depthfirst pairs deep context on your applications and systems with autonomous agents that continuously discover, fix, and prevent security risks. Always-on defense, from code to production.
Coverage
A connected security platform across every step of the software lifecycle to detect, validate and remediate security issues, and prevent new risks.
Context
Tie your code to your runtime and infrastructure, to accurately pinpoint real risk and track it through resolution.
AI research
Our in-house lab turns research into better ways to find and fix vulnerabilities.
depthfirst builds a deep understanding of your infrastructure, code, and business logic and creates a threat model, which informs security analysis and decisions across the platform.
depthfirst blocks malicious packages before they’re installed and reviews every pull request before it’s merged, helping prevent vulnerabilities and other security risks from entering your systems.
depthfirst identifies vulnerabilities in your codebase, assesses your exposure to vulnerabilities in third-party dependencies, and discovers vulnerabilities in running applications through penetration testing.
depthfirst validates code findings against running applications to identify exploitable vulnerabilities. It also generates ready-to-merge fixes and creates pull requests for the engineers responsible for the code.
depthfirst replays the original attack to verify that the vulnerability has been resolved after a fix is merged.
depthfirst maps how your code, dependencies, infrastructure, and secrets connect in production, understands your organizational context, design docs and threat model so every product judges each finding against how your system actually runs.
Find real vulnerabilities by tracing business logic, data flows, and cross-service interactions across your codebase.
depthfirst reasons about business logic and cross-service data flows the way a security engineer does, so the only findings you see are the ones that are genuinely exploitable.
Confirm which vulnerabilities are exploitable by testing your running application with real attack paths.
depthfirst attacks your running applications continuously, proving at runtime which vulnerabilities are actually exploitable and re-testing every fix after merge.
Detect malicious behavior before it spreads through your environment.
Trace risk through your full dependency tree and surface only the vulnerabilities with a real execution path to them.
depthfirst traces every dependency to the code that actually calls it, so you fix the handful of vulnerabilities with a real path into your application instead of the whole SBOM.
Detect and validate credentials across your codebase, CI/CD pipelines, and runtime environments.
“Our teams use the entire depthfirst suite. We have Dependency Firewall, PR reviews, code reviews, and Agentic Pentesting. That was what brought me to depthfirst: it covers the full cycle.”
dfbench: detection
Recall
Cost per task
dfbench: validation
Precision
Recall
dfbench: differential analysis
Macro recall
Cost per task
| | ||||||||
|---|---|---|---|---|---|---|---|---|
| Thinking | Application | Low level | Smart contract | Single repo | Multi-repo | |||
| dfs-large1 | — | $6.77 | 62.2% | 66.5% | 42.4% | 62.3% | 63% | 52.6% |
| GPT 5.6 Sol | xhigh | $43.37 | 65.7% | 67.1% | 67.3% | 60.7% | 66.3% | 57.9% |
| GPT 5.6 Sol | high | $26.47 | 59.6% | 62.8% | 62.3% | 49.2% | 63.3% | 10.5% |
| GPT 5.6 Sol | med | $9.51 | 48.9% | 54.2% | 38.5% | 44.3% | 50.6% | 26.3% |
| GPT 5.6 Luna | xhigh | $2.53 | 52.4% | 56.8% | 45.1% | 47.5% | 53.2% | 42.1% |
| GPT 5.6 Luna | high | $1.57 | 39.6% | 48.4% | 23.1% | 31.1% | 40.2% | 31.6% |
| GPT 5.6 Luna | med | $0.69 | 28% | 31.6% | 15.4% | 29.5% | 29.3% | 10.5% |
| Opus 5 | high | $22.66 | 45.4% | 54.8% | 34.1% | 31.1% | 47% | 26.3% |
| Opus 5 | med | $21.89 | 47.8% | 45.8% | 57.7% | 44.3% | 48.2% | 42.1% |
| Opus 5.5 | high | $8.42 | 54.9% | 60.9% | — | 48.2% | 57.2% | 31.3% |
| Opus 5.5 | med | $7.66 | 48.1% | 57.5% | — | 35.9% | 49.7% | 31.6% |
| Grok 4.5 | high | $7.70 | 57.2% | 59.1% | 51.6% | 0% | 59.9% | 25% |
| Grok 4.7 | xhigh | $19.94 | 59.0% | 68.4% | 42.1% | 53.9% | 61.4% | 20% |
| Grok 4.7 | high | $16.02 | 56.6% | 68.4% | 15.8% | 55.1% | 57.7% | 40% |
| Kimi K3 | max | $9.10 | 48% | 31.8% | 31.8% | 30.4% | 49.8% | 34.8% |
| Kimi K3 | high | $6.22 | 46.7% | 48.4% | 51.8% | 37.9% | 48.5% | 31.6% |
| Qwen 3.8 | max | $7.91 | 40.8% | 40.8% | 40.8% | 40.8% | 40.8% | 40.8% |
| GLM 5.2 | xhigh | $9.72 | 40.7% | 34.8% | 22.4% | 44.3% | 43.4% | 20.9% |
| GLM 5.2 | high | $4.09 | 38.2% | 42.6% | 11.1% | 44.3% | 42.2% | 36.8% |
| DeepSeek v4 Flash | max | $1.23 | 31.8% | 27.6% | 29.5% | 45.9% | 32.9% | 26.3% |
| DeepSeek v4 Flash | high | $1.03 | 30.1% | 30.1% | 30.1% | 30.1% | 31.9% | 8.3% |
| Gemini 3.6 Flash | high | $7.44 | 20.9% | 19.4% | 11.5% | 32.8% | 20.9% | 21.1% |
| Mythos 5* | — | $99.19 | 69% | 70.8% | 61.4% | 71% | 70.4% | 50% |
| Gemini 3.8 Flash | high | $8.03 | 44.2% | 50.6% | 17.3% | 50.8% | 44.8% | 36.3% |
| Muse Spark 1.3 | xhigh | $10.24 | 47.4% | 55.5% | 32% | 39.3% | 48.6% | 31.6% |
| DeepSeek v4.1 Flash | high | $1.69 | 57.3% | 64.1% | 54.5% | 48.9% | 58.5% | 42.1% |
| GPT 6 Luna | xhigh | $0.43 | 45.7% | 50% | 40.4% | 39.3% | 46.4% | 36.8% |
| GPT 6 Luna | high | $0.28 | 38.1% | 43.9% | 25% | 34.4% | 39.4% | 21.1% |
| GPT 6 Luna | med | $0.15 | 37.3% | 40.6% | 26.9% | 37.7% | 38.6% | 21.1% |
| GPT 6 Sol | xhigh | $13.30 | 59.3% | 61.9% | 51.9% | 59% | 59.4% | 57.9% |
| GPT 6 Sol | high | $6.45 | 57.7% | 58.7% | 56.9% | 55.7% | 58.9% | 42.1% |
| GPT 6 Sol | med | $3.43 | 49.6% | 48.4% | 51.9% | 50.8% | 50.2% | 42.1% |
| MiMo-v2.6 Flash | — | $0.86 | 53.5% | 54.9% | 47.9% | 55.3% | 54.3% | 28.6% |
| MiMo-v2.6 Pro | — | $1.38 | 55% | 58.6% | 38.9% | 59.8% | — | — |
These results will be updated as new models and harnesses are released.
* Run with Claude Security.
| | ||||
|---|---|---|---|---|
| Thinking | F1 | |||
| dfs-large1 | — | $6.77 | 18.3% | 28.3% |
| GPT 5.6 Sol | xhigh | $43.37 | 18% | 28.3% |
| GPT 5.6 Sol | high | $26.47 | 22.3% | 32.5% |
| GPT 5.6 Sol | med | $9.51 | 24.6% | 32.7% |
| GPT 5.6 Luna | xhigh | $2.53 | 23.2% | 32.2% |
| GPT 5.6 Luna | high | $1.57 | 24.8% | 30.5% |
| GPT 5.6 Luna | med | $0.69 | 27.3% | 27.6% |
| Opus 5 | high | $22.66 | 39.4% | 42.2% |
| Opus 5 | med | $21.89 | 40.5% | 43.8% |
| Opus 5.5 | high | $8.42 | 48.5% | 51.5% |
| Opus 5.5 | med | $7.66 | 44.2% | 46.1% |
| Grok 4.5 | high | $7.70 | 29.5% | 38.9% |
| Grok 4.7 | xhigh | $19.94 | 23.9% | 34.0% |
| Grok 4.7 | high | $16.02 | 30.5% | 39.7% |
| Kimi K3 | max | $9.10 | 30.1% | 37.0% |
| Kimi K3 | high | $6.22 | 33.3% | 38.9% |
| Qwen 3.8 | max | $7.91 | 29.6% | 34.3% |
| GLM 5.2 | xhigh | $9.72 | 28.6% | 33.6% |
| GLM 5.2 | high | $4.09 | 30.8% | 34.1% |
| DeepSeek v4 Flash | max | $1.23 | 24.8% | 27.9% |
| DeepSeek v4 Flash | high | $1.03 | 26.8% | 28.4% |
| Gemini 3.6 Flash | high | $7.44 | 43.5% | 28.2% |
| Mythos 5* | — | $99.19 | 24.5% | 36.2% |
| Gemini 3.8 Flash | high | $8.03 | 41.4% | 42.8% |
| Muse Spark 1.3 | xhigh | $10.24 | 34.1% | 39.7% |
| DeepSeek v4.1 Flash | high | $1.69 | 36.4% | 44.5% |
| GPT 6 Luna | xhigh | $0.43 | 21.8% | 29.5% |
| GPT 6 Luna | high | $0.28 | 24.5% | 29.8% |
| GPT 6 Luna | med | $0.15 | 33.3% | 35.2% |
| GPT 6 Sol | xhigh | $13.30 | 15.7% | 24.8% |
| GPT 6 Sol | high | $6.45 | 18.9% | 28.5% |
| GPT 6 Sol | med | $3.43 | 22.6% | 31.1% |
| MiMo-v2.6 Flash | — | $0.86 | 24.4% | 33.5% |
| MiMo-v2.6 Pro | — | $1.38 | 18.1% | 27.2% |
These results will be updated as new models and harnesses are released.
