ZeroPath
AI-native, agentic AppSec platform that unifies SAST, SCA, secrets, IaC and DAST to find, verify and auto-fix exploitable vulnerabilities.
By ZeroPath · 4.0/5 Value-Position score (estimate)
Positioning guardrails
Best for
- Engineering and AppSec teams that need AI-native SAST/SCA with business-logic and broken-auth detection and far fewer false positives.
- Security teams that want findings validated for exploitability and remediated through AI-generated autofix pull requests.
- Organizations consolidating code, dependency, secrets, IaC, container and runtime scanning, plus AI/MCP inventory and AI-BOM, in one platform.
- Security-sensitive buyers that need on-prem, self-hosted or private-cloud deployment and their own LLM keys.
Ideal size: 20–200 developers people · Scale-up to enterprise with an AppSec owner and CI/CD in place
Not for
- Solo developers or very small teams with no security budget: no free tier is published and the Team plan starts at $1,000/mo.
- US public-sector buyers that require FedRAMP authorization; no FedRAMP claim is published.
- Teams expecting a managed penetration-testing or vCISO consulting service rather than a scanning platform.
- Buyers who want a zero-touch dependency scanner with no policy, triage or repo-context configuration.
Value metrics scorecard
Time-to-Value
Under a week to first scan
~7 days to first production value
Total Cost of Ownership
$48,000/yr
Starts at $12,000 · Team: from $1,000/mo plus $60 per developer (unlimited repos and scans); Enterprise custom-priced; usage-based credit plan listed as 'coming soon'
Implementation Friction
2/5
Engineering + admin effort required
Value-Position score
out of 5 · model estimate
Full cost breakdown
Mandatory implementation fee
None
Seat tiers
Team billed per developer (~$60/dev) on top of a $1,000/mo base, unlimited repositories and scans; Enterprise custom with volume discounts
Add-on costs
- Credit-based pay-per-scan plan listed as 'coming soon' (usage-based)
Company & support
Who is behind ZeroPath, and how your team gets help once it is live.
Company
- Founded
- Not recorded
- Headquarters
- Not recorded
How you get support
- PhoneNot listed
- EmailNot listed
- Live chatNot listed
- Support portal / ticketsNot listed
- Community forumPlan not stated
- Help centre / docsPlan not stated
- Dedicated account managerEnterprise only
- In person / on-siteNot listed
- Hours
- Not recorded
- Response time
- 24-hour response time for support requests; priority support and SLA for enterprise customers
Docs point to documentation, a Discord community and a support team; pricing lists Dedicated Support & SLA on Enterprise only. Security and data-export requests go to security@ and privacy@ addresses.
“Not listed” means the vendor’s public pages don’t mention that channel, not that it is unavailable. Ask about it during evaluation.
Market position
Where ZeroPath sits against its closest alternatives. Pick any two of cost, speed, friction and buyer score, and up to 9 companies to compare.
Quadrant view
Typical annual cost × Time-to-value
The lines cross at the median of the solutions shown, so about half sit on each side of each line. A dashed ring marks an outlier pinned to the edge; hover for its value.
Companies on the chart 6 / 10
- ZeroPath
- Semgrep
- SonarQube
- Pebl
- Corgea
- LegalSifter
Add or change companies
Up to 10 companies including ZeroPath. Listed closest first.
Stack fit signal
Compatibility with standard B2B ecosystems.
Ships an official MCP server. Connects to Claude Code, Claude Desktop, ChatGPT connectors and Cursor out of the box.
AI & MCP readiness
What ZeroPath ships in AI, and what it asks of your ecosystem.
AI features shipped
Sources describe AI-native SAST, an AI agent ('Zero') that triages reports and builds security sprints, AI-generated autofix patches, AI-powered risk scoring and prioritisation, custom rules written in natural language, and AI inventory plus CycloneDX AI-BOM for models, agents and MCP servers.
Your data & models
- Trains on your data
- Not recorded — ask the vendor
- Runs on
- OpenAI, Anthropic
- AI pricing
- Included in the plan
In your ecosystem
- AI connection
- Official MCP server
- Model key
- Bring your own key
- AI usage audit
- Not recorded
Compliance attestations
* IAPP AIGP certifies individuals, not products. It means named staff hold the credential — not that the platform does.
Bottom line
ZeroPath is an AI-native, agentic AppSec platform: SAST, SCA with reachability, secrets, IaC, container and DAST scanning, PR reviews and one-click AI autofix, plus AI model/agent/MCP inventory and AI-BOM. It sells zero-config onboarding, exploitability validation and about 90% noise reduction, with SOC 2 Type II and GDPR claims. Team starts at $1,000/mo plus $60 per developer with unlimited repos; Enterprise adds self-hosted deployment, BYOK keys, SCIM and a support SLA.
Frequently asked questions
How is ZeroPath priced?
The Team plan starts from $1,000/mo plus $60 per developer and includes unlimited repositories, scans and PR scans, SSO/SAML and Jira, Linear and Slack integrations. Enterprise is custom-priced and adds on-prem/self-hosted or private-cloud deployment, BYOK LLM keys, SCIM, dedicated support with SLA, custom rules and volume discounts. A usage-based credit plan is listed as 'coming soon'.
What does ZeroPath actually scan?
The platform covers AI-native SAST across 15+ languages, SCA with reachability analysis, secrets detection with validation, IaC scanning (Terraform, Kubernetes, Docker, CloudFormation), container image scanning, DAST with exploit proof and fix verification, continuous pull-request reviews, and AI inventory/AI-BOM for models, agents and MCP servers. Findings sync to Jira, Linear and Slack and can be auto-fixed via generated patches.
Is our code used to train AI models?
No. The ZeroPath trust centre states that enterprise agreements with its model providers (including OpenAI and Anthropic) prohibit training on customer data, retaining customer inputs beyond processing, and using customer code for model improvement, and that proprietary code is never used to train or improve AI models. Source code is retained for 30 days in isolated per-scan containers and then automatically deleted.
Can ZeroPath be self-hosted?
Yes, on the Enterprise plan. ZeroPath offers on-prem, self-hosted and private-cloud deployment, or deployment into your own AWS, Azure or GCP account, in which case your code never leaves your environment. Enterprise also includes BYOK (bring your own LLM keys), SCIM provisioning, custom compliance reports and controls over data retention, managed through Pulumi infrastructure-as-code.
What compliance certifications does ZeroPath hold?
The trust centre claims SOC 2 Type II certification and full GDPR compliance, annual third-party penetration tests, an active vulnerability disclosure programme and AWS US-West hosting with AES-256 encryption at rest and TLS 1.3 in transit. ISO 27001, HIPAA, FedRAMP and ISO 42001 are not claimed, so buyers with those mandates must validate compensating controls or self-hosted deployment.