depthfirst

Overview

X

depthfirst is an AI-native security platform positioned as the operating system for modern security. Through its autonomous security command center (Platform), it unifies code review, supply chain analysis, secret leak prevention, penetration testing, and a dependency firewall into a single system, helping security teams discover and address threats at every stage of the software development lifecycle. ### Core Capabilities - **Code**: Finds code vulnerabilities that traditional scanners miss, delivers context-aware code reviews, and provides directly applicable fix suggestions within PRs. - **Supply Chain**: Focuses on the actual reachability of dependencies, not just their presence. - **Secrets**: Blocks secrets and sensitive data from leaking before they leave the repository. - **Agentic Pentesting**: Runs automated penetration tests against live code to uncover runtime vulnerabilities. - **Dependency Firewall**: Detects malicious behavior before it spreads through your environment, with support for on-device deployment. ### Workflow The depthfirst workflow forms a complete loop: prevention at the source, single-system integration, discovery of real vulnerabilities, exploitability validation, confident remediation, and retesting. The platform tracks context across multiple scans, refining detection results over time. ### Research & Benchmarking The team has built AI agents specifically for security and released the dfbench v1 cybersecurity benchmark along with the dfs-large1 model to evaluate how frontier models and agent systems perform in vulnerability detection, validation, and diff analysis. Their research covers real-world cases such as GitLab RCE and FFmpeg zero-day vulnerabilities. ### Who It's For Ideal for product security teams and information security leaders who need full-lifecycle coverage and want to reduce security engineering overhead. Security teams at companies like AngelList, Supabase, Persona, and Moveworks already use the platform.

Q&A

What is depthfirst?AI-generated

depthfirst is an AI-native security platform covering code, dependencies, infrastructure, and runtime environments, delivering end-to-end capabilities from vulnerability discovery and validation to remediation.

What does Dependency Firewall do?AI-generated

Dependency Firewall detects malicious behavior before it spreads through your environment and supports on-device deployment.

What is Agentic Pentesting?AI-generated

Agentic Pentesting is a depthfirst feature that runs automated penetration tests against live code to uncover runtime vulnerabilities.

What is dfbench?AI-generated

dfbench is a cybersecurity benchmark (v1) released by depthfirst to evaluate how frontier models and agent systems perform in vulnerability detection, validation, and diff analysis.

How does the PR reviewer help developers?AI-generated

The PR reviewer not only finds code flaws and complex threats but also suggests specific code changes that developers can apply directly within the pull request.

Which companies use depthfirst?AI-generated

Customers mentioned include the security teams at AngelList, Supabase, Persona, and Moveworks by ServiceNow.