Arnica, Cycode, OX Security and Prime Security

About Cycode

Cycode is the agentic development security platform that unifies visibility, prioritization, and remediation across the software development lifecycle. Cycode says it unifies control, context, and autonomy on a single platform to find and fix risk before it reaches production. Cycode provides end-to-end controls for the AI layer of the software factory.^[5][10]

Cycode says its AI code security combines deterministic rules with AI detection and reasoning. Cycode offers proprietary Application Security Testing tools, including SAST, SCA, and IaC scanning, built natively into the platform. Cycode SAST supports a wide range of programming languages and SCMs. Language support covers Java, C#, JavaScript, PHP, Python, Ruby, and Go. SCM support covers GitHub, GitLab, BitBucket, Azure DevOps, and Gerrit. Cycode catches misconfigurations across Terraform, Kubernetes, Helm, and CloudFormation. Cycode finds container vulnerabilities and correlates them back to the root cause in code.^[5][7]

On the software supply chain side, Cycode says it scans, detects, and blocks secret exposure in code, pipelines, productivity tools, and AI assistants. Cycode says it identifies misconfigured pipelines and prevents supply chain attacks with runtime eBPF monitoring. Cycode says it detects proprietary source code exposed to the public. Cycode can ingest, generate, and manage a software bill of materials. Cycode says it auto-discovers shadow AI, coding assistants, and MCP servers across the development environment. Cycode says it enforces policy-driven control over AI tools with full AIBOM coverage.

Cycode describes the Context Intelligence Graph as a single shared graph that distills noisy alerts into risks that matter. Cycode Maestro orchestrates AI Teammates that assess exposure, analyze exploitability, and generate fixes. Cycode says its specialized agents find and fix exploitable risks 17x faster. Cycode says it combines security understanding with code-to-runtime context to determine what attackers can actually exploit. Cycode says it unifies visibility and correlates risk across the ADLC into a single, queryable view. Cycode's risk posture module integrates 120+ tools across SCMs, CI/CD, cloud, ticketing, and security tools. Cycode says teams can create dashboards aligned with their business and stakeholders.^[1][8]

The RIG is the ASPM engine behind Cycode's native security solutions and ConnectorX, providing code to cloud traceability and automating vulnerability discovery, prioritization and remediation. ConnectorX is Cycode's click and connect ASPM integration platform that lets companies use Cycode's native ASPM tools or maximize their investments in their existing AppSec tools.^[8]

Cycode customers can deploy on public cloud, or on private cloud and on-premises environments through the Cycode Enterprise Server offering. Cycode offers enterprise SaaS customers a choice between EU data residency and Global (US) data residency.

Unity replaced fragmented scanning with Cycode's converged platform and gained unified visibility across thousands of repos. Uphold standardized on Cycode to bring AST, SSCS, and ASPM under a single graph. Cycode says Solaris cut critical-vulnerability MTTR by 99.4% and triage time by 99% after deploying Cycode. theScore is a Cycode customer that uses one platform dedicated to developer security. Cycode says it helps enterprises like UBS and Elastic prove compliance and keep shipping software securely. For automotive software teams, Cycode says it supports alignment with ISO/SAE 21434 and UNECE WP.29 lifecycle requirements through automated evidence collection and real-time posture reporting.^[5][8][10]

Cycode holds ISO27001 certification and ISO/IEC 42001 certification. Cycode has completed a SOC 2 Type II audit and a CSA STAR Level 1 attestation. Lior Levy is Co-founder and CEO of Cycode. Cycode is backed by Insight Partners and YL Ventures, and the series-B company has raised $80M. Cycode lists ION Crossover Partners among its backers.^[1][8][11]

About OX Security

OX Security states a mission to create a world where software secures itself. OX says AI now writes most of the code, pulls its own dependencies and spins up its own cloud. OX describes an attack as a chain that runs from prompt to MCP server to agent to committed code to cloud and data. OX says security has to cover the whole chain, from the first prompt to production runtime.^[2][3]

OX prevents insecure code and destructive scenarios in AI coding tools with VibeSec. OX predicts risk through organization-specific context at every stage of the SDLC and remediates with AI. OX describes its platform as a unified, code first security platform that embeds detection and response across the SDLC. OX prioritizes risks that are exploitable, reachable and impactful. OX actively identifies exploitable vulnerabilities tied to specific code and API exposures.^[3][4]

OX pinpoints, investigates and eliminates code-level issues across the entire SDLC. For code that has already been written, OX Code applies a contextual SAST that prioritizes findings based on exploitability. OX supports over 100 languages and frameworks, with direct integration into developer workflows via Git-based scanning and CI/CD hooks. OX correlates static findings with runtime, environmental and business context to prioritize reachable and exploitable vulnerabilities. Code Projection is the OX capability for tracing vulnerabilities from runtime observations back to their originating source code, repository and commit. OX continuously monitors every open-source dependency and third-party component across codebase, pipelines and runtime. OX maps each open-source and third-party dependency to known CVEs and license obligations and prioritizes vulnerable components by reachability and exploitability. OX generates and maintains an SBOM in SPDX and CycloneDX formats, extended by the PBOM, to track component provenance and integrity across the CI/CD lifecycle. OX blocks malicious, hallucinated, license-violating or previously denied packages from entering a codebase or pipeline.^{[4][5][6][8][9]}

OX records the full software delivery chain for every build, capturing runner identity, build arguments, artifact signatures, environment variables and deployment targets. OX scans pipeline configurations for insecure practices including unpinned third-party actions, secrets in logs, excessive permissions and deprecated commands. OX assesses repository and organization configurations for access control gaps, branch protection weaknesses, missing code review enforcement and authentication risks. OX identifies and remediates insecure pipeline configurations, compromised runners, tampered build scripts and unauthorized artifact promotion. OX scans Terraform, Kubernetes, Helm, Dockerfile and Azure ARM and consolidates findings in one view. OX detects overly permissive IAM roles, exposed storage, weak network policies and unencrypted resources before they reach production. OX scans source code, Git history, container images and cloud assets for API keys, passwords, tokens and personally identifiable information. OX extends secrets and PII detection into AI coding environments.^{[7][8][9][10]}

OX inventories every model, MCP server, IDE extension, agent skill and hook in an AI dev stack with continuous risk monitoring. OX enforces policy directly against AI BOM components in real time, blocking unapproved or risky elements before the codebase is impacted. OX scans, flags and quarantines risky AI agent skills before they can propagate malicious or problematic instructions across development workflows. OX VibeSec operates as a security layer above individual IDEs and gives AppSec teams centralized control, cross-SDLC context and consistent policy enforcement. OX is built to integrate with an existing pipeline, embedding into IDEs and AI coding assistants and connecting to CI/CD systems. OX developer tool controls provide a single control plane for enforcing AI coding guardrails across multiple tools and environments.^{[1][2][3][4][5][9][10][11][12]}

About Prime Security

Prime Security sells an AI security review platform designed for software development lifecycles. Prime Agents learn an organisation's architecture, code and risk history. Prime Security describes one platform covering the SDLC before the code, in the code and after the code. Prime agents work autonomously inside the customer environment, mapping every application, policy, resource and data flow. Prime agents live inside the development lifecycle and understand designs, code, cloud and policies.^[1][2][3][4]

Prime Security says AI agents, multiple stacks and complex development processes have created an attack surface that no existing security tool was built to handle. Prime Security states its aim as connecting architecture, code and cloud to find every exploitable attack vector before attackers do. Prime tracks every asset as it moves from design to deployment. Prime learns an organisation's architecture, past decisions and risk profile, and each review builds on the last one.^[3][4][5]

Autonomous design reviews use AI agents to review specs, architecture and data flows to uncover security risks before code is written. Prime checks every design, scores every risk and validates every fix in code. Prime can produce a threat model, and Prime combines design-level analysis with actual code. Prime Security covers architecture reviews, threat modeling, documentation analysis, and security analysis tied to tickets and code changes. Prime finds vulnerabilities and logic flaws in AI-generated and human-written code. Prime checks every PR the moment it opens, whether a developer or an agent wrote it. Prime checks each pull request for approved auth flows, encryption methods, architecture patterns and framework requirements. Prime reviews every PR against the policies that apply to that repo, validates each finding and hands the agent the context to fix it. Prime logs every review, finding, validation and fix.^{[1][2][3][4][6]}

Prime sets security guardrails for agents like Cursor and Claude Code, catching insecure code at the PR before it merges. Prime Security embeds security policies directly into AI coding workflows. Prime inventories every package in the dependency graph, direct and transitive, and matches it against known CVEs and the license policy. Prime identifies vulnerable packages accessible to attackers with proven attack paths. Exploitable findings arrive with the full attack path, and unreachable ones arrive marked as noise, with the reasoning attached. Prime checks every dependency against the license policy in the same scan. Prime runs continuous attack path analysis with source, architecture and controls. Prime maps how services talk, where data flows and how an attacker would chain it all together. Prime evaluates multi-step attacks the way an attacker plans them.^[1][3][4][7]

Prime delivers a tailored fix wherever the work happens, with the PR, Slack or a Jira ticket for developers. For dev agents, Prime delivers context over MCP, so mitigation runs with no human in the loop. Prime proposes mitigations built for the codebase, delivers them to developers and agents and validates the fix landed in code. Agents run continuously across planning and development workflows without requiring custom engineering from the customer team. Prime integrates with Github, Gitlab, Claude Code, Cursor, Jira, Confluence, Google Drive, Azure DevOps, Linear, and Git Issues.^[2][3][4]

Prime Security supports Product Security Engineers and Security Architects. MX adopted Prime Security. MX is a financial data platform that powers secure data access, analytics, and personalized money experiences for banks, fintechs, and financial institutions. Oscar Health adopted Agentic Security Architect from Prime to automate security reviews and proactively identify risk across all engineering work. Oscar Health is a healthcare technology company that combines digital experiences with health insurance services. ThoughtSpot adopted Agentic Security Architect from Prime to scale security reviews and threat modeling across its expanding engineering surface area. ThoughtSpot is an analytics platform that enables organizations to explore, analyze, and act on data at scale.^{[1][4][8][9][10]}