ZeroPath

ZeroPath classifies 17 kinds of AI components in existing scans, including LLM SDKs, agent frameworks, MCP servers, model files, and prompt configs, with no added LLM cost.

The company generates a CycloneDX AI-BOM for each repository, covering the models, datasets, agents, and AI SDKs its software ships.

Scan built container images for OS-package and bundled-dependency vulnerabilities. Per-layer findings, measured base-image upgrade guidance, private-registry and air-gapped support, and scheduled monitoring, unified with SAST and SCA under ZeroPath.

The only SAST that thinks like an attacker. Find authentication bypasses, IDORs, and logic bugs that pattern-based tools miss. Automatically evolves to detect new threats. 75% fewer false positives.

A short review of CVE-2026-20266, a critical OS command injection vulnerability in the Splunk AI Toolkit's btool configuration helper that allows admin role users to execute arbitrary commands on the underlying host.

Traditional SAST buries teams in false positives because it can't see how an app runs in production. Adding repository context — plain-language facts about deployment, trust boundaries, and authentication — cut candidate issues 71-76% across two repositories, with zero high-severity bugs lost.

ZeroPath pricing starts at $1,000 per month plus $60 per developer.

ZeroPath uses AI-powered SAST to find and fix broken authentication, logic bugs, outdated dependencies, and other issues.

AI-native SAST that finds 2x more vulnerabilities with 75% fewer false positives. Automated security for modern DevOps teams.

The page explains how ZeroPath collects, uses, and protects data.

The page presents ZeroPath’s terms and conditions for using its services.