ZeroPath
ZeroPath is an application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime.
What ZeroPath is
ZeroPath is an application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime. Its tools include static and software composition analysis, secrets and infrastructure-as-code scanning, pull request reviews, policy management, dynamic and container scanning, AI inventory, and AI-BOM generation. Static analysis targets business logic and authentication issues such as IDOR vulnerabilities, race conditions, and authorization bypasses. ZeroPath says its SAST and SCA assess whether vulnerable dependencies can be reached and exploited in an application. The SAST product lists support for 15+ languages and average pull request scans under 60 seconds. Native version control integrations include GitHub, GitLab, Bitbucket, and Azure DevOps; Jira and Linear support two-way issue sync, and Slack and email can receive alerts. The company lists SOC 2 Type II certification, GDPR compliance, and annual external penetration tests. Source code is retained for 30 days for patch generation, Q&A, and rescanning, then automatically deleted. On-premises deployment can run in a customer's AWS, Azure, or GCP account.
Good
- Scans code, dependencies, secrets, and infrastructure-as-code.
- SAST lists support for 15+ languages.
- Integrates with GitHub, GitLab, Bitbucket, and Azure DevOps.
- On-premises deployment can run in a customer's cloud account.
- Source code is automatically deleted after 30 days.
Watch out
- There is no free plan.
- Enterprise pricing is custom.
- Source code is retained for 30 days.
Who it suits
ZeroPath is positioned for engineering teams shipping quickly and for organizations with advanced security needs. Its deployment options and scanning coverage may suit teams looking to analyze code and related application risks.
Verdict
ZeroPath combines multiple security scanning and review tools with source-control and issue-tracking integrations. Team pricing starts with a monthly base plus a per-developer charge, while Enterprise pricing is custom.
Plans and prices
From ZeroPath's own pricing page, checked 3 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Team | $1,000 a month | Unlimited repositories & scans · SAST, SCA, secrets & IaC scanning · runtime validation · PR reviews & autofix · SSO/SAML · Jira, Linear & Slack · Starting from $1,000/mo + $60/dev |
| Credits | Priced on request | Pay per scan · no monthly commitment · AI-native SAST, SCA & secrets scanning · PR reviews & autofix · CI/CD integration · Usage-based; Coming soon |
| Enterprise | Priced on request | Everything in Team · on-prem/self-hosted/private cloud · BYOK · volume discounts · dedicated support & SLA · SCIM · policy engine · custom compliance reports · Custom |
The facts
Each one read from ZeroPath's own pages, with the date it was checked.
What it does
- AI data handling
- ZeroPath says its agreements with OpenAI and Anthropic prohibit training on customer data or retaining customer inputs beyond processing.checked 3 Oct 2026
- Code retention
- The Trust Center says source code is retained for 30 days for patch generation, Q&A, and rescanning, then automatically deleted.checked 3 Oct 2026
- Dependency analysis
- ZeroPath says its SAST and SCA assess whether vulnerable dependencies are reachable and exploitable in the application.checked 3 Oct 2026
- Deployment
- On-premises deployment can run in a customer's AWS, Azure, or GCP account, where the company says code never leaves the customer's environment.checked 3 Oct 2026
- Intended users
- The pricing page positions Team for engineering teams shipping quickly and Enterprise for organizations with advanced needs.checked 3 Oct 2026
- Languages and speed
- The SAST page lists support for 15+ languages and says average pull request scans take under 60 seconds.checked 3 Oct 2026
- Purpose
- ZeroPath describes itself as an AI-native application security platform for finding and fixing exploitable vulnerabilities across code, cloud, and runtime.checked 3 Oct 2026
- SAST findings
- The SAST product targets business logic and authentication flaws, including IDOR vulnerabilities, race conditions, and authorization bypasses.checked 3 Oct 2026
- Security certification
- The Trust Center states that ZeroPath is SOC 2 Type II certified and GDPR compliant, and undergoes annual external penetration tests.checked 3 Oct 2026
- Security coverage
- Its product stack includes SAST, SCA, secrets scanning, IaC scanning, PR reviews, policy management, DAST, container scanning, AI inventory, and AI-BOM generation.checked 3 Oct 2026
- Source control integrations
- Native version control integrations include GitHub, GitLab, Bitbucket, and Azure DevOps, with Gerrit and CVS also listed on the site.checked 3 Oct 2026
- Support
- The Trust Center states a 24-hour response time for support requests and says priority support is available to enterprise customers.checked 3 Oct 2026
- Workflow integrations
- ZeroPath lists Jira and Linear two-way issue sync, Slack and email alerts, and imports from Snyk, Semgrep, Checkmarx, SonarQube, Veracode, Fortify, and Synopsys.checked 3 Oct 2026
The company
- Headquarters
- 2261 Market Street, STE 10797, San Francisco, CA 94114, United Stateschecked 28 Sep 2026
Alternatives to ZeroPath
- 1
Mondoo CSPM
Free planOpen sourceWebAPIExtensionLinux7.7Free plan - 2
Grype
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.4Free plan - 3
Sysdig Secure
WebAPILinuxmacOS7.2From $20 a month - 4
Alibaba Cloud Container Registry
Free planWebAPILinuxWindows7.1Free plan - 5
Trivy
Free planLinuxmacOSSelf-hostedWindows7.0Free plan - 6
RapidFort
Free planWebLinuxSelf-hosted6.4Free plan