ZeroPath is an AI-native SAST and application security suite that uses large language models instead of traditional pattern-matching rules. It targets the vulnerabilities classic scanners miss — business logic flaws, broken authentication, and authorization bypasses.
The platform scans repositories top-down with zero configuration and no build scripts, verifies that findings are actually exploitable, and generates working patches.
ZeroPath was named to the RSAC 2026 Innovation Sandbox Top 10 and reports running 300k+ scans per month for customers ranging from startups to Fortune 500 companies.
ZeroPath traces a finding from source to sink and scores it, here an IDOR in a Go ticket-store handler.
What Is ZeroPath?
ZeroPath is an end-to-end, AI-native code security suite. Where traditional SAST applies deterministic rules and data-flow analysis, ZeroPath uses LLMs to reason about code intent and context.
That difference is what lets it surface logic-level vulnerabilities — broken access control, auth bypasses, and business logic flaws — that pattern matchers struggle to detect.
| Capability | Details |
|---|---|
| Core engine | AI-native SAST built on large language models |
| Standout detections | Business logic flaws, broken auth, authorization bypass |
| Suite coverage | SAST, SCA, secrets, IaC, DAST, container scanning, PR reviews |
| AI inventory | AI, agent, and MCP mapping plus a CycloneDX AI-BOM |
| Remediation | Exploitability verification + AI-generated patches |
| Setup | Zero config, no build scripts required |
| Recognition | RSAC 2026 Innovation Sandbox Top 10 |
| Scale | 300k+ scans per month; Fortune 500 customers |
What are ZeroPath’s key features?
AI-native vulnerability detection
ZeroPath’s engine reasons about code rather than matching fixed patterns. It is built to find the issues that require understanding intent — authorization checks that are missing, logic that can be abused, and authentication flows that can be bypassed.
This is the category gap it targets: deterministic scanners are strong on injection-class bugs but weak on logic-level flaws, which is where ZeroPath focuses.
Exploitability verification
Before reporting a finding, ZeroPath attempts to confirm it is actually exploitable. This filtering is central to its low-noise positioning — practitioners, including curl maintainer Daniel Stenberg, have publicly noted a low false-positive rate.
The vendor reports that adding plain-language repository context cut candidate findings by 71 to 76 percent across two test repositories, with no high-severity bugs lost.
SAST Autofix
Rather than only flagging a problem, ZeroPath generates working patches for the vulnerabilities it finds. Continuous pull request reviews bring the same analysis into the development flow, and an AI assistant called Zero helps triage findings and plan remediation.
The zeropath-ai bot opens a merge-ready pull request with the fix and a summary of the vulnerability it patched.
End-to-end suite
Beyond SAST, ZeroPath covers SCA with reachability awareness, secrets detection across 40+ file types, IaC misconfiguration scanning, container image scanning, and dynamic testing.
It also inventories AI models, agents, and MCP servers across a codebase and generates a CycloneDX AI-BOM, with a policy engine and risk management that syncs to Jira, Linear, and ServiceNow.
Proven on hardened open-source code
ZeroPath has surfaced confirmed CVEs in some of the most scrutinized open-source projects, including curl, Linux, OpenSSL, OpenVPN, FFmpeg, and sudo. Finding novel issues in code this heavily audited is a meaningful signal of detection depth.
Case studies report concrete outcomes: Aptos Labs used ZeroPath to scale security across 1M+ lines of Rust and 70 engineers, citing roughly 8x faster vulnerability discovery and 20+ hours saved per week.
What does ZeroPath cost?
ZeroPath publishes pricing on its website. The Team plan starts at $1,000 per month plus $60 per developer and includes unlimited repositories and scans, SAST, SCA with reachability, secrets, IaC, runtime validation, PR reviews, and autofix.
An Enterprise plan adds on-prem or private-cloud deployment, bring-your-own-key model support, SCIM, the policy engine, and custom compliance reports at custom pricing. A usage-based Credits plan is listed as coming soon, and startups and independent security researchers can apply for discounted or free access.
When to use ZeroPath
ZeroPath fits teams whose biggest gap is logic-level vulnerabilities — the broken-auth and business-logic flaws that traditional SAST cannot reach.
It also suits teams drowning in scanner noise, since exploitability verification and AI triage are designed to surface only what matters. For a broader comparison, see the SAST tools category and the Checkmarx alternatives roundup.
For teams that prefer deterministic, rule-based engines they can audit and extend, a tool like Semgrep or CodeQL remains the more transparent choice.