jan 2026
Signals & risks
Latest news
ZeroPath Blog · Jun 2026
ZeroPath reported that repository context cut candidate issues by 71-76% across two repositories without losing any high-severity bugs.
ZeroPath Blog · Jun 2026
ZeroPath introduced automatic threat modeling for every application it identifies, using the model to evaluate changes at the agent, pull request, and repository levels.
Morningstar / Business Wire · May 2026
ZeroPath announced Zero, a persistent AI agent for AppSec that works inside tools like Slack and manages workflows, escalation, and remediation as part of its broader platform expansion.
ZeroPath Blog · Mar 2026
Case study describing how Aptos Labs used ZeroPath to scale security scanning across a large Rust codebase, customize rules, and save 20+ hours per week.
ZeroPath Blog · Feb 2026
Case study showing ZeroPath helping Commenda surface more real vulnerabilities, including business-logic bugs, without adding dedicated security headcount.
Jobs and careers at ZeroPath
0 jobs at ZeroPath
No open positions
Check back later for new openings