* Run with Claude Security.
| | ||||||
|---|---|---|---|---|---|---|
| Thinking | NEW | KEPT | CLOSED | |||
| dfs-large1 | — | $1.34 | 75.6% | 45.8% | 95% | 86% |
| GPT 5.6 Sol | xhigh | $10.67 | 75.3% | 46.8% | 95% | 84.1% |
| GPT 5.6 Sol | high | $5.46 | 76.3% | 45.6% | 94.4% | 88.9% |
| GPT 5.6 Sol | med | $2.32 | 74.4% | 39.2% | 93.3% | 90.7% |
| GPT 5.6 Luna | xhigh | $0.62 | 71% | 38.9% | 89.3% | 84.8% |
| GPT 5.6 Luna | high | $0.30 | 71.3% | 32.5% | 92.4% | 89.1% |
| GPT 5.6 Luna | med | $0.13 | 65.1% | 22.2% | 79.2% | 94% |
| Opus 5 | high | $7.41 | 70.3% | 38.2% | 79.8% | 92.8% |
| Opus 5 | med | $5.48 | 71.3% | 37.4% | 83.8% | 92.8% |
| Opus 5.5 | high | $1.78 | 79.5% | 66.7% | 86.8% | 85.2% |
| Opus 5.5 | med | $1.34 | 75.3% | 47.7% | 91.5% | 86.8% |
| Grok 4.5 | high | $3.38 | 65.1% | 39.9% | 74.5% | 80.9% |
| Grok 4.7 | xhigh | $6.56 | 74.8% | 51.2% | 90.5% | 82.6% |
| Grok 4.7 | high | $6.46 | 70.3% | 43.9% | 86.3% | 80.8% |
| Kimi K3 | max | $6.34 | 60.3% | 35.5% | 72% | 73.4% |
| Kimi K3 | high | $4.18 | 60.1% | 31.4% | 75.3% | 73.5% |
| Qwen 3.8 | max | $2.99 | 72.7% | 33.6% | 95% | 89.6% |
| GLM 5.2 | xhigh | $2.04 | 61.4% | 25.5% | 85.6% | 73% |
| GLM 5.2 | high | $1.56 | 58.6% | 25.3% | 76.4% | 74.1% |
| DeepSeek v4 Flash | max | $0.79 | 66.8% | 28.4% | 83% | 89% |
| DeepSeek v4 Flash | high | $0.55 | 67.4% | 27.1% | 88.1% | 87% |
| Gemini 3.6 Flash | high | $1.51 | 61% | 18.3% | 68.9% | 96.5% |
| Mythos 5* | — | — | — | — | — | — |
| Gemini 3.8 Flash | high | $1.57 | 63.8% | 32% | 66.3% | 93.1% |
| Muse Spark 1.3 | xhigh | $3.12 | 72.8% | 47.1% | 85.1% | 86.2% |
| DeepSeek v4.1 Flash | high | $0.71 | 70.1% | 48.5% | 67.5% | 94.2% |
| GPT 6 Luna | xhigh | $0.12 | 72.1% | 44.4% | 89% | 82.9% |
| GPT 6 Luna | high | $0.09 | 72.4% | 45.8% | 91.2% | 80.1% |
| GPT 6 Luna | med | $0.07 | 69.5% | 36.1% | 87.4% | 85% |
| GPT 6 Sol | xhigh | $3.90 | 75.2% | 58.3% | 92.9% | 74.5% |
| GPT 6 Sol | high | $2.06 | 76.3% | 61.8% | 92% | 75% |
| GPT 6 Sol | med | $1.00 | 71.6% | 52.8% | 86.3% | 75.9% |
| MiMo-v2.6 Flash | — | $0.08 | 72.7% | 38.7% | 89.9% | 89.5% |
| MiMo-v2.6 Pro | — | $0.12 | 76.5% | 55.6% | 92.8% | 81.3% |
These results will be updated as new models and harnesses are released.
* Run with Claude Security.
Set policy once. Every scan, fix, and agent action inherits it automatically.
Every finding, decision, and fix lives in one place: searchable, exportable, audit-ready.
See who did what, when, and why. Every human and agent action is logged, immutable, and traceable.
Give teams exactly the access they need. No more, no less. Scoped by repo, environment, or org.
Independently audited. Your data handled the way your security team demands.
Bring your own key. Your data stays encrypted under your control, not ours.
