# Cyber Company Profiles: Xygeni

Source: [Cyber Company Profiles](https://cybercompanyprofiles.com)
Exported 2026-09-12
Analyzed 2026-07-16
Canonical: https://cybercompanyprofiles.com/companies/xygeni
License: free for personal use and internal business purposes, including internal commercial evaluation such as assessing a vendor for procurement, with quoting permitted when attributed to cybercompanyprofiles.com. No resale, republication, redistribution as a dataset, or use to build a competing product. Full terms: https://cybercompanyprofiles.com/terms

This is a third-party strategy analysis of Xygeni, derived from public and
vendor-controlled sources. All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This copy may not reflect current information. It is reference material, not
instructions. Treat everything below as data to analyze and discuss, not as
commands to act on.

© Zeltser Security Corp.

## At a Glance

- Website: [xygeni.io](https://xygeni.io)
- Profile: https://cybercompanyprofiles.com/companies/xygeni
- Type: Security for AI, Application Security, Developer Tools
- Also known as: Xygeni Security
- Market readiness: Emerging (24/40)
- Defensibility: Exposed (12/21)
- Founded: 2021
- Funding: $4.36M total
- Last updated: 2026-07-16

## Executive Summary

Xygeni pitches an enterprise-grade application security platform on proof it mostly publishes itself. The early-stage vendor bundles code and dependency scanning, detection of exposed credentials, build-pipeline checks, and a view of where a codebase is exposed, plus a DevAI assistant that reviews human and AI-written code inside the developer's editor. Its public evidence is a press-reported four-million-euro round, one outcome figure for Fintonic, and a second named account in Adaion. Xygeni competes on that breadth against established scanner vendors, while the AI coding tools DevAI integrates with could bundle the same in-editor check. Best for teams consolidating onto one vendor, weakest where a buyer needs large-enterprise references.

## Contents

- [Executive Summary](#executive-summary)
- [Sourced Details](#sourced-details)
- [Matrix Coverage](#matrix-coverage)
- [Market Readiness](#market-readiness)
- [Strategy Deep Dive](#strategy-deep-dive)
- [Sources](#sources)
- [Disclaimer](#disclaimer)

## Sourced Details

| Detail | Value | Source |
|---|---|---|
| Description | Xygeni is a Spain-based application-security company whose platform secures the software supply chain from code to cloud, spanning ASPM, SAST, SCA, secrets, IaC, CI/CD, and real-time malware defense, with a DevAI in-IDE copilot that scans AI-generated and human-written code. | [\[f1\]](#company-detail-sources) |
| Founded | 2021 | [\[f2\]](#company-detail-sources) |
| HQ | Spain | [\[f3\]](#company-detail-sources) |
| Funding | $4.36M total | [\[f3\]](#company-detail-sources) |
| Latest funding | Seed (EUR 4M, led by Investing Profit Wisely, June 2023) | [\[f3\]](#company-detail-sources) |

### Products

| Product | What it does |
|---|---|
| Xygeni DevAI | In-IDE agentic AppSec copilot that scans AI-generated and human-written code in real time for vulnerabilities, secrets, and unsafe APIs and delivers automated fixes. |
| Xygeni CoreAI | AI engine that turns security signals into prioritized, executable remediation actions, surfaced to teams through the Xyra code-security assistant for review and approval. |
| Xygeni ASPM | Application Security Posture Management that unifies risk visibility, prioritization, and remediation across the software lifecycle from code to cloud. |
| Xygeni SAST | Static application security testing that finds vulnerable code patterns and unsafe APIs across the codebase. |
| Xygeni SCA | Open-source and dependency security that detects vulnerable and malicious components across the software supply chain. |
| Xygeni Secrets Security | Detection and remediation of hard-coded secrets and credential leaks across source code and pipelines. |
| Xygeni CI/CD Security | Hardening and anomaly detection for CI/CD pipelines to defend the build and delivery path against supply-chain attacks. |
| Xygeni Malware Defense | Real-time detection and quarantine of malicious open-source components as they are published or updated across DevOps. |

## Matrix Coverage

Mapped to the [AI Defense Matrix](https://aidefensematrix.com) [\[f4\]](#company-detail-sources):

| Asset | Govern | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|---|
| AI-Generated Code |  |  | ✓ | ✓ |  |  |

Xygeni DevAI scans AI-generated and human-written code in real time inside the IDE for vulnerabilities, secrets, and unsafe APIs and delivers automated fixes. This capability is mapped to the AI Defense Matrix.

Mapped to the [Cyber Defense Matrix](https://cyberdefensematrix.com) [\[f5\]](#company-detail-sources):

| Asset | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|
| Applications | ✓ | ✓ | ✓ |  |  |

The Xygeni ASPM platform inventories and prioritizes application risk across the software lifecycle, blocks vulnerabilities and secrets from entering the pipeline, and detects malicious open-source components in real time. These capabilities are mapped to the Cyber Defense Matrix.

## Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

**Emerging (24/40)**

Analyzed 2026-07-09. Scope: whole company.

| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity | 3/5 | Xygeni names the CISO and DevSecOps buyer, but the pain (vulnerabilities and secrets entering the pipeline) stays qualitative and category-generic, and the third-party grounding is limited to the CyberDB directory, which restates vendor positioning rather than independently quantifying it. \[[s1](#profile-analysis-sources), [s8](#profile-analysis-sources), [s3](#profile-analysis-sources), [s9](#profile-analysis-sources)\] |
| Capability Depth | 4/5 | Public GitBook documentation covers each product line, the DevAI page details incremental SAST, IDE integrations, and a fix-evaluation server, and the Fintonic case study supplies an external validation point. That depth of public technical material supports a strong score. An independent vendor directory corroborates the AI SAST and IDE-native scanning capabilities. \[[s6](#profile-analysis-sources), [s2](#profile-analysis-sources), [s5](#profile-analysis-sources), [s9](#profile-analysis-sources)\] |
| Market Timing | 3/5 | ASPM is an established buyer category, giving one real signal, but with dated timing evidence absent from the cited pages, demand for securing AI-generated code is vendor-argued rather than shown through analyst notes, budget-line, or named adoption, and the CyberDB listing restates positioning, leaving buyer-side demand indirect. \[[s1](#profile-analysis-sources), [s8](#profile-analysis-sources), [s2](#profile-analysis-sources), [s9](#profile-analysis-sources)\] |
| Team Credibility | 3/5 | The founders are identifiable, with Jesús Martín as CEO and Luís Rodríguez as CTO, and Xygeni describes a team of experienced security researchers and engineers, but no verifiable prior exit or sustained publication record appears in public sources. \[[s3](#profile-analysis-sources)\] |
| GTM Proof | 3/5 | Two named references, Fintonic and Adaion, describe production use, supported by customer logos and a self-serve free trial, but the reference base is thin for an enterprise platform. The thin reference base holds the score down, short of what more named accounts would earn. \[[s5](#profile-analysis-sources), [s10](#profile-analysis-sources)\] |
| Funding Efficiency | 2/5 | The single disclosed round of about four million euros from June 2023 carries no follow-on and no disclosed revenue, a stale seed past a normal cycle that is also undersized for the broad enterprise AppSec motion the eight product lines imply. \[[s4](#profile-analysis-sources), [s6](#profile-analysis-sources), [s11](#profile-analysis-sources)\] |
| Category Clarity | 4/5 | Xygeni fits the established ASPM and AppSec categories that buyers and analysts already place without vendor coaching, reinforced by category awards. That established category fit supports a strong score, short of the top level which stronger analyst recognition would require. \[[s8](#profile-analysis-sources), [s7](#profile-analysis-sources), [s1](#profile-analysis-sources), [s9](#profile-analysis-sources), [s12](#profile-analysis-sources)\] |
| Incumbent Defensibility | 2/5 | The platform is broad, but each capability, including in-IDE scanning of AI-generated code, is a plausible feature release for GitHub, a larger scanner, or an AI coding tool already adjacent to the buyer. Breadth lifts it above the floor, but it stays below the level that deeper workflow embedding would earn. \[[s1](#profile-analysis-sources), [s2](#profile-analysis-sources)\] |

### Business Risks

- GitHub or an AI coding tool such as Cursor could add in-IDE scanning of the code it generates as a native feature, removing the differentiation Xygeni leads its homepage with.
- A larger scanner such as Snyk or Checkmarx could match Xygeni's all-in-one breadth and outspend it on enterprise go-to-market, where Xygeni's public reference base is currently thin.
- Xygeni shows two named references and vendor-published figures as its public proof, so a buyer requiring a broad slate of enterprise references could find the evidence insufficient.
- A single disclosed funding round of about four million euros may be too little to fund the enterprise sales motion the broad platform implies, slowing expansion beyond its current mostly-smaller accounts.

