OX Security introduced Active ASPM, moving past passive aggregation to autonomous posture management. VibeSec, their AI-driven security agent, continuously enforces security policies within CI/CD pipelines.
Their Pipeline Bill of Materials (PBOM) tracks full software lineage from code to deployment.
The company also created the OSC&R framework in collaboration with security experts from Google, Microsoft, and GitLab — an ATT&CK-like model for describing software supply chain threats.
What is OX Security?
Most ASPM platforms collect vulnerabilities and display them. OX Security goes further by actively monitoring the development pipeline and blocking risky deployments before they reach production.
OX Security reports up to 97% reduction in security debt for organizations using the platform.
What are OX Security’s key features?
Active ASPM
The “active” part distinguishes OX Security from most competitors:
| Action | How it works |
|---|---|
| Real-time monitoring | Watches pipeline activity and detects policy violations as they occur |
| Deployment blocking | Prevents risky builds from reaching production based on configurable policies |
| Automated remediation | Triggers fix workflows and routes findings to the right teams |
| Anomaly detection | Alerts on unusual pipeline behavior that could indicate compromise |
Pipeline Bill of Materials
PBOM captures the full software delivery chain:
| What PBOM records | Why it matters |
|---|---|
| Source code components and dependencies | Standard SBOM coverage |
| Build pipeline configurations | Detect pipeline injection risks |
| CI/CD tool versions and plugins | Track build environment integrity |
| Artifact signatures and checksums | Verify artifact provenance |
| Deployment targets and configurations | Map what runs where |
| Developer and approver identities | Audit trail for compliance |
This record supports incident investigation, compliance evidence, and supply chain attack detection.
No-code workflows
OX Security has a visual workflow builder for security automation:
| Feature | Description |
|---|---|
| Drag-and-drop policies | Create security rules without writing code |
| Conditional logic | Build complex decision trees for different scenarios |
| Integration actions | Trigger Jira tickets, Slack alerts, or custom webhooks |
| Approval gates | Require manual sign-off for sensitive operations |
| Audit trails | Full history of every workflow execution and outcome |
OSC&R framework
The Open Software Supply Chain Attack Reference provides structured taxonomy for supply chain threats:
| Category | Examples |
|---|---|
| Compromise vectors | Source code, build systems, dependencies |
| Attack techniques | Typosquatting, dependency confusion, pipeline injection |
| Detection strategies | Behavioral analysis, integrity checking, provenance verification |
| Mitigation controls | Code signing, pipeline hardening, dependency pinning |
Security teams use OSC&R to assess their defenses against known attack patterns.
Compliance support
OX Security maps findings and controls to major frameworks:
| Framework | Coverage |
|---|---|
| EU Cyber Resilience Act | SBOM/PBOM generation, vulnerability tracking |
| CISA SSDF | Secure development lifecycle evidence |
| NIST 800-53 | Security control documentation |
| SOC 2 | Security monitoring and incident response |
| FedRAMP | Continuous monitoring requirements |
How much does OX Security cost?
OX Security does not publish list pricing on ox.security — every commercial tier sits behind a “request a demo” or “contact sales” form, which is the standard pattern for enterprise ASPM. Plan on a custom annual contract sized by repository count, pipeline count, and connected cloud accounts.
The platform is sold as an enterprise SaaS SKU; smaller-team or Pro-level options are not surfaced publicly on ox.security/pricing at the time of this update. Standard enterprise tier features (SSO, role-based access control, audit trails, SOC 2) are included rather than sold as add-ons. Verify tier shape and any per-pipeline or per-repo dimension with the vendor at evaluation.
OX Security vs alternatives
If OX Security does not fit your stack, four ASPM platforms cover overlapping ground.
- Legit Security — The closest direct competitor; Legit publishes its own Legit vs OX Security comparison page. Legit leans into AI-developed-code guardrails (VibeGuard) and enterprise-SDLC mapping; OX leans into Active ASPM with deployment blocking and PBOM-style supply chain provenance.
- Apiiro — Better fit if you want a Gartner ASPM Magic Quadrant Leader with a Risk Graph, AutoFix Agent, and AI-prompt guardrails. Apiiro is more mature on prioritization than OX and lighter on pipeline-blocking enforcement.
- Cycode — Better fit if you want native scanning (SAST/SCA/secrets/container) plus ASPM correlation in one platform. Cycode’s supply chain depth (CI/CD security, source code leakage detection) overlaps with OX’s PBOM angle.
- Phoenix Security — Better fit if you want ACPM (Application and Cloud Posture Management) framing with strong reachability analysis and explicit risk-based budgeting rather than deployment blocking.
For a wider sweep, the ASPM hub lists every active platform alongside OX.
OX Security funding and history
OX Security was founded in 2021 in Tel Aviv by Neatsun Ziv and Lior Arzi. In May 2025, the company raised a $60 million Series B led by DTCP, bringing total funding to roughly $94 million across rounds. Customers cited at the time of the Series B announcement included a mix of Fortune 500 and SaaS companies. The OSC&R framework (Open Software Supply Chain Attack Reference) was published in collaboration with Google, Microsoft, and GitLab security teams and remains an active open-source project at oscar.io.
OX Security FAQ
What is PBOM? Pipeline Bill of Materials — OX Security’s extension of the standard SBOM concept to the build pipeline itself. PBOM records source components, pipeline configurations, CI/CD tool versions, artifact signatures, deployment targets, and developer/approver identities. SBOM tells you what is in the artifact; PBOM tells you how the artifact got built.
What is the OSC&R framework? Open Software Supply Chain Attack Reference — an ATT&CK-style structured taxonomy for software supply chain threats. OX Security helped create OSC&R in collaboration with Google, Microsoft, and GitLab to give security teams a shared vocabulary for compromise vectors, attack techniques, detection strategies, and mitigation controls.
When was OX Security founded? 2021, in Tel Aviv, by Neatsun Ziv and Lior Arzi.
Who is the CEO of OX Security? Neatsun Ziv, who co-founded the company.
What does “Active ASPM” mean? Active ASPM monitors pipeline activity in real time and takes action — blocking risky deployments based on policy, triggering scans on high-risk changes, and routing findings to the right teams automatically. Traditional (passive) ASPM aggregates findings into a dashboard but does not enforce gates.
What does OX Security integrate with?
GitHub
GitLab
Bitbucket
Azure Repos
GitHub Actions
GitLab CI
Jenkins
CircleCI
Azure Pipelines
AWS
Azure
GCP
Kubernetes
TerraformHow do I get started with OX Security?
When to use OX Security
OX Security makes sense when passive ASPM isn’t enough.
If vulnerabilities keep reaching production despite detection, if you need supply chain visibility beyond standard SBOM, or if compliance mandates (EU CRA, CISA guidelines) require build provenance, OX Security’s active approach fills those gaps.
If you mainly need vulnerability aggregation without pipeline enforcement, ArmorCode or DefectDojo are simpler options.
If you want built-in scanning rather than pipeline governance, Aikido or Jit take that approach.
