ZeroPath

Name: ZeroPath
Brand: ZeroPath
Rating: 4.3 (9 reviews)

AI Native

Detect and fix your application's exploitable security issues.

Est 2024|Raised $7.5M|28 Ref Customers

LinkedIn 3K|Web traffic 11K|FTEs 7|HQ San Francisco, CA

MarketsApplication Security Testing (AST)Code Security SAST

Published Oct 15, 2026

01Common complaints

- Company sizes or stages where this product may be overkill or insufficient - Very early startups with minimal compliance needs may prefer native GitHub security features (Dependabot, code scanning) or open-source tools due to lower operational overhead. - Highly regulated enterprises that require extensive, publicly documented compliance artifacts and strict data residency controls should validate controls and request audit documentation. - Industries or use cases where competitors are more suitable - Teams needing broad ecosystem coverage across containers, registries, and multiple SDLC touchpoints may prefer Snyk. - Organizations standardized on GitHub wanting native, integrated controls and per-committer pricing may prefer GitHub Advanced Security. - Technical requirements this product may not meet - Use cases requiring guaranteed scan consistency and deterministic outputs should be pressure-tested; there is at least one public report of inconsistent results across repeated scans. - Budget considerations - For limited budgets, per-developer pricing can be material; alternatives include GitHub add-ons (if already on GitHub) or open-source tools such as Semgrep. - Specific integrations or workflows to validate - Buyers should confirm requirements around IDE plugins, ticketing integrations (e.g., Jira), SBOM formats, and export APIs with the vendor. - Red flags to address in procurement - Contract terms and trial options were not clearly documented in the sources reviewed. Buyers should request month-to-month pilots, clear success criteria, and exit clauses where possible. - Limitations acknowledged or implied in vendor materials and reviews - Vendor materials focus on reducing false positives via AI validation; explicit vendor statements of product limitations were not prominent in accessible documentation. - Roadmap items and availability - No clear roadmap dates or precise feature timelines were found in the accessible sources. - Scale limitations - The vendor states testing with very large codebases (e.g., 5M+ lines). Independent validation of scale behavior should be part of procurement testing. - Security or compliance gaps - Public documentation is limited for data residency specifics, penetration test disclosures, and progress details on ISO certifications. - Technical debt and architectural notes from reviews - Reviewers describe the product as relatively new and evolving; this can imply ongoing maturity work and occasional UI bugs. - API and integration notes - The vendor provides CLI and API access per documentation; specific API limitations were not detailed in the sources reviewed.

Deal disqualifiers: what makes a poor fit

Requirements for fully deterministic, repeatable outputs for compliance or contractual obligations (given reports of inconsistent scan results)
Teams that cannot tolerate frequent UI/workflow changes
Organizations requiring publicly documented data residency and detailed security attestations that are not visible in public materials

02Why they buy

- Reported advantages validated by customer feedback (paraphrased) - Reviewers report more relevant findings and reduced false positives in some contexts. - Some reviewers reported detection of business-logic issues that other scanners missed. - PR integration and workflow fit were cited as practical advantages. - Several reviewers noted responsive support and that vendor-generated patches were usable with minimal edits in their environments. - Features reported as differentiators - The combination of AI-assisted validation, an emphasis on business-logic detection, patch-generation, and PR-focused reviews. - A unified platform approach covering SAST, SCA, secrets, IaC, and DAST in one suite (as described by the vendor). - Buyers should independently evaluate patch quality and scan accuracy on representative codebases. - Areas where competitors have clearer advantages - Snyk: mature ecosystem and broad integrations. - GitHub Advanced Security: native GitHub integration and transparent per-committer pricing. - Traditional enterprise vendors: established governance, procurement fit, and long-standing audit artifacts.

03Field reports

Review platform availability

Vendor-specific pages on some review platforms were limited or not found in the sources accessed; G2 contained multiple reviews for ZeroPath.

Selected reviewer observations (paraphrased from public reviews)

- Positive (precision and patching) - A G2 reviewer reported that the product's source-to-sink analysis was precise, which reduced triage time; the reviewer stated that auto-generated patches required minimal modification in their cases. - Positive (business-logic bugs) - A reviewer indicated the scanner identified business-logic vulnerabilities that other tools had missed in their environment. - Mixed/negative (rapid change) - Some reviewers noted frequent product updates and UI changes, which can require adjustment to workflows. - Negative (consistency) - A reviewer reported inconsistent scan results across repeated scans. - Negative (performance) - Some reviewers stated that scan times can be longer in certain situations.

Community commentary

In a public discussion, participants expressed caution about attributing all improvements solely to AI-assisted tooling and emphasized the role of human triage and validation.

Balance and potential bias

The visible review pool is limited; several public reviews are labeled as vendor-invited or similar, which can correlate with more favorable feedback. Low-star reviews were not prominent in the accessible excerpts; absence of such reviews in the accessible sample does not imply none exist.

Common criticisms and complaints summarized

UI or dashboard quirks
Rapid product/UI changes
Scan time performance in some environments
Inconsistent findings across repeated scans (reported by a reviewer)

Reasons customers cited for choosing the product

More relevant findings and reduced false-positive noise in some contexts
PR integration and workflow fit
Vendor-generated patches that required minimal edits

Reasons that may drive churn (observed or inferred)

Inconsistent scan results
Frequent UI/workflow changes
Coverage gaps for niche vulnerability types

Outcomes claimed by customers

Most quantified outcomes visible in accessible sources are vendor-published or reviewer-reported; these should be validated via reference checks or in-house evaluations.

Vendor-published case studies and claims

The vendor publishes case comparisons and metrics, including a vendor article stating that an organization found more real vulnerabilities after switching to the product, and claims about scan volumes and customer profiles.
These metrics are vendor-published and were not independently verified in the sources reviewed.

Specific results and quantified impact

Examples of vendor-published outcomes include claims of higher vulnerability yield and comparative cost advantages; the underlying methodologies are not fully disclosed and should be validated in bake-offs or reference calls.

Implementation details and time to value

Vendor materials reiterate quick initial scans and PR-level scan times; enterprise deployments typically require configuration of SSO, policies, and gating rules that add to onboarding time.

Challenges during adoption and mitigation

Reviewer comments indicate scan scheduling or configuration adjustments were used to mitigate longer scan times in some environments.

Critical notes on vendor metrics

The case-study metrics and comparative claims are vendor-reported; procurement should request test datasets, methodology, and independent verification where possible.

Absence of negative case studies

No public detailed case studies reporting failed deployments were identified in the accessible sources. The most negative operational evidence observed was reviewer feedback on scan consistency.

04Best fit

Company sizes: specific employee counts and revenue ranges

Inferred best-fit:
- Organizations with small-to-mid employee bases and dedicated engineering teams with growing AppSec needs.
- Mid-market to enterprise organizations requiring multi-team governance features (SSO, audit logs).
Possible fit:
- Compact engineering teams that require PR-focused scanning with lower false positive noise.

Industries and verticals where adoption is strongest (with customer examples)

Vendor claims usage across finance, healthcare, and technology. Some reviewers referenced Financial Services and Health Care contexts.
Vendor site displays customer logos such as NetSPI, MESH, HitPay, Aquanow; buyers should validate logo usage and references.

Roles and personas: decision makers AND end users

Decision makers:
- CISO / Head of Security
- Director/Manager of AppSec / Product Security
- VP Engineering
End users:
- AppSec engineers responsible for triage and governance
- Developers receiving PR feedback and applying patches
- DevOps/platform engineers managing CI/CD integration

Pain points and challenges the product addresses

High false positive volumes from legacy SAST
Need for faster PR-level feedback
Coverage gaps for business-logic and auth-related flaws
Developer-security friction caused by noisy findings

Qualification criteria: what makes a strong fit

Teams seeking PR-level security feedback that developers will act on
Organizations that can accommodate relatively frequent product updates
Organizations with processes to review AI-assisted patches

Real customer examples with company names when available

Vendor site displays logos such as NetSPI, MESH, HitPay, Aquanow; referenceability should be confirmed during procurement.

05The pitch

What the product does (core value proposition in objective terms)

- ZeroPath describes its platform as an application security (AppSec) solution that integrates multiple code-security functions into a single suite. - Product modules listed on the vendor site include: - SAST (static application security testing) - SCA (software composition analysis) - Secrets detection - IaC misconfiguration scanning - PR security reviews - Policy engine - Risk management - An AI-assisted patch generation feature (vendor-branded) - Dynamic application security testing (DAST) - The vendor states its primary differentiators are lower false positive rates through context-aware analysis and exploitability checks, and automated patch-generation capabilities. These are vendor claims and should be validated in customer environments.

Target market and market positioning

The vendor markets the product as a comprehensive AppSec suite intended for organizations that seek reduced false positives relative to traditional SAST, improved detection of business-logic and authentication flaws, and fast PR-level scanning suitable for merge gating.
Messaging targets AppSec engineers, security leads, and engineering teams that report high noise from legacy SAST tools.

Get a comprehensive analysis of ZeroPath including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →