Depthfirst

Name: Depthfirst
Brand: depthfirst

AI NativeLeader

Depthfirst General Security Intelligence (GSI) is an AI-native application security and vulnerability management platform that discovers vulnerabilities across code, dependencies, containers, and runtime behavior, reduces false positives using repository and runtime context and exploitability reasoning, and provides remediation guidance including code suggestions and automated pull-request proposals.

Est 2024|Valuation $591M|Raised $120M|6 Ref Customers

LinkedIn 5K|Web traffic 45K|FTEs 25|HQ San Francisco, CA

MarketsApplication Security Testing (AST)Code Security

Published Oct 2, 2026

01Common complaints

- Independent verification of security claims (precision/recall benchmarks, third-party evaluations) is required prior to purchase; many public vendor claims lack detailed methodology. - Publicly documented compliance artifacts (SOC 2 Type II, ISO certificates) are required for procurement today; these were not clearly available in public materials reviewed. - Transparent, self-serve pricing or month-to-month contracts are necessary; depthfirst appears to be sales-led and defaults to annual invoicing. - The environment is air-gapped or subject to strict data residency controls that prevent SaaS-based analysis of source code. - Existing toolchains already provide the required SCA/SAST coverage and the incremental benefit would be limited.

Deal disqualifiers (poor fit)

Organizations that cannot allow a third-party SaaS vendor to analyze proprietary source code.
Teams that require publicly documented SOC 2/ISO certifications before procurement.
Small teams that require self-serve pricing and month-to-month commitments.

Publicly acknowledged limitations

The vendor's terms acknowledge that AI outputs may be inaccurate or insufficient and that customers must review and adopt code changes themselves.

Roadmap signals

Secrets support was announced as a public preview, indicating the feature set is evolving and certain capabilities may still be maturing.

Scale limitations

Public documentation did not include technical limits such as maximum repository counts, LOC limits, or scan frequency caps; these appear to be negotiated via Order Forms.

API limitations / integration constraints

The vendor indicates API access for flexibility, but public developer documentation was not found in accessible sources reviewed.

02Why they buy

Unique selling points supported by available evidence (reported by vendor or customers)

Context-aware vulnerability identification across code and infrastructure, as presented in vendor materials.
A PR review workflow that proposes remediation suggestions.
Vendor-stated metrics related to signal-to-noise improvement and suggestion acceptance rates (these are vendor-cited and lack independently published methodology in public sources).

Where competitors may have advantages

Larger ecosystem integrations, broader language coverage, and longer product maturity.
More visible third-party validation in the form of peer reviews, analyst coverage, and compliance artifacts.

03Field reports

Depthfirst publishes multiple customer stories. These are vendor-selected narratives and are not independently verified in this report.

What is available publicly vs. missing

Depthfirst is a recently launched vendor and, at the time of this research, traditional review platforms contained limited or no accessible user review volume for the product. - **Gartner Peer Insights:** No publicly accessible product review page for depthfirst was found during queries executed for this report; Gartner pages are frequently gated. - **G2 / TrustRadius / Capterra:** No definitive product listing with user reviews was identified in accessible searches for this report. Available public feedback is primarily vendor-published case studies, press coverage quoting vendor or customer statements, and limited social posts announcing product milestones.

Representative vendor-cited customer statements (neutral summary)

- One customer stated that depthfirst reduced a portion of their security-engineering workload and characterized the product's assistance as similar to an experienced product-security engineer. - Another customer reported that depthfirst's PR reviewer provided concrete code suggestions and that the tooling integrated into their existing review workflows, leading to faster remediation in that deployment. - A third customer reported increased code-security coverage and that a substantial portion of agent recommendations had been addressed in their deployment. These statements are vendor- or customer-published and have not been independently verified for this report.

Negative reviews (publicly accessible)

No direct 1–2 star user reviews were accessible on major review platforms during this research. The likely negative vectors (derived from vendor terms and common buyer concerns) are noted in the "Critical Analysis & Common Complaints" section.

Common "why they chose it" themes (from vendor case studies and positioning)

The vendor positions the product as generating fewer low-value alerts compared to legacy scanners.
The product is presented as able to identify complex vulnerabilities and logic flaws that span code and infrastructure boundaries.
Vendor materials emphasize remediation via PR suggestions and code changes.
Vendor case studies highlight fast initial onboarding in select customer deployments.

Common "why some might leave" themes (inferred; not directly evidenced by public churn reviews)

Potential churn drivers (derived from common AppSec buyer experience) include: - AI-generated recommendations not trusted or producing excessive false positives in practice. - Perceived coverage or depth gaps relative to best-of-breed, single-purpose tools. - Unclear pricing or enterprise minimums. - Data governance constraints that prevent sharing source code with a SaaS vendor. Note: These churn reasons are not confirmed by public user churn statements for depthfirst; they reflect common patterns in the AppSec market.

1) Developer-focused platform — reported increased coverage and addressed recommendations

Reported results: The vendor-cited case study states an increase in code-security coverage and that a majority of agent recommendations were addressed.
Critical evaluation: "Security coverage" is not explicitly defined in public materials. Outcomes are vendor-published and no third-party audit was identified.

2) Enterprise automation provider — onboarding and workflow integration

Reported implementation: The case study describes onboarding by granting permissions to a repository integration and connecting artifact registries.
Critical evaluation: The described workflow indicates integration maturity for some customers, but approval processes and risk review in regulated enterprises may be more time-consuming.

3) Recruitment marketplace — efficiency and noise-reduction claims

Reported outcomes: The vendor-cited material describes efficiency gains and reduced noise in the customer environment.
Critical evaluation: These are useful operational anecdotes but lack independently published measurement details.

04Best fit

Company sizes

Likely best fit:

Mid-market to enterprise organizations (mid-sized to large organization) with substantial engineering investment.
Security teams that operate baseline scanning tools and need improved prioritization and remediation workflows.

Industries

Best aligned where software delivery is core:

SaaS / cloud software
Fintech (subject to procurement constraints)
Developer platforms

Roles/personas

Economic buyer: CISO / VP Security / Head of Product Security
Champion: AppSec lead, DevSecOps lead
End users: software engineers receiving PR feedback and security engineers triaging findings

"Great fit" qualification criteria

Many repositories and services with complex authentication and data flows.
Significant backlog or noise from existing scanners.
Appetite for automation and PR-based remediation workflows.

05The pitch

What the product does (objective value proposition)

Depthfirst is an AI-native application security and vulnerability management platform marketed as General Security Intelligence (GSI). The platform uses AI agents that connect to code repositories and related artifacts to: - Discover vulnerabilities across application code, dependencies/supply chain, secrets exposure, containers/infrastructure, and dynamic/running application behavior. - Attempt to reduce false positives by using repository and runtime context and exploitability/attack-path reasoning. - Provide remediation guidance, including code suggestions and, in some cases, proposed pull requests. Depthfirst presents a thesis that modern application risk often spans services, permissions, and business logic, and that single-point tools (SAST/SCA/secret scanning/container scanning) can generate noise and miss complex cross-boundary issues. **Primary product name:** General Security Intelligence (GSI).

Target market and positioning

Positioned for: - Security teams embedded in software engineering organizations (product security, AppSec, DevSecOps). - Mid-market to enterprise engineering organizations with rapid release cadence and complex stacks (microservices, SaaS integrations, cloud infrastructure, CI/CD). - Buyers seeking fewer, more actionable alerts and remediation that integrates into developer workflows (PR comments/PRs). Depthfirst competes in the broader application security platform space (sometimes described as "AI AppSec" or agent-enabled AppSec).

Get a comprehensive analysis of Depthfirst including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Oct 2, 2026

01Common complaints

Independent verification of security claims (precision/recall benchmarks, third-party evaluations) is required prior to purchase; many public vendor claims lack detailed methodology.
Publicly documented compliance artifacts (SOC 2 Type II, ISO certificates) are required for procurement today; these were not clearly available in public materials reviewed.
Transparent, self-serve pricing or month-to-month contracts are necessary; depthfirst appears to be sales-led and defaults to annual invoicing.
The environment is air-gapped or subject to strict data residency controls that prevent SaaS-based analysis of source code.
Existing toolchains already provide the required SCA/SAST coverage and the incremental benefit would be limited.

Deal disqualifiers (poor fit)

Organizations that cannot allow a third-party SaaS vendor to analyze proprietary source code.
Teams that require publicly documented SOC 2/ISO certifications before procurement.
Small teams that require self-serve pricing and month-to-month commitments.

Publicly acknowledged limitations

The vendor's terms acknowledge that AI outputs may be inaccurate or insufficient and that customers must review and adopt code changes themselves.

Roadmap signals

Secrets support was announced as a public preview, indicating the feature set is evolving and certain capabilities may still be maturing.

Scale limitations

Public documentation did not include technical limits such as maximum repository counts, LOC limits, or scan frequency caps; these appear to be negotiated via Order Forms.

API limitations / integration constraints

The vendor indicates API access for flexibility, but public developer documentation was not found in accessible sources reviewed.

02Why they buy

Unique selling points supported by available evidence (reported by vendor or customers)

Context-aware vulnerability identification across code and infrastructure, as presented in vendor materials.
A PR review workflow that proposes remediation suggestions.
Vendor-stated metrics related to signal-to-noise improvement and suggestion acceptance rates (these are vendor-cited and lack independently published methodology in public sources).

Where competitors may have advantages

Larger ecosystem integrations, broader language coverage, and longer product maturity.
More visible third-party validation in the form of peer reviews, analyst coverage, and compliance artifacts.

03Field reports

Depthfirst publishes multiple customer stories. These are vendor-selected narratives and are not independently verified in this report.

What is available publicly vs. missing

Depthfirst is a recently launched vendor and, at the time of this research, traditional review platforms contained limited or no accessible user review volume for the product.

Gartner Peer Insights: No publicly accessible product review page for depthfirst was found during queries executed for this report; Gartner pages are frequently gated.
G2 / TrustRadius / Capterra: No definitive product listing with user reviews was identified in accessible searches for this report.

Available public feedback is primarily vendor-published case studies, press coverage quoting vendor or customer statements, and limited social posts announcing product milestones.

Representative vendor-cited customer statements (neutral summary)

One customer stated that depthfirst reduced a portion of their security-engineering workload and characterized the product's assistance as similar to an experienced product-security engineer.
Another customer reported that depthfirst's PR reviewer provided concrete code suggestions and that the tooling integrated into their existing review workflows, leading to faster remediation in that deployment.
A third customer reported increased code-security coverage and that a substantial portion of agent recommendations had been addressed in their deployment.

These statements are vendor- or customer-published and have not been independently verified for this report.

Negative reviews (publicly accessible)

Common "why they chose it" themes (from vendor case studies and positioning)

The vendor positions the product as generating fewer low-value alerts compared to legacy scanners.
The product is presented as able to identify complex vulnerabilities and logic flaws that span code and infrastructure boundaries.
Vendor materials emphasize remediation via PR suggestions and code changes.
Vendor case studies highlight fast initial onboarding in select customer deployments.

Common "why some might leave" themes (inferred; not directly evidenced by public churn reviews)

Potential churn drivers (derived from common AppSec buyer experience) include:

AI-generated recommendations not trusted or producing excessive false positives in practice.
Perceived coverage or depth gaps relative to best-of-breed, single-purpose tools.
Unclear pricing or enterprise minimums.
Data governance constraints that prevent sharing source code with a SaaS vendor.

Note: These churn reasons are not confirmed by public user churn statements for depthfirst; they reflect common patterns in the AppSec market.

1) Developer-focused platform — reported increased coverage and addressed recommendations

Reported results: The vendor-cited case study states an increase in code-security coverage and that a majority of agent recommendations were addressed.
Critical evaluation: "Security coverage" is not explicitly defined in public materials. Outcomes are vendor-published and no third-party audit was identified.

2) Enterprise automation provider — onboarding and workflow integration

Reported implementation: The case study describes onboarding by granting permissions to a repository integration and connecting artifact registries.
Critical evaluation: The described workflow indicates integration maturity for some customers, but approval processes and risk review in regulated enterprises may be more time-consuming.

3) Recruitment marketplace — efficiency and noise-reduction claims

Reported outcomes: The vendor-cited material describes efficiency gains and reduced noise in the customer environment.
Critical evaluation: These are useful operational anecdotes but lack independently published measurement details.

04Best fit

Company sizes

Likely best fit:

Mid-market to enterprise organizations (mid-sized to large organization) with substantial engineering investment.
Security teams that operate baseline scanning tools and need improved prioritization and remediation workflows.

Industries

Best aligned where software delivery is core:

SaaS / cloud software
Fintech (subject to procurement constraints)
Developer platforms

Roles/personas

Economic buyer: CISO / VP Security / Head of Product Security
Champion: AppSec lead, DevSecOps lead
End users: software engineers receiving PR feedback and security engineers triaging findings

"Great fit" qualification criteria

Many repositories and services with complex authentication and data flows.
Significant backlog or noise from existing scanners.
Appetite for automation and PR-based remediation workflows.

05The pitch

What the product does (objective value proposition)

Discover vulnerabilities across application code, dependencies/supply chain, secrets exposure, containers/infrastructure, and dynamic/running application behavior.
Attempt to reduce false positives by using repository and runtime context and exploitability/attack-path reasoning.
Provide remediation guidance, including code suggestions and, in some cases, proposed pull requests.

Depthfirst presents a thesis that modern application risk often spans services, permissions, and business logic, and that single-point tools (SAST/SCA/secret scanning/container scanning) can generate noise and miss complex cross-boundary issues.

Primary product name: General Security Intelligence (GSI).

Target market and positioning

Positioned for:

Security teams embedded in software engineering organizations (product security, AppSec, DevSecOps).
Mid-market to enterprise engineering organizations with rapid release cadence and complex stacks (microservices, SaaS integrations, cloud infrastructure, CI/CD).
Buyers seeking fewer, more actionable alerts and remediation that integrates into developer workflows (PR comments/PRs).

Depthfirst competes in the broader application security platform space (sometimes described as "AI AppSec" or agent-enabled AppSec).

Get a comprehensive analysis of Depthfirst including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →