Xygeni

• GitHub or an AI coding tool such as Cursor could add in-IDE scanning of the code it generates as a native feature, removing the differentiation Xygeni leads its homepage with.
• A larger scanner such as Snyk or Checkmarx could match Xygeni's all-in-one breadth and outspend it on enterprise go-to-market, where Xygeni's public reference base is currently thin.
• Xygeni shows two named references and vendor-published figures as its public proof, so a buyer requiring a broad slate of enterprise references could find the evidence insufficient.
• A single disclosed funding round of about four million euros may be too little to fund the enterprise sales motion the broad platform implies, slowing expansion beyond its current mostly-smaller accounts.

Xygeni addresses the security team that has to find and fix risk across the entire software development lifecycle without slowing engineering. The company frames the problem as securing the software supply chain from code to cloud, covering source code, open-source dependencies, secrets, infrastructure-as-code, CI/CD pipelines, and the malicious packages that enter through them.

The buyer is named clearly. Xygeni sells to security and DevSecOps leaders, and its Fintonic reference is a CISO-CTO who describes the platform as central to the security strategy. The pain is concrete and current: vulnerabilities, exposed secrets, and misconfigurations reaching production faster as AI coding assistants increase the volume of code.

The market context is favorable. Application Security Posture Management is a recognized buyer category, and the security of AI-generated code is an active concern, so Xygeni speaks to demand that buyers are already funding rather than a need it has to argue into existence. [s1, s8, s3, s5]

Xygeni ships an unusually broad platform for its stage. The product set spans ASPM, SAST, SCA, DAST, secrets, IaC, CI/CD security, build security, malware defense, and anomaly detection, with a CoreAI engine that prioritizes findings. Public GitBook documentation covers each line, which is a stronger evidence base than marketing pages alone.

DevAI is the AI-first lead. Xygeni describes it as embedded inside modern IDEs, where developers interact with it through the IDE's Copilot or agent chat window, and names VS Code, IntelliJ, Cursor, and Windsurf as examples. It performs incremental static analysis as developers type, flags vulnerable patterns, exposed secrets, and unsafe APIs in both human and AI-generated code, and proposes automated fixes. A fix-evaluation server checks each proposed change for breaking-change risk before a developer approves it.

The capability that earns the AI Defense Matrix placement is DevAI's scanning of AI-generated code. The capability appears to apply the same scanning engine that Xygeni already ran across the pipeline, now moved to the moment AI writes the code rather than the moment it reaches a build. [s6, s2, s1, s9]

Xygeni competes in a crowded AppSec field by consolidating tools that buyers often purchase separately. Its closest rivals are ASPM and AppSec-platform vendors that sell the same developer-native scanning and remediation pitch to the same buyer.

Capital is the defining structural constraint. Xygeni has disclosed one funding round of about four million euros, so it competes on breadth rather than on capital or installed base.

The platform also sits downstream of a second kind of competitor. GitHub and the AI coding tools whose output DevAI scans can add in-IDE security checks to their own products, which would contest the AI-generated-code position Xygeni now leads with. Its defense is the all-in-one span across the lifecycle, which a single-feature bundler does not match. [s1, s4, s2]

Xygeni's go-to-market is self-serve at the front, with a free trial and product tour, layered over a direct sales motion aimed at security leaders. The public proof of demand is concentrated rather than broad.

Two references, Fintonic and Adaion, are named with attributed CISO quotes, and Fintonic carries a vendor-published figure of a 75 to 90 percent reduction in the time to prioritize security tasks. Beyond that, the site shows customer logos and a set of category awards from a single industry awards program. The awards and the case-study numbers come from Xygeni's own channels, so they evidence a working demand-generation engine more than independent enterprise validation.

The honest read is that named, referenceable traction is thin for a platform positioned across the full enterprise AppSec stack. That is consistent with an early-stage company building its reference base, but a buyer that requires multiple enterprise references would not yet find them in public materials. [s5, s7, s1]

Xygeni's leadership is publicly identifiable. Jesús Martín is CEO and co-founder, Luís Rodríguez is CTO and co-founder, and Jesús Cuadrado is Chief Product Officer, each with a public profile.

The company describes a team of researchers and engineers with decades of experience in product development and cybersecurity, backed by an advisory board of cybersecurity leaders. That establishes domain competence consistent with the breadth of product shipped.

What the public record does not show is a verifiable prior exit or a sustained, recognized publication record that would lift the team to the level of repeat founders with a proven track record in the same category. The signals support credibility at the level of an experienced first-time-scale team rather than serial category builders. [s3]

Xygeni's homepage says it operationalizes the secure SDLC practices required by leading security and regulatory frameworks, shown with framework badges under a heading about operating in regulated environments. Read in context, these present the frameworks the platform helps customers satisfy rather than Xygeni's own audited attestations, and the badge images carry no certifying detail.

No inspectable trust center was found in the public record. Probes of the usual locations, including trust and security subdomains and the compliance, security, and trust-center paths, did not resolve, and the AI Defense Matrix Catalog records no compliance attestation for the DevAI product.

The practical implication is that a buyer with a hard compliance gate would need to request Xygeni's own attestation status directly, since the public materials document framework alignment rather than a published, third-party-audited certification. [s1]

Add analyzed competitors to compare them side by side with Xygeni.

Xygeni targets the security leader and DevSecOps team that has to secure code, dependencies, and pipelines across the development lifecycle without slowing engineering. It frames the buyer as the security and DevSecOps leaders who own software-supply-chain risk, and its named references are headed by a CISO-CTO and a CISO.

The public proof runs below the enterprise positioning the platform implies. The two named references are Fintonic, a fintech company, and Adaion, and the cited pages show customer logos and case studies rather than large-enterprise reference detail. The publicly proven base is limited to those named references and logos, with no large-enterprise reference detail shown, even though the platform addresses an enterprise-grade problem.

The segmentation strategy is consolidation. Xygeni sells one platform spanning tools a buyer often purchases from several vendors, which fits a buyer that wants fewer contracts and one console rather than best-of-breed point tools.

Xygeni's capability set is broad and documented. Public GitBook guides cover ASPM, SAST, DAST, SCA, secrets, and CI/CD security, and the platform adds IaC, build security, malware defense, and anomaly detection. Xygeni positions CoreAI as the risk-intelligence and orchestration layer over the scanners, paired with AI auto-fix remediation.

DevAI is the AI-specific product Xygeni promotes most prominently. Xygeni describes it as embedded inside modern IDEs, where developers interact with it through the IDE's Copilot or agent chat window, and names VS Code, IntelliJ, Cursor, and Windsurf as examples. It performs incremental static analysis as developers type, flags vulnerabilities, secrets, and unsafe APIs in human and AI-generated code, and proposes automated fixes that a server first checks for breaking-change risk.

The AI advantage comes from applying scanning where AI writes code rather than from a proprietary model. DevAI appears to extend Xygeni's existing static-analysis and remediation capabilities into the IDE, so Xygeni differentiates on placement and integration rather than on a detection technology a rival could not build.

Xygeni runs a self-serve top of funnel layered over direct sales. The site offers a free trial and a product tour, and the broader motion targets security leaders through case studies, awards, and a demo request.

The public selling signals are vendor-controlled. The category awards come from a single industry awards program, and the headline customer outcome, a 75 to 90 percent reduction in prioritization time, is published by Xygeni in its own case study rather than reported independently. These show a working demand-generation engine more than independent validation of scale.

The traction gap is the honest read. Two named references and a set of customer logos is thin proof for a platform pitched across the full enterprise AppSec stack, which is consistent with an early-stage company still building its referenceable base.

The homepage and ASPM pages carry free-trial and book-a-demo paths and a Pricing link, and the live pricing page publishes the unit and the ladder: annual subscriptions sized by contributors and daily scans, a Standard plan listed from 2,160 dollars billed annually, a Premium tier, and a custom Enterprise plan, each with a free-trial path. Published contributor-based pricing fits the consolidation pitch, letting a buyer compare the bundled cost against point tools before a sales conversation.

Xygeni delivers as a platform that integrates into existing developer tooling. The official documentation states on-premise support, and a third-party vendor profile indicates a SaaS option as well. The platform connects into source-code managers and CI systems across the development pipeline.

The operational model is scan-and-remediate across the lifecycle. Xygeni performs real-time detection across open-source dependencies and other SDLC assets, prioritizes exploitable and business-critical risk, and proposes or automates fixes, with DevAI adding incremental scanning inside the IDE and a fix-evaluation step before changes are applied.

What the public record does not document is the operational maturity a large enterprise would probe, such as published uptime commitments, support tiers, or scale references. The documentation establishes the product's operating model, not its performance or large-enterprise scale.

Xygeni's homepage says it operationalizes the secure SDLC practices required by leading security and regulatory frameworks, shown with framework badges. Read in context, these present the frameworks the platform helps customers meet rather than Xygeni's own audited attestations, and the badge images carry no certifying detail.

No trust center or vendor certification page is visible in the cited public materials, and a 2026-07-16 probe found the trust and security subdomains unregistered and the /trust, /security, /compliance, and /trust-center paths returning 404. The public materials document framework alignment, not a published third-party certification.

The practical effect is a trust gap for compliance-sensitive buyers. A buyer with a hard certification requirement would have to request Xygeni's own attestation status directly, since the site does not establish that Xygeni itself holds an audited SOC 2 or ISO 27001.

Xygeni positions itself as the consolidation layer rather than a point tool, and its CoreAI engine can apply insights to its own findings and to third-party tool output. That broadens the platform claim from Xygeni's scanners alone toward an orchestration role over a buyer's existing stack.

The ecosystem dependency runs the other way too. DevAI scans the output of AI coding tools and embeds in their IDEs, which makes Xygeni a complement to platforms such as GitHub and the AI coding assistants rather than a peer that controls its own distribution.

That position carries a structural risk. The same platforms whose surfaces Xygeni plugs into, the IDEs and code hosts and AI coding tools, are the parties best placed to add in-IDE scanning of the code they generate, which would contest the AI-generated-code position Xygeni now leads with.

Xygeni's leadership is publicly identifiable, with Jesús Martín as CEO and co-founder, Luís Rodríguez as CTO and co-founder, and Jesús Cuadrado as Chief Product Officer. The company says it is backed by an advisory board of cybersecurity leaders, though the cited pages do not name the advisors.

The company describes a team of researchers and engineers with decades of experience in product development and cybersecurity, which is consistent with the breadth of documented product relative to the public funding record. That output per disclosed dollar is a credible signal for an early-stage team.

The cited materials establish current roles and broad experience without documenting a prior exit or a sustained publication record. On that record the team reads as experienced and capable rather than as documented repeat category builders, which matters when the company is asking enterprise buyers to consolidate onto its platform.