ZeroPath
AI code scanner that hunts logic and auth flaws, then writes the patch
Overview
ZeroPath is an AI-native application-security platform from San Francisco that combines static analysis, dependency reachability, secrets, infrastructure-as-code, dynamic testing and pull-request reviews, and generates fixes for what it finds. Its Zero agent runs triage and remediation workflows in Slack.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 14 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- No monthly commitment
- AI-native SAST, SCA and secrets scanning
- PR reviews, autofix and CI/CD integration
- Unlimited repositories and scans
- SAST for business-logic and broken-auth flaws, SCA with reachability, secrets and IaC
- Runtime validation, PR reviews and one-click autofix
- SSO/SAML; Jira, Linear and Slack integrations
- On-prem, self-hosted or private cloud
- Bring your own LLM keys; volume discounts
- SCIM, policy engine and custom compliance reports
- Dedicated support and SLA
Use cases
What you can produce with ZeroPath
- Security reviews posted on every pull request, with inline comments
- AI-generated patches for confirmed vulnerabilities, opened as pull requests
- Full-repository SAST, reachability-aware SCA, secrets and IaC scanning across unlimited repos
- Dynamic tests that attempt to prove a finding is exploitable and verify the fix
- Custom security rules written in plain English through the policy engine
- Zero agent workflows in Slack that triage bug-bounty reports and escalate unpatched issues
- A CycloneDX AI bill of materials and an inventory of models, agents and MCP servers in the code
ASEAN Perspective
ZeroPath in Southeast Asia
ZeroPath counts HitPay — a Singapore-based fintech serving Southeast Asian merchants — among its confirmed customers, providing some proof of regional fit, particularly for fintech and crypto-native teams across SG, MY, and PH. The platform's cloud-hosted default with US-based infrastructure may be a consideration for MAS-regulated Singapore institutions or Indonesian BSSN-compliance scenarios where data residency matters. On-premises and self-hosted deployment (Enterprise tier) mitigates this but requires a custom engagement. No dedicated ASEAN sales presence or localised compliance reporting (MAS TRM, OJK, BNM) has been announced as of mid-2026, so regional procurement teams should factor in potential onboarding friction.
ZeroPath is one of the few AI code scanners with outside evidence behind it: curl's maintainer credited its reports, alongside another tool's, with a batch of confirmed fixes in 2025, and its focus on business-logic and authorisation flaws targets what rule-based scanners struggle with. Generated patches, PR reviews and the Slack-based Zero agent push it past scan-and-report.
Its headline accuracy figures are the vendor's own benchmark. Pricing is published but steep for small teams, $1,000 a month plus $60 per developer with no free plan, though startups can apply for up to 50% off. Best for engineering organisations that want fewer, better findings.
What we found
ZeroPath is a San Francisco application-security company from Y Combinator's Summer 2024 batch. Its YC listing names four founders, including chief technology officer Raphael Karger, formerly a Google security engineer, and a former Tesla red-team engineer. It launched publicly in January 2025 with a seed round led by SurgePoint Capital, joined by Y Combinator and Paul Graham; the amount was not disclosed. In 2026 it was one of ten finalists in the RSAC Innovation Sandbox contest.
The pitch is a scanner that reasons about code rather than matching patterns. The platform covers static analysis aimed at business-logic and authorisation flaws, dependency analysis that checks whether a vulnerable function is actually called, secrets and infrastructure-as-code scanning, pull-request reviews, generated fixes, dynamic testing that tries to prove a finding exploitable, container scanning and an inventory of AI components in a codebase. Zero, an agent added in May 2026, works in Slack threads to triage bug-bounty reports, open fix pull requests and chase owners. ZeroPath says it verifies exploitability before surfacing a finding, and its site claims twice as many real vulnerabilities with 75% fewer false positives; no outside audit of that benchmark was found.
The outside evidence is better than usual for the category. curl maintainer Daniel Stenberg wrote in October 2025 that the project had worked through 809 potential issues raised by ZeroPath and a second tool, Aisle, and fixed about 15% as confirmed problems. ZeroPath's Aptos Labs case study describes scanning a Rust codebase of more than a million lines and a replay-related flaw that, by ZeroPath's account, rule-based scanners missed. Its own scale figures keep rising: 200,000 scans a month across 1,000+ organisations in a March 2026 release, 300,000+ on the homepage now.
Team pricing is published: from $1,000 a month plus $60 per developer, sold through a demo, with unlimited repositories and scans. There is no free plan. Startups can apply for up to half off and security researchers for free access. No ASEAN data-residency option is published.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
Notable facts
- ZeroPath's co-founders from Tesla Red Team and Google Security started the company after growing frustrated that their own security tools generated thousands of alerts — but flagged almost no real bugs.
- ZeroPath's published benchmark shows it detected 87.5% of business logic and authentication vulnerabilities — while Snyk and Bearer detected 0% on the same test set.
- Within seven months of its January 2025 public launch, ZeroPath grew to 750+ customers and 125,000 monthly scans; by mid-2026 that had scaled to 1,000+ orgs and 300,000+ scans.
- ZeroPath was selected as a Top 10 finalist in the RSAC 2026 Innovation Sandbox — the cybersecurity industry's most-watched startup competition — just 14 months after its public launch.
Frequently asked questions
About this listing
This entry was compiled from publicly available data including ZeroPath's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with ZeroPath unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to ZeroPath directly →
Spotted something out of date? Suggest an update →
Related reading
More in Security & Safety