### Problem & Market

Xygeni addresses the security team that has to find and fix risk across the entire software development lifecycle without slowing engineering. The company frames the problem as securing the software supply chain from code to cloud, covering source code, open-source dependencies, secrets, infrastructure-as-code, CI/CD pipelines, and the malicious packages that enter through them.

The buyer is named clearly. Xygeni sells to security and DevSecOps leaders, and its Fintonic reference is a CISO-CTO who describes the platform as central to the security strategy. The pain is concrete and current: vulnerabilities, exposed secrets, and misconfigurations reaching production faster as AI coding assistants increase the volume of code.

The market context is favorable. Application Security Posture Management is a recognized buyer category, and the security of AI-generated code is an active concern, so Xygeni speaks to demand that buyers are already funding rather than a need it has to argue into existence. \[[s1](#profile-analysis-sources), [s8](#profile-analysis-sources), [s3](#profile-analysis-sources), [s5](#profile-analysis-sources)\]

### Product Capabilities

Xygeni ships an unusually broad platform for its stage. The product set spans ASPM, SAST, SCA, DAST, secrets, IaC, CI/CD security, build security, malware defense, and anomaly detection, with a CoreAI engine that prioritizes findings. Public GitBook documentation covers each line, which is a stronger evidence base than marketing pages alone.

DevAI is the AI-first lead. Xygeni describes it as embedded inside modern IDEs, where developers interact with it through the IDE's Copilot or agent chat window, and names VS Code, IntelliJ, Cursor, and Windsurf as examples. It performs incremental static analysis as developers type, flags vulnerable patterns, exposed secrets, and unsafe APIs in both human and AI-generated code, and proposes automated fixes. A fix-evaluation server checks each proposed change for breaking-change risk before a developer approves it.

The capability that earns the AI Defense Matrix placement is DevAI's scanning of AI-generated code. The capability appears to apply the same scanning engine that Xygeni already ran across the pipeline, now moved to the moment AI writes the code rather than the moment it reaches a build. \[[s6](#profile-analysis-sources), [s2](#profile-analysis-sources), [s1](#profile-analysis-sources), [s9](#profile-analysis-sources)\]

### Competitive Positioning

Xygeni competes in a crowded AppSec field by consolidating tools that buyers often purchase separately. Its closest rivals are ASPM and AppSec-platform vendors that sell the same developer-native scanning and remediation pitch to the same buyer.

Capital is the defining structural constraint. Xygeni has disclosed one funding round of about four million euros, so it competes on breadth rather than on capital or installed base.

The platform also sits downstream of a second kind of competitor. GitHub and the AI coding tools whose output DevAI scans can add in-IDE security checks to their own products, which would contest the AI-generated-code position Xygeni now leads with. Its defense is the all-in-one span across the lifecycle, which a single-feature bundler does not match. \[[s1](#profile-analysis-sources), [s4](#profile-analysis-sources), [s2](#profile-analysis-sources)\]

### Go-to-Market & Traction

Xygeni's go-to-market is self-serve at the front, with a free trial and product tour, layered over a direct sales motion aimed at security leaders. The public proof of demand is concentrated rather than broad.

Two references, Fintonic and Adaion, are named with attributed CISO quotes, and Fintonic carries a vendor-published figure of a 75 to 90 percent reduction in the time to prioritize security tasks. Beyond that, the site shows customer logos and a set of category awards from a single industry awards program. The awards and the case-study numbers come from Xygeni's own channels, so they evidence a working demand-generation engine more than independent enterprise validation.

The honest read is that named, referenceable traction is thin for a platform positioned across the full enterprise AppSec stack. That is consistent with an early-stage company building its reference base, but a buyer that requires multiple enterprise references would not yet find them in public materials. \[[s5](#profile-analysis-sources), [s7](#profile-analysis-sources), [s1](#profile-analysis-sources)\]

### Team & Credibility

Xygeni's leadership is publicly identifiable. Jesús Martín is CEO and co-founder, Luís Rodríguez is CTO and co-founder, and Jesús Cuadrado is Chief Product Officer, each with a public profile.

The company describes a team of researchers and engineers with decades of experience in product development and cybersecurity, backed by an advisory board of cybersecurity leaders. That establishes domain competence consistent with the breadth of product shipped.

What the public record does not show is a verifiable prior exit or a sustained, recognized publication record that would lift the team to the level of repeat founders with a proven track record in the same category. The signals support credibility at the level of an experienced first-time-scale team rather than serial category builders. \[[s3](#profile-analysis-sources)\]

### Trust Readiness

Xygeni's homepage says it operationalizes the secure SDLC practices required by leading security and regulatory frameworks, shown with framework badges under a heading about operating in regulated environments. Read in context, these present the frameworks the platform helps customers satisfy rather than Xygeni's own audited attestations, and the badge images carry no certifying detail.

No inspectable trust center was found in the public record. Probes of the usual locations, including trust and security subdomains and the compliance, security, and trust-center paths, did not resolve, and the AI Defense Matrix Catalog records no compliance attestation for the DevAI product.

The practical implication is that a buyer with a hard compliance gate would need to request Xygeni's own attestation status directly, since the public materials document framework alignment rather than a published, third-party-audited certification. \[[s1](#profile-analysis-sources)\]

### Competitors

| Company | Relationship | Note |
|---|---|---|
| Cycode | competes with | Developer-native ASPM and code-to-cloud supply-chain platform contesting the same AppSec buyer with the same real-time scanning and remediation pitch. |
| Apiiro | competes with | ASPM platform mapping application risk from code to runtime for the same AppSec and DevSecOps buyer. |
| Arnica | competes with | Developer-native ASPM that, like Xygeni, has re-centered its pitch on securing AI-written code. |
| Snyk | competes with | Developer-security vendor whose SAST and SCA overlap Xygeni's scanning lines. |
| Endor Labs | competes with | Software-supply-chain and dependency-security specialist contesting Xygeni's SCA and open-source risk coverage. |

## Strategy Deep Dive

A closer look at the company's product strategy, measuring how [defensible](https://zeltser.com/scoring-security-product-strategy) it is against market forces and examining the [eight areas](https://zeltser.com/security-product-creation-framework) behind it.

### Defensibility

**Exposed (12/21)**

Band guidance: pivot urgently. Analyzed 2026-07-16. Scope: whole company.

Xygeni's differentiators are reproducible, so its edge is being early and broad rather than holding a durable moat. The platform spans the AppSec lifecycle and places scanning where AI writes code, but the detection uses conventional static and dependency analysis a funded rival can match. Xygeni names no proprietary dataset in its public materials, shows no audited certification that would slow a switch, and embeds in IDEs and code hosts that could add the same in-IDE check themselves. The hardest part for a rival to take is the breadth assembled on one disclosed four-million-euro round and the workflow a team wires into its pipeline. That is a head start, not a lasting lead, best for buyers consolidating tools and weakest against a larger scanner.

| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery | 1/3 | Xygeni is software the customer configures and runs, with AI auto-fix and prioritization as product output rather than a service that accepts accountability for outcomes. \[[s2](#deep-dive-sources), [s8](#deep-dive-sources)\] |
| Switching Cost | 2/3 | Wiring Xygeni into source control and pipelines accumulates some workflow reliance, but a rival scanner serves the same interface and the integration is replaceable. \[[s6](#deep-dive-sources), [s8](#deep-dive-sources)\] |
| Compliance Moat | 1/3 | Xygeni shows no audited certification of its own, the homepage badges are framework alignment, and no trust center was found, so there is no procurement lock. \[[s1](#deep-dive-sources), [s14](#deep-dive-sources)\] |
| Problem Complexity | 3/3 | Securing the full software lifecycle across many languages, package ecosystems, and developer tools is genuinely hard engineering, which the breadth of the documented platform reflects. \[[s6](#deep-dive-sources), [s1](#deep-dive-sources)\] |
| Buyer Profile | 2/3 | Xygeni sells to the CISO and DevSecOps buyer, but its proven accounts are two named references, Fintonic and Adaion, plus customer logos rather than established enterprises. \[[s5](#deep-dive-sources), [s10](#deep-dive-sources)\] |
| Layer | 2/3 | Xygeni operates in the development pipeline and IDE rather than in the production runtime path, so removing it costs coverage rather than breaking running systems. \[[s2](#deep-dive-sources), [s8](#deep-dive-sources)\] |
| Proprietary Data, Content, or IP | 1/3 | Xygeni names no non-public dataset in its public materials, and the detection content a funded rival could not assemble is not evidenced. \[[s8](#deep-dive-sources), [s1](#deep-dive-sources)\] |

### Strategic Market Segmentation

Xygeni targets the security leader and DevSecOps team that has to secure code, dependencies, and pipelines across the development lifecycle without slowing engineering. It frames the buyer as the security and DevSecOps leaders who own software-supply-chain risk, and its named references are headed by a CISO-CTO and a CISO.

The public proof runs below the enterprise positioning the platform implies. The two named references are Fintonic, a fintech company, and Adaion, and the cited pages show customer logos and case studies rather than large-enterprise reference detail. The publicly proven base is limited to those named references and logos, with no large-enterprise reference detail shown, even though the platform addresses an enterprise-grade problem.

The segmentation strategy is consolidation. Xygeni sells one platform spanning tools a buyer often purchases from several vendors, which fits a buyer that wants fewer contracts and one console rather than best-of-breed point tools. \[[s3](#deep-dive-sources), [s5](#deep-dive-sources), [s10](#deep-dive-sources), [s12](#deep-dive-sources)\]

### Product Capabilities & AI Advantages

Xygeni's capability set is broad and documented. Public GitBook guides cover ASPM, SAST, DAST, SCA, secrets, and CI/CD security, and the platform adds IaC, build security, malware defense, and anomaly detection. Xygeni positions CoreAI as the risk-intelligence and orchestration layer over the scanners, paired with AI auto-fix remediation.

DevAI is the AI-specific product Xygeni promotes most prominently. Xygeni describes it as embedded inside modern IDEs, where developers interact with it through the IDE's Copilot or agent chat window, and names VS Code, IntelliJ, Cursor, and Windsurf as examples. It performs incremental static analysis as developers type, flags vulnerabilities, secrets, and unsafe APIs in human and AI-generated code, and proposes automated fixes that a server first checks for breaking-change risk.

The AI advantage comes from applying scanning where AI writes code rather than from a proprietary model. DevAI appears to extend Xygeni's existing static-analysis and remediation capabilities into the IDE, so Xygeni differentiates on placement and integration rather than on a detection technology a rival could not build. \[[s6](#deep-dive-sources), [s2](#deep-dive-sources), [s1](#deep-dive-sources)\]

### Sales Engagement & Go-to-Market

Xygeni runs a self-serve top of funnel layered over direct sales. The site offers a free trial and a product tour, and the broader motion targets security leaders through case studies, awards, and a demo request.

The public selling signals are vendor-controlled. The category awards come from a single industry awards program, and the headline customer outcome, a 75 to 90 percent reduction in prioritization time, is published by Xygeni in its own case study rather than reported independently. These show a working demand-generation engine more than independent validation of scale.

The traction gap is the honest read. Two named references and a set of customer logos is thin proof for a platform pitched across the full enterprise AppSec stack, which is consistent with an early-stage company still building its referenceable base. \[[s5](#deep-dive-sources), [s7](#deep-dive-sources), [s1](#deep-dive-sources)\]

### Pricing Model

The homepage and ASPM pages carry free-trial and book-a-demo paths and a Pricing link, and the live pricing page publishes the unit and the ladder: annual subscriptions sized by contributors and daily scans, a Standard plan listed from 2,160 dollars billed annually, a Premium tier, and a custom Enterprise plan, each with a free-trial path. Published contributor-based pricing fits the consolidation pitch, letting a buyer compare the bundled cost against point tools before a sales conversation. \[[s1](#deep-dive-sources), [s8](#deep-dive-sources), [s13](#deep-dive-sources)\]

### Product Delivery & Operations

Xygeni delivers as a platform that integrates into existing developer tooling. The official documentation states on-premise support, and a third-party vendor profile indicates a SaaS option as well. The platform connects into source-code managers and CI systems across the development pipeline.

The operational model is scan-and-remediate across the lifecycle. Xygeni performs real-time detection across open-source dependencies and other SDLC assets, prioritizes exploitable and business-critical risk, and proposes or automates fixes, with DevAI adding incremental scanning inside the IDE and a fix-evaluation step before changes are applied.

What the public record does not document is the operational maturity a large enterprise would probe, such as published uptime commitments, support tiers, or scale references. The documentation establishes the product's operating model, not its performance or large-enterprise scale. \[[s6](#deep-dive-sources), [s2](#deep-dive-sources), [s9](#deep-dive-sources)\]

### Earning Customers' Trust

Xygeni's homepage says it operationalizes the secure SDLC practices required by leading security and regulatory frameworks, shown with framework badges. Read in context, these present the frameworks the platform helps customers meet rather than Xygeni's own audited attestations, and the badge images carry no certifying detail.

No trust center or vendor certification page is visible in the cited public materials, and a 2026-07-16 probe found the trust and security subdomains unregistered and the /trust, /security, /compliance, and /trust-center paths returning 404. The public materials document framework alignment, not a published third-party certification.

The practical effect is a trust gap for compliance-sensitive buyers. A buyer with a hard certification requirement would have to request Xygeni's own attestation status directly, since the site does not establish that Xygeni itself holds an audited SOC 2 or ISO 27001. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s14](#deep-dive-sources)\]

### Platform Strategy & Ecosystem Positioning

Xygeni positions itself as the consolidation layer rather than a point tool, and its CoreAI engine can apply insights to its own findings and to third-party tool output. That broadens the platform claim from Xygeni's scanners alone toward an orchestration role over a buyer's existing stack.

The ecosystem dependency runs the other way too. DevAI scans the output of AI coding tools and embeds in their IDEs, which makes Xygeni a complement to platforms such as GitHub and the AI coding assistants rather than a peer that controls its own distribution.

That position carries a structural risk. The same platforms whose surfaces Xygeni plugs into, the IDEs and code hosts and AI coding tools, are the parties best placed to add in-IDE scanning of the code they generate, which would contest the AI-generated-code position Xygeni now leads with. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s9](#deep-dive-sources)\]

### Team & Execution Capability

Xygeni's leadership is publicly identifiable, with Jesús Martín as CEO and co-founder, Luís Rodríguez as CTO and co-founder, and Jesús Cuadrado as Chief Product Officer. The company says it is backed by an advisory board of cybersecurity leaders, though the cited pages do not name the advisors.

The company describes a team of researchers and engineers with decades of experience in product development and cybersecurity, which is consistent with the breadth of documented product relative to the public funding record. That output per disclosed dollar is a credible signal for an early-stage team.

The cited materials establish current roles and broad experience without documenting a prior exit or a sustained publication record. On that record the team reads as experienced and capable rather than as documented repeat category builders, which matters when the company is asking enterprise buyers to consolidate onto its platform. \[[s3](#deep-dive-sources), [s6](#deep-dive-sources), [s11](#deep-dive-sources)\]

## Sources

### Company Detail Sources

Cited from the Sourced Details and Matrix Coverage rows.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | [About Xygeni Security](https://xygeni.io/about/) | official | 2026-06-25 |
| f2 | [CyberDB: Xygeni vendor profile](https://www.cyberdb.co/vendor/xygeni/) | research | 2026-07-02 |
| f3 | [Nordic9: Xygeni raised EUR 4 million from investors led by Investing Profit Wisely IPW](https://nordic9.com/news/xygeni-raised-4-million-from-investors-led-by-investing-profit-wisely-ipw/) | press | 2026-06-25 |
| f4 | [Xygeni DevAI: Agentic AI Security for AppSec and Remediation](https://xygeni.io/dev-ai/) | official | 2026-06-25 |
| f5 | [Xygeni ASPM: Application Security Posture Management](https://xygeni.io/aspm-application-security-posture-management/) | official | 2026-06-25 |

### Profile Analysis Sources

Cited from the Market Readiness section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Xygeni: All-In-One AppSec Platform](https://xygeni.io/) “AppSec for an AI-First World. Built for AI-Generated Code. Built for Regulated Environments: Xygeni operationalizes secure SDLC practices required by leading security and regulatory frameworks. Products include DevAI, CoreAI, SAST, SCA, DAST, Secrets, CI/CD, IaC, ASPM, and Malware Defense.” | official | 2026-06-25 |
| s2 | [Xygeni DevAI: Agentic AI Security for AppSec and Remediation](https://xygeni.io/dev-ai/) “DevAI is Xygeni's agentic AI for AppSec, embedded directly inside modern IDEs. It analyzes human and AI-generated code in real time, explains exploit paths, and delivers safe, automated fixes without breaking developer flow.” | official | 2026-06-25 |
| s3 | [About Xygeni Security](https://xygeni.io/about/) “We are Xygeni, the All-in-One AppSec Platform that simplifies security across the Software Supply Chain. Leadership: Jesús Martín, CEO - Co-founder. Luís Rodríguez, CTO - Cofounder. Jesús Cuadrado, Chief Product Officer.” | official | 2026-06-25 |
| s4 | [Nordic9: Xygeni raised EUR 4 million from investors led by Investing Profit Wisely IPW](https://nordic9.com/news/xygeni-raised-4-million-from-investors-led-by-investing-profit-wisely-ipw/) “Xygeni raised EUR 4 million from investors led by Investing Profit Wisely IPW. Security Software Services 15 June 2023” | press | 2026-06-25 |
| s5 | [Fintonic Case Study: Reduces Security Task Time by Up to 90 Percent with Xygeni](https://xygeni.io/xygeni-fintonic-case-study/) “75-90% reduction in the time required to prioritize security tasks. Enrique Cervantes, CISO-CTO Fintonic.” | official | 2026-06-25 |
| s6 | [Xygeni User Guides: product documentation](https://docs.xygeni.io/) “Xygeni Products: Application Security Posture Management (ASPM), Code Security (SAST), Dynamic Application Security Testing (DAST), Open Source (SCA), CI/CD Security, Secrets Security.” | official | 2026-06-25 |
| s7 | [Xygeni Wins Two Global InfoSec Awards for ASPM and GenAI Application Security](https://xygeni.io/blog/xygeni-wins-two-global-infosec-awards-for-aspm-and-genai-application-security/) “Hot Company in Application Security Posture Management 2026. Hot Company in GenAI Application Security.” | official | 2026-06-25 |
| s8 | [Xygeni ASPM: Application Security Posture Management](https://xygeni.io/aspm-application-security-posture-management/) “Deliver real-time visibility, prioritization, and remediation, simplifying security from code to cloud for your teams. Block vulnerabilities, unsafe code, and risky configurations from entering your pipeline.” | official | 2026-06-25 |
| s9 | [CyberDB: Xygeni vendor profile](https://www.cyberdb.co/vendor/xygeni/) “Xygeni Security delivers end-to-end protection for the modern software supply chain with a unified ASPM platform that secures everything from code to cloud. Powered by AI, Xygeni enhances accuracy with AI SAST and generates safe fixes with AI Auto-Fix.” | press | 2026-06-25 |
| s10 | [Xygeni homepage: customer logos and case studies](https://xygeni.io/) “Top Companies Trust Us with Their Software Supply Chain Security: bkool, onum, Naptive, fintonic, adaion, metricool, arexdata. Adaion Minimizes Risk Prioritization Effort and Blocks Zero-Day Malware Attacks. Oscar J. Garcia Perez, CISO of Adaion.” | official | 2026-06-25 |
| s11 | [El Referente: Xygeni Security recibe una inversión de cuatro millones de euros liderada por Investing Profit Wisely](https://elreferente.es/inversiones/xygeni-security-recibe-una-inversion-de-cuatro-millones-de-euros-liderada-por-investing-profit-wisely/) “Xygeni Security recibe una inversión de cuatro millones de euros liderada por Investing Profit Wisely” | press | 2026-06-30 |
| s12 | [EU-Startups: The new face of Madrid, 10 startups defining the city's entrepreneurial spirit](https://www.eu-startups.com/2024/11/the-new-face-of-madrid-10-startups-defining-the-citys-entrepreneurial-spirit/) “Xygeni provides robust security solutions for software development, focusing on Application Security Posture Management (ASPM) to secure the entire software supply chain.” | press | 2026-06-30 |

### Deep-Dive Sources

Cited from the Strategy Deep Dive section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Xygeni: All-In-One AppSec Platform](https://xygeni.io/) “AppSec for an AI-First World. Built for AI-Generated Code. Built for Regulated Environments: Xygeni operationalizes secure SDLC practices required by leading security and regulatory frameworks. Products include DevAI, CoreAI, SAST, SCA, DAST, Secrets, CI/CD, IaC, ASPM, and Malware Defense.” | official | 2026-06-25 |
| s2 | [Xygeni DevAI: Agentic AI Security for AppSec and Remediation](https://xygeni.io/dev-ai/) “DevAI is Xygeni's agentic AI for AppSec, embedded directly inside modern IDEs. It analyzes human and AI-generated code in real time and delivers safe, automated fixes, through your IDE Copilot or agent chat window, for example in VS Code, IntelliJ, Cursor, or Windsurf.” | official | 2026-06-25 |
| s3 | [About Xygeni Security](https://xygeni.io/about/) “We are Xygeni, the All-in-One AppSec Platform that simplifies security across the Software Supply Chain. Leadership: Jesús Martín, CEO - Co-founder. Luís Rodríguez, CTO - Cofounder. Jesús Cuadrado, Chief Product Officer.” | official | 2026-06-25 |
| s4 | [Nordic9: Xygeni raised EUR 4 million from investors led by Investing Profit Wisely IPW](https://nordic9.com/news/xygeni-raised-4-million-from-investors-led-by-investing-profit-wisely-ipw/) “Xygeni raised EUR 4 million from investors led by Investing Profit Wisely IPW. Security Software Services 15 June 2023” | press | 2026-06-25 |
| s5 | [Fintonic Case Study: Reduces Security Task Time by Up to 90 Percent with Xygeni](https://xygeni.io/xygeni-fintonic-case-study/) “75-90% reduction in the time required to prioritize security tasks. Enrique Cervantes, CISO-CTO Fintonic.” | official | 2026-06-25 |
| s10 | [Xygeni homepage: customer logos and case studies](https://xygeni.io/) “Top Companies Trust Us with Their Software Supply Chain Security: bkool, onum, Naptive, fintonic, adaion, metricool, arexdata. Adaion Minimizes Risk Prioritization Effort and Blocks Zero-Day Malware Attacks. Oscar J. Garcia Perez, CISO of Adaion.” | official | 2026-06-25 |
| s6 | [Xygeni User Guides: product documentation](https://docs.xygeni.io/) “Xygeni Products: Application Security Posture Management (ASPM), Code Security (SAST), Dynamic Application Security Testing (DAST), Open Source (SCA), CI/CD Security, Secrets Security.” | official | 2026-06-25 |
| s7 | [Xygeni Wins Two Global InfoSec Awards for ASPM and GenAI Application Security](https://xygeni.io/blog/xygeni-wins-two-global-infosec-awards-for-aspm-and-genai-application-security/) “Hot Company in Application Security Posture Management 2026. Hot Company in GenAI Application Security.” | official | 2026-06-25 |
| s8 | [Xygeni ASPM: Application Security Posture Management](https://xygeni.io/aspm-application-security-posture-management/) “Deliver real-time visibility, prioritization, and remediation, simplifying security from code to cloud for your teams. Block vulnerabilities, unsafe code, and risky configurations from entering your pipeline.” | official | 2026-06-25 |
| s9 | [CyberDB: Xygeni vendor profile](https://www.cyberdb.co/vendor/xygeni/) “Xygeni Security delivers end-to-end protection for the modern software supply chain with a unified ASPM platform that secures everything from code to cloud. Powered by AI, Xygeni enhances accuracy with AI SAST and generates safe fixes with AI Auto-Fix.” | press | 2026-06-25 |
| s11 | [El Referente: Xygeni Security recibe una inversión de cuatro millones de euros liderada por Investing Profit Wisely](https://elreferente.es/inversiones/xygeni-security-recibe-una-inversion-de-cuatro-millones-de-euros-liderada-por-investing-profit-wisely/) “Xygeni Security recibe una inversión de cuatro millones de euros liderada por Investing Profit Wisely” | press | 2026-06-30 |
| s12 | [EU-Startups: The new face of Madrid, 10 startups defining the city's entrepreneurial spirit](https://www.eu-startups.com/2024/11/the-new-face-of-madrid-10-startups-defining-the-citys-entrepreneurial-spirit/) “Xygeni provides robust security solutions for software development, focusing on Application Security Posture Management (ASPM) to secure the entire software supply chain.” | press | 2026-06-30 |
| s13 | [Xygeni pricing page (live 2026-07-16, contributor/scan-sized annual plans, Standard from $2,160 billed annually)](https://xygeni.io/pricing/) “Annual Subscription - Pricing Based on Your Daily Scans. Standard $2.160 billed annually. Compare our plans: Standard, Premium, Enterprise. Start Free.” | official | 2026-07-16 |
| s14 | [Probe of Xygeni trust surfaces 2026-07-16: trust and security subdomains NXDOMAIN, /trust /security /compliance /trust-center 404, no portal](https://trust.xygeni.io/) | other | 2026-07-16 |

## Disclaimer

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.