GitGuardian

• GitHub could extend the secret scanner it already ships, which independent researchers measured as the most precise tool in their nine-tool comparison, into the collaboration tools and vaults GitGuardian covers, removing the reason to buy a separate scanner.
• The one independent benchmark on record rated the scanner's accuracy relatively low and, on the sample it timed, its scan the slowest of nine tools. A fresh public comparison could reach the same conclusion about the current engine and undercut the detection claim the company sells on.
• The free command-line scanner calls GitGuardian's hosted service to work, so a self-contained open-source alternative that matched its detector coverage would weaken the self-serve developer entry point GitGuardian uses to reach engineering teams.
• Vault vendors such as HashiCorp and CyberArk, whose stores ggscout reads, could extend their own products to report on the credentials that never made it into the vault.
• Seventy percent of revenue comes from the United States, and North America supplied more than 80 percent of new annual recurring revenue in 2025. A slowdown in that one market would hit growth before the newer regions could take up the slack.

GitGuardian sells to three groups at once. Developers get a scanner that runs before a commit leaves a laptop, security operations analysts get the queue of exposures to close, and the identity team gets an inventory of the machine accounts those credentials belong to. The company frames the problem as credentials sitting where nobody put them deliberately, in a personal repository, a chat message or a build pipeline.

How badly the field currently solves this has independent measurement behind it. North Carolina State University researchers evaluated nine secret-detection tools against a shared corpus of repositories and found top precision of 75 percent, 46 percent for the runner-up, and five of the nine below 7 percent. That paper also opens by citing GitGuardian's own count of leaks across public GitHub, which is how the company's monitoring became the figure that benchmark cites for the scale of the problem, rather than a reference other researchers use.

The newer half of the problem is who holds the credential rather than where it leaked. Service accounts, API keys, OAuth tokens and AI agents outnumber human users by a wide margin, and GitGuardian shipped a non-human identity governance line in 2025 to inventory them, attribute owners and flag the ones that are stale or over-privileged. [s16, s1, s2, s4]

GitGuardian describes four core capabilities. Internal Secrets Monitoring watches a customer's own repositories, pipelines, registries and collaboration tools, Public Secrets Monitoring watches public GitHub, NHI Governance inventories machine identities, and Developer Endpoint Protection extends coverage to the developer's own machine. Honeytoken ships inside NHI Governance, planting decoy credentials that alert when an intruder uses one.

Two named tools carry the work into the places secrets live. The ggshield command-line scanner detects more than 550 credential types at the pre-commit stage and inside build pipelines, and it needs an API key because the detection itself runs as GitGuardian's hosted service. The ggscout collector reads secrets metadata out of HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, CyberArk Conjur Cloud, Akeyless and Delinea, hashes it inside the customer's environment, and sends fingerprints and metadata rather than plaintext.

The reconciliation between those two halves is the product's argument. Finding a credential in a chat message means little on its own, and matching it to a vault entry, an owner and a set of permissions is what turns it into a ticket somebody can close. The company describes agentic prioritization triaging incidents and auto-routing them to the right developer.

An outside evaluation of the free scanner exists and is not flattering. The North Carolina State University benchmark ran version 1.14.3 against 818 repositories. On the 15-repository sample the researchers timed, it was the slowest of the eight tools they could time, at 4.8 hours, with precision and recall the researchers described as relatively low, and only 18 percent of the true secrets it found were also found by Gitleaks. That test dates from 2023 and covers the free command-line tool rather than the platform sold today, which leaves the current engine's accuracy measured only by the company. [s1, s6, s7, s16, s3, s5, s9]

GitGuardian competes against the code host itself as well as against the identity vendors. GitHub ships its own secret scanner, and the North Carolina State University benchmark measured that scanner as the most precise of the nine it tested, at 75 percent, so the platform GitGuardian also distributes through sells a competing capability.

The company's stated answer is breadth rather than depth on any one surface. It covers repositories it does not host, chat and ticketing tools, container registries, developer laptops and the vaults themselves, and its pitch is finding what never made it into a vault rather than protecting what did. Its own site states the case as vaults protecting what is inside them while GitGuardian finds the API key in Slack and the credential in a personal repository.

At the Series B in December 2021 the company said it would use the money to build a code security platform able to compete with companies such as Snyk. The direction since has bent toward identity rather than application security, which puts it beside the machine-identity governance vendors rather than the code scanners it once named. [s16, s1, s10, s7]

Two motions run in parallel. A free Starter plan covers up to 25 developers with no credit card and a GitHub Marketplace listing puts the product where developers already shop for security apps, alongside a claimed reach of more than 600,000 developers. The paid motion is a quoted deal through Growth and Enterprise. Growth carries internal monitoring, limited public monitoring, remediation playbooks and single sign-on, and Enterprise adds machine-identity governance, wider public monitoring, collaboration-tool sources and self-hosted deployment. Licenses can also be bought through the AWS Marketplace.

The named-customer record is genuine and mostly reaches the public through the company. SiliconANGLE lists DigitalOcean, Snowflake, Datadog, ING Groep, Euronext and BASF, and GitGuardian separately names Deutsche Telekom and BASF and publishes named practitioners at Vermeer, Qlik and Orange Business speaking about their deployments.

Scale figures are the company's own measurement. GitGuardian reports more than 115,000 developers inside enterprise customers, more than 610,000 enterprise repositories monitored, more than 210,000 connected collaboration sources and more than 16 million free users' repositories, with 70 percent of revenue from the United States. SiliconANGLE repeats three of those figures. No revenue amount appears anywhere in the reviewed sources. [s5, s1, s18, s19, s4]

Eric Fourrier and Jérémy Thomas started GitGuardian in 2017 as a side project while working full-time as data scientists and software engineers, collecting public GitHub commits in real time until the scale of the leakage became clear. Fourrier is chief executive and co-founder today. Thomas held the chief executive role at the Series B in December 2021, when SecurityWeek reported he would move from France to the United States to open an American office, so coverage from that period names a different person in the job.

The company's research output is what carries its public standing. Its measurement of leaked credentials across public GitHub is cited by that benchmark as the reference figure for the problem, which is an unusual position for a vendor to hold in a market it also sells into.

The reviewed record shows no prior exit and no earlier named product either founder built before this one. Investor support is broad, with Insight Partners leading the 2026 round alongside Eurazeo, Balderton, Sapphire Ventures, Quadrille Capital, Fly Ventures and BPI. A filing on the United States Securities and Exchange Commission's EDGAR system covering the year ended December 31, 2025 lists GitGuardian SAS of Paris among equity investments held at five percent or more, which is where the French legal entity behind the product is on record. [s4, s10, s16, s9, s15]

Two things carry the trust story. One is architecture: the ggscout collector hashes secrets metadata inside the customer's own environment and exports only hashed fingerprints and metadata, so the plaintext credential stays where it already sits. An enterprise buyer can also take a self-hosted deployment instead of the hosted service.

The other is a published trust record with real content behind it. GitGuardian's trust center states annual SOC 2 Type II audits by Prescient Assurance, maintained since 2022, alongside GDPR, encryption in transit and at rest, independent penetration tests and a 48-hour incident notification commitment. It also records monthly vulnerability scans and a private bug bounty.

Separately from what it holds, GitGuardian sells compliance as a reason to buy. Its site lists PCI DSS, NIS2, DORA, SOC 2, ISO 27001, SOX and GDPR as frameworks that now expect demonstrable control over secrets and machine identities, which describes the buyer's own obligations rather than GitGuardian's attestations. [s7, s5, s8, s1]

Add analyzed competitors to compare them side by side with GitGuardian.

GitGuardian segments by the team that has to act on a finding rather than by company size. Developers get a scanner that runs before a commit leaves the laptop, security operations analysts get the queue of exposures to close, and the identity team gets an inventory of the machine accounts behind those credentials. The vendor writes the same split into its own navigation, with pages for developers, security operations analysts, security engineers and identity and access management.

The commercial segment is the enterprise with credentials scattered across tools it does not host. Growth carries internal monitoring, limited public monitoring, remediation playbooks and single sign-on, while machine-identity governance, wider public monitoring, collaboration and file-storage sources, and self-hosted deployment are held for Enterprise. So the customer with one code host and one vault has much less to buy than the customer with repositories, chat, ticketing and several vaults.

Underneath sits a self-serve segment that never talks to sales. The free Starter plan covers up to 25 developers with no credit card, and the GitHub Marketplace listing puts the product in front of developers choosing security apps for themselves.

GitGuardian describes four core capabilities covering the places a credential can end up. Internal Secrets Monitoring watches a customer's repositories, pipelines, registries and collaboration tools, Public Secrets Monitoring watches public GitHub, NHI Governance inventories machine identities, and Developer Endpoint Protection extends coverage to the developer's own machine. Honeytoken ships inside NHI Governance, planting decoy credentials that alert when an intruder uses one.

Two tools carry that into the customer's environment. The ggshield command-line scanner detects more than 550 credential types at the pre-commit stage, and it needs an API key because the detection itself runs as GitGuardian's hosted service. The ggscout collector reads secrets metadata from HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, CyberArk Conjur Cloud, Akeyless and Delinea Secret Server, hashes it inside the customer's environment, and sends fingerprints and metadata rather than plaintext.

The AI claim is about triage rather than detection. GitGuardian describes agentic prioritization that triages incidents the way a security operations engineer would, and auto-routing that assigns each one to the right developer. It also ships a server for the Model Context Protocol, so a coding agent can scan files, manage incidents and place honeytokens from inside an editor such as Cursor or Windsurf. The company describes that server as built with read-only permissions.

Outside measurement of the detection exists and is unflattering. North Carolina State University researchers compared nine tools against 818 repositories and ran ggshield version 1.14.3. On the 15-repository sample they timed, it was the slowest tool, at 4.8 hours, with precision and recall the researchers described as relatively low. Only 18 percent of the true secrets it found were also found by Gitleaks. That test covers the free command-line tool in 2023 rather than the platform sold now, which leaves the current engine's accuracy measured only by the company.

