Dependency Firewall On-Device
Continuous Cyber Defense
depthfirst combines deep context from code to production with autonomous AI agents that continuously discover, fix, and prevent security risks.
Self-learning security that gets smarter over time, bringing you to inbox zero.
- Customers resolving all critical issues within 90 days
- 42%
- Novel malware detection in dependencies
- <3.5 min
- Positive sentiment from developers on findings and fix recommendations
- >70%
Our customers choose depthfirst to stay ahead of how software is secured.
How MoonPay Securely Ships New Products Faster With depthfirst
How Listen Labs Builds Safely at the Frontier of Agentic Software Development
How Chainguard Built Comprehensive Security Review Across Its Codebase and CI/CD Workflows
How Thatch Stays at Zero Critical Vulnerabilities While AI Accelerates Software Development
How AngelList Built an AI-Native Security Program with depthfirst
How Persona Increased Code-Security Coverage by 2x with depthfirst
Why Moveworks Chose depthfirst to Secure Production
“Our teams use the entire depthfirst suite. We have Dependency Firewall, PR reviews, code reviews, and Agentic Pentesting. That was what brought me to depthfirst: it covers the full cycle.”
The depthfirst security operating system is built for how modern security teams work.
-
Dependency Firewall blocks malicious packages. Security Reviewer validates every human and AI-generated code change before vulnerabilities, sensitive data, or malware enter your codebase.
-
Code Scanner reasons across business logic, data flow, and exploit chains to uncover issues other tools miss.
-
Agentic Pentester validates findings against your running application, so you only fix what’s exploitable. Security Reviewer generates merge-ready pull requests that fit into your existing workflow.
-
Agentic Pentester replays the same attack after every merge to verify the vulnerability is fully resolved.
One intelligent platform to detect, validate, and remediate security issues across your software.
-
Code
Find real vulnerabilities by tracing business logic, data flows, and cross-service interactions across your codebase.
Replacing Traditional SAST
depthfirst reasons about business logic and cross-service data flows the way a security engineer does, so the only findings you see are the ones that are genuinely exploitable.
-
Dependency Firewall
Detect malicious behavior before it spreads through your environment.
-
Agentic Pentesting
Confirm which vulnerabilities are exploitable by testing your running application with real attack paths.
Replacing Manual pentesting, Traditional DAST
depthfirst attacks your running applications continuously, proving at runtime which vulnerabilities are actually exploitable and re-testing every fix after merge.
-
Supply Chain
Trace risk through your full dependency tree and surface only the vulnerabilities with a real execution path to them.
Replacing Traditional Static SCA
depthfirst traces every dependency to the code that actually calls it, so you fix the handful of vulnerabilities with a real path into your application instead of the whole SBOM.
-
Secrets & Sensitive Data
Detect and validate credentials across your codebase, CI/CD pipelines, and runtime environments.
Advancing AI research. We develop and train efficient, security-specific agents that power every depthfirst product.
dfbench: detection
Recall
Cost per task
dfbench: validation
Precision
Recall
dfbench: differential analysis
Macro recall
Cost per task
| | ||||||||
|---|---|---|---|---|---|---|---|---|
| Thinking | Application | Low level | Smart contract | Single repo | Multi-repo | |||
| dfs-large1 | — | $6.77 | 62.2% | 66.5% | 42.4% | 62.3% | 63% | 52.6% |
| GPT 5.6 Sol | xhigh | $43.37 | 65.7% | 67.1% | 67.3% | 60.7% | 66.3% | 57.9% |
| GPT 5.6 Sol | high | $26.47 | 59.6% | 62.8% | 62.3% | 49.2% | 63.3% | 10.5% |
| GPT 5.6 Sol | med | $9.51 | 48.9% | 54.2% | 38.5% | 44.3% | 50.6% | 26.3% |
| GPT 5.6 Luna | xhigh | $2.53 | 52.4% | 56.8% | 45.1% | 47.5% | 53.2% | 42.1% |
| GPT 5.6 Luna | high | $1.57 | 39.6% | 48.4% | 23.1% | 31.1% | 40.2% | 31.6% |
| GPT 5.6 Luna | med | $0.69 | 28% | 31.6% | 15.4% | 29.5% | 29.3% | 10.5% |
| Opus 5 | high | $22.66 | 45.4% | 54.8% | 34.1% | 31.1% | 47% | 26.3% |
| Opus 5 | med | $21.89 | 47.8% | 45.8% | 57.7% | 44.3% | 48.2% | 42.1% |
| Opus 5.5 | high | $8.42 | 54.9% | 60.9% | — | 48.2% | 57.2% | 31.3% |
| Opus 5.5 | med | $7.66 | 48.1% | 57.5% | — | 35.9% | 49.7% | 31.6% |
| Grok 4.5 | high | $7.70 | 57.2% | 59.1% | 51.6% | 0% | 59.9% | 25% |
| Grok 4.7 | xhigh | $19.94 | 59.0% | 68.4% | 42.1% | 53.9% | 61.4% | 20% |
| Grok 4.7 | high | $16.02 | 56.6% | 68.4% | 15.8% | 55.1% | 57.7% | 40% |
| Kimi K3 | max | $9.10 | 48% | 31.8% | 31.8% | 30.4% | 49.8% | 34.8% |
| Kimi K3 | high | $6.22 | 46.7% | 48.4% | 51.8% | 37.9% | 48.5% | 31.6% |
| Qwen 3.8 | max | $7.91 | 40.8% | 40.8% | 40.8% | 40.8% | 40.8% | 40.8% |
| GLM 5.2 | xhigh | $9.72 | 40.7% | 34.8% | 22.4% | 44.3% | 43.4% | 20.9% |
| GLM 5.2 | high | $4.09 | 38.2% | 42.6% | 11.1% | 44.3% | 42.2% | 36.8% |
| DeepSeek v4 Flash | max | $1.23 | 31.8% | 27.6% | 29.5% | 45.9% | 32.9% | 26.3% |
| DeepSeek v4 Flash | high | $1.03 | 30.1% | 30.1% | 30.1% | 30.1% | 31.9% | 8.3% |
| Gemini 3.6 Flash | high | $7.44 | 20.9% | 19.4% | 11.5% | 32.8% | 20.9% | 21.1% |
| Mythos 5* | — | $99.19 | 69% | 70.8% | 61.4% | 71% | 70.4% | 50% |
| Gemini 3.8 Flash | high | $8.03 | 44.2% | 50.6% | 17.3% | 50.8% | 44.8% | 36.3% |
| Muse Spark 1.3 | xhigh | $10.24 | 47.4% | 55.5% | 32% | 39.3% | 48.6% | 31.6% |
| DeepSeek v4.1 Flash | high | $1.69 | 57.3% | 64.1% | 54.5% | 48.9% | 58.5% | 42.1% |
| GPT 6 Luna | xhigh | $0.43 | 45.7% | 50% | 40.4% | 39.3% | 46.4% | 36.8% |
| GPT 6 Luna | high | $0.28 | 38.1% | 43.9% | 25% | 34.4% | 39.4% | 21.1% |
| GPT 6 Luna | med | $0.15 | 37.3% | 40.6% | 26.9% | 37.7% | 38.6% | 21.1% |
| GPT 6 Sol | xhigh | $13.30 | 59.3% | 61.9% | 51.9% | 59% | 59.4% | 57.9% |
| GPT 6 Sol | high | $6.45 | 57.7% | 58.7% | 56.9% | 55.7% | 58.9% | 42.1% |
| GPT 6 Sol | med | $3.43 | 49.6% | 48.4% | 51.9% | 50.8% | 50.2% | 42.1% |
| MiMo-v2.6 Flash | — | $0.86 | 53.5% | 54.9% | 47.9% | 55.3% | 54.3% | 28.6% |
| MiMo-v2.6 Pro | — | $1.38 | 55% | 58.6% | 38.9% | 59.8% | — | — |
These results will be updated as new models and harnesses are released.
* Run with Claude Security.
| | ||||
|---|---|---|---|---|
| Thinking | F1 | |||
| dfs-large1 | — | $6.77 | 18.3% | 28.3% |
| GPT 5.6 Sol | xhigh | $43.37 | 18% | 28.3% |
| GPT 5.6 Sol | high | $26.47 | 22.3% | 32.5% |
| GPT 5.6 Sol | