incl. 5 contributors
/month · $2.160 billed annually
Loading
/month · $2.160 billed annually
Custom
| Funcionalidad | Free Start Free | Team Start Free | Business Start Free | Enterprise Contact us |
|---|---|---|---|---|
| SAST | ||||
| SAST | Incluido | Incluido | Incluido | Incluido |
| AI Triage | No incluido | Incluido | Incluido | Incluido |
| AI-generated remediation suggestions | No incluido | Incluido | Incluido | Incluido |
| AI attack path explanations | No incluido | Incluido | Incluido | Incluido |
| Malicious Code Detection in proprietary application | No incluido | No incluido | No incluido | Incluido |
| SCA | ||||
| Open source vulnerability (Detection, blocking, and alerting) | Incluido | Incluido | Incluido | Incluido |
| License and Obsolescence Management | Incluido | Incluido | Incluido | Incluido |
| Pipeline and issue tracker integrations | Incluido | Incluido | Incluido | Incluido |
| Real-time Malware in OS Packages (Early Detection, alerting, and immediate dependency firewalling) | Incluido | Incluido | Incluido | Incluido |
| AI Triage | No incluido | Incluido | Incluido | Incluido |
| Auto-remediation | No incluido | Incluido | Incluido | Incluido |
| Reachability | No incluido | Incluido | Incluido | Incluido |
| Exploitability | No incluido | Incluido | Incluido | Incluido |
| Advanced Prioritization | No incluido | Incluido | Incluido | Incluido |
| SBOM and VDR On-Demand Generation | No incluido | Incluido | Incluido | Incluido |
| Containers support | No incluido | Incluido | Incluido | Incluido |
| IDE Plugin (DevAI) | ||||
| Real-time IDE vulnerability detection | Incluido | Incluido | Incluido | Incluido |
| Secure AI-generated code validation | Incluido | Incluido | Incluido | Incluido |
| Incremental SAST scanning while coding | No incluido | Incluido | Incluido | Incluido |
| AI-generated remediation suggestions | No incluido | Incluido | Incluido | Incluido |
| AI attack path explanations | No incluido | Incluido | Incluido | Incluido |
| Guardrails pre-validation before commit | No incluido | Incluido | Incluido | Incluido |
| Secrets Security | ||||
| Secrets Leakage Detection, blocking, and alerting | Incluido | Incluido | Incluido | Incluido |
| Source code, Infrastructure-as-Code, Docker images,... | Incluido | Incluido | Incluido | Incluido |
| Scan in Historical Information | Incluido | Incluido | Incluido | Incluido |
| Multi-SCM support (GitHub, Azure Repos, GitLab, Bitbucket) | Incluido | Incluido | Incluido | Incluido |
| Issue management with ticketing tracker integrations | Incluido | Incluido | Incluido | Incluido |
| Pre-Commit Hooks | Incluido | Incluido | Incluido | Incluido |
| Automated Continuous DevOps Security Scanning | Incluido | Incluido | Incluido | Incluido |
| AI Triage | No incluido | Incluido | Incluido | Incluido |
| Advanced Prioritization | No incluido | Incluido | Incluido | Incluido |
| Auto-revocation | No incluido | Incluido | Incluido | Incluido |
| CI/CD Security | ||||
| Advanced Prioritization | No incluido | Incluido | Incluido | Incluido |
| Pipeline and issue tracker integrations | No incluido | Incluido | Incluido | Incluido |
| Remediation Guidance | No incluido | Incluido | Incluido | Incluido |
| Context-Driven Security Insights | No incluido | Incluido | Incluido | Incluido |
| Pipeline vulnerabilities detection | No incluido | Incluido | Incluido | Incluido |
| CI/CD Infrastructure Misconfigurations Identification | No incluido | Incluido | Incluido | Incluido |
| Pre-Commit Hooks | No incluido | Incluido | Incluido | Incluido |
| AI Triage | No incluido | Incluido | Incluido | Incluido |
| Malicious Command Detection in Pipelines | No incluido | No incluido | Incluido | Incluido |
| Infrastructure As Code Security | ||||
| Advanced Prioritization | No incluido | Incluido | Incluido | Incluido |
| Pipeline and issue tracker integrations | No incluido | Incluido | Incluido | Incluido |
| Remediation Guidance | No incluido | Incluido | Incluido | Incluido |
| Context-Driven Security Insights | No incluido | Incluido | Incluido | Incluido |
| Support for Terraform, CloudFormation: ARM and Bicep, Ansible | No incluido | Incluido | Incluido | Incluido |
| Pre-Commit Hooks | No incluido | Incluido | Incluido | Incluido |
| Support for Multi-Framework / AWS and Azure, Kubernetes and Docker. | No incluido | Incluido | Incluido | Incluido |
| AI Triage | No incluido | Incluido | Incluido | Incluido |
| Malicious Command Detection in IaC | No incluido | No incluido | Incluido | Incluido |
| Application Security Posture Management (ASPM) | ||||
| Full SDLC Assets visibility | No incluido | Incluido | Incluido | Incluido |
| Full Security Context from Code to Cloud | No incluido | Incluido | Incluido | Incluido |
| Context-Driven Security Insights | No incluido | Incluido | Incluido | Incluido |
| Advanced Prioritization and Remediation | No incluido | Incluido | Incluido | Incluido |
| Advanced Security Audit Trails | No incluido | Incluido | Incluido | Incluido |
| Third Party Tools Integration (SAST, SCA, Secrets, and others) | No incluido | No incluido | No incluido | Incluido |
| Advanced Correlation and Security Insights | No incluido | No incluido | No incluido | Incluido |
| Complete Application Risk Management | No incluido | No incluido | No incluido | Incluido |
| DAST | ||||
| Automated dynamic application scanning | No incluido | No incluido | No incluido | Incluido |
| Runtime vulnerability detection | No incluido | No incluido | No incluido | Incluido |
| API and web attack simulation | No incluido | No incluido | No incluido | Incluido |
| Continuous validation of exposed services | No incluido | No incluido | No incluido | Incluido |
| AI Triage | No incluido | No incluido | No incluido | Incluido |
| Risk-aware reporting & prioritization | No incluido | No incluido | No incluido | Incluido |
| CI/CD pipeline integration | No incluido | No incluido | No incluido | Incluido |
| Code Quality | ||||
| Code quality analysis (code smells, complexity, maintainability, dead code, duplication, naming conventions) | No incluido | No incluido | No incluido | Incluido |
| Multi-language quality rules (Java, JavaScript, Python, PHP, C#, Go, HTML, Swift, Kotlin) | No incluido | No incluido | No incluido | Incluido |
| Dedicated Quality section in the web platform | No incluido | No incluido | No incluido | Incluido |
| Quality policies (detector configuration, custom severity, rule grouping) | No incluido | No incluido | No incluido | Incluido |
| Quality guardrails & CI/CD quality gates | No incluido | No incluido | No incluido | Incluido |
| AI Triage for quality findings | No incluido | No incluido | No incluido | Incluido |
| AI Remediation for quality findings | No incluido | No incluido | No incluido | Incluido |
| API Security | ||||
| Automatic discovery of every API endpoint (from code and OpenAPI specs) | No incluido | No incluido | No incluido | Incluido |
| Detection of exposed and unauthenticated endpoints | No incluido | No incluido | No incluido | Incluido |
| Broken authorization & access-control detection (BOLA / BFLA) | No incluido | No incluido | No incluido | Incluido |
| Sensitive data exposure detection (PII / PCI / PHI in requests & responses) | No incluido | No incluido | No incluido | Incluido |
| Shadow, zombie & deprecated API detection | No incluido | No incluido | No incluido | Incluido |
| CI/CD-native gating for API risks | No incluido | No incluido | No incluido | Incluido |
| AI Triage for API findings * | No incluido | No incluido | No incluido | Incluido |
| Anomalies Detection | ||||
| Behavior-Based Risks Detection | No incluido | No incluido | No incluido | Incluido |
| Continuous Monitoring | No incluido | No incluido | No incluido | Incluido |
| Alert Anomalies in Real-Time | No incluido | No incluido | No incluido | Incluido |
| Block Code Tampering | No incluido | No incluido | No incluido | Incluido |
| Customizable anomaly rule sets | No incluido | No incluido | No incluido | Incluido |
| Build Security | ||||
| SLSA Provenance Generation | No incluido | No incluido | No incluido | Incluido |
| Build Attestation Generation | No incluido | No incluido | No incluido | Incluido |
| Build Integrity Verification | No incluido | No incluido | No incluido | Incluido |
| Artifact Signature Verification | No incluido | No incluido | No incluido | Incluido |
| Software Artifact Tampering Detection | No incluido | No incluido | No incluido | Incluido |
| Xygeni Platform | ||||
| Integrations (See all) | Incluido | Incluido | Incluido | Incluido |
| Customer User Roles | Incluido | Incluido | Incluido | Incluido |
| Policy Management | Incluido | Incluido | Incluido | Incluido |
| Projects Tags | Incluido | Incluido | Incluido | Incluido |
| Policy Customization | No incluido | Incluido | Incluido | Incluido |
| SDLC Inventory | No incluido | Incluido | Incluido | Incluido |
| SDLC Asset Graph | No incluido | Incluido | Incluido | Incluido |
| SSC Compliance (CIS, OpenSSF, and more) | No incluido | No incluido | Incluido | Incluido |
| Governance | No incluido | No incluido | No incluido | Incluido |
| DevOps Health Check | No incluido | No incluido | No incluido | Incluido |
| SSO: SAML, OKTA | No incluido | No incluido | No incluido | Incluido |
| Rich API | No incluido | No incluido | No incluido | Incluido |
* Coming soon.
Xygeni counts each contributor that has made at least one commit to a repository scanned within the past 90 days. There is no limit to the number of commits per identifier.
A scan in Xygeni contains a comprehensive set of security analyses, including SAST, dependency analysis, inventory, secrets detection, SCA, IaC security, and malware detection.
A scan applies the full set of analyses associated with your plan’s products.
No. Xygeni doesn’t upload your source code to scan it. The scan is executed locally into your network infrastructure and no code is uploaded to Xygeni servers. Only the results are uploaded (duly protected during transit and in storage)
In case you use the auto-remediation functionality Xygeni will upload the file to change but then it will be removed from our systems immediately after the change.
Yes. Xygeni offers preloaded projects so you can view examples of different security vulnerabilities without scanning your code.
Of course, the Xygeni scanner can connect to your repos but also works over a file system folder. You just need to specify where the source code is: either in a local folder or into an external git repository.
No, a credit card isn’t required to sign up for the Free Account. There are no hidden fees or automatic enrollments. You can continue using the app with no time limits. Upgrade whenever you’re ready to unlock additional features and capabilities, giving you time to choose the plan that best fits your needs.
You can cancel or downgrade your subscription anytime. You’ll keep access to the Xygeni plan features you’ve already paid for until the end of your current billing period, and any changes will take effect at the start of the next billing cycle.
Yes, you can upgrade your plan anytime through any of Xygeni’s available purchase channels.
Xygeni’s AI operations run on credits. A credit represents a set of LLM tokens, so you pay for what you actually use, not a fixed price per action. All AI-powered operations consume credits: AI Autofix, AI Triage, and AI attack path explanations.
Consumption is usage-based, not a flat rate per action. It scales with the size of the code analyzed and the amount of context the operation needs, so a small fix uses fewer credits than a large, context-heavy one.
AI operations pause until credits are available again. You can buy additional credits whenever you need them, or raise your monthly credit allowance.
Yes. Triage, Autofix, and explanations can run on third-party findings (for example, ingested through ASPM), as long as Xygeni has the access it needs. This is usually a repository access token with the right permissions. Setup is documented at https://docs.xygeni.io.
If you bring your own LLM, AI operations do not consume Xygeni credits. Contact info@xygeni.io to evaluate the options that fit your setup.