Two motions run side by side. The free Starter plan and the GitHub Marketplace listing pull developers in without a conversation, and the company claims a reach of more than 600,000 developers. The paid motion is a quoted deal through Growth and Enterprise, and Enterprise is where machine-identity governance, wider public secrets monitoring and self-hosted deployment live. Licenses can also be bought through the AWS Marketplace.

Named references sit on both sides of the record. SiliconANGLE lists DigitalOcean, Snowflake, Datadog, ING Groep, Euronext and BASF as customers, GitGuardian separately names Deutsche Telekom and BASF, and its own site carries named practitioners at Vermeer, Qlik and Orange Business describing what the product did for them.

Geography is concentrated and the company says so. Seventy percent of revenue comes from the United States, and North America supplied more than 80 percent of new annual recurring revenue in 2025. The Series C proceeds are earmarked for Asia Pacific, South America and the Middle East alongside the existing markets.

GitGuardian meters by developer, and it defines the term. For internal monitoring and machine-identity governance a developer is any active contributor to a secured project who has committed in the last 90 days, so the meter tracks working engineers rather than seats or scan volume. Endpoint protection is priced separately, per endpoint per year, in two tiers.

Only the bottom tier carries a published rate. Starter is free for up to 25 developers with no credit card, and both Growth and Enterprise say to contact sales, so the price of what an enterprise actually buys is not public.

What each tier includes is public, and the packaging carries the strategy. Growth bundles internal monitoring across code, pipelines and registries, limited public monitoring, remediation playbooks and single sign-on. Enterprise adds machine-identity governance with honeytokens, wider public monitoring, collaboration and file-storage sources, self-hosted deployment and a twelve-month audit log.

In the default deployment the customer runs the collectors and GitGuardian runs the detection. The ggshield scanner and the ggscout collector install in the customer's own pipelines and infrastructure, and an academic evaluation of the scanner records that it calls GitGuardian's API to identify a secret, so the detection logic sits on the vendor's side of that line.

The design keeps plaintext credentials where they already are. GitGuardian describes ggscout collecting secrets metadata, converting it into an encrypted form inside the customer's environment, and sending only that, and the ggscout page states that plaintext secrets never leave, only hashed fingerprints and metadata.

An enterprise that will not run on the vendor's cloud has another option. Self-hosted deployment is listed as available at the Enterprise tier and on the trust center, which moves the platform inside the customer's own perimeter.

Half of the trust argument is architectural. Secrets metadata is hashed inside the customer's environment before it is sent, plaintext credentials stay put, and an enterprise can take a self-hosted deployment instead of the vendor's cloud.

The other half is a published trust record with real content behind it. GitGuardian's trust center states annual SOC 2 Type II audits by Prescient Assurance, maintained since 2022, alongside GDPR, encryption in transit and at rest, independent penetration tests and a 48-hour incident notification commitment. It also records monthly vulnerability scans, a private bug bounty and cybersecurity insurance. Enterprise buyers get twelve months of audit log retention.

Separately from what it holds, GitGuardian sells compliance as a reason to buy. Its homepage lists PCI DSS, CIS, NIS2, SOC 2, DORA, ISO 27001, SOX and GDPR as frameworks that now expect demonstrable control over secrets and machine identities, which describes what the buyer owes an auditor rather than what GitGuardian is certified against.

GitGuardian positions itself as one platform spanning the life of a credential, from the moment a developer writes one to the moment a security team rotates or revokes it. The pitch on its homepage is explicitly complementary to the vault vendors rather than competitive with them: vaults protect what is inside them, and GitGuardian finds the key in a chat message or a personal repository that never made it in.

That posture makes the vault vendors partners in the plumbing. The ggscout collector reads from HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, CyberArk Conjur Cloud, Akeyless and Delinea Secret Server, so the product depends on read access to stores other companies sell.

The developer-facing edge of the ecosystem is where the position is thinnest. The free command-line scanner is open source but calls GitGuardian's hosted service to do the detection. The code host it distributes through ships a competing scanner of its own, which North Carolina State University researchers measured as the most precise of the nine tools they compared.

Eric Fourrier and Jérémy Thomas started GitGuardian in 2017 while working full-time as data scientists and software engineers, collecting public GitHub commits in real time until the scale of the leakage became clear. Fourrier is co-founder and chief executive now. Thomas held the chief executive role at the Series B in December 2021, when SecurityWeek reported he would move to the United States to open an American office, so coverage from that period names a different person in the job.

Execution shows in a steady release cadence rather than a single launch. The company's own timeline records public secrets monitoring in 2018, internal secrets monitoring in 2020, honeytokens in 2023, machine-identity governance in 2025, and developer endpoint protection in 2026. A filing on the United States Securities and Exchange Commission's EDGAR system covering the year ended December 31, 2025 lists GitGuardian SAS of Paris among equity investments held at five percent or more.

The public standing this team has built rests on research rather than pedigree. GitGuardian's measurement of leaked credentials across public GitHub is what an academic benchmark of nine detection tools cites when it sets up the size of the problem, so a vendor's own count has become a figure researchers work from in the market it sells into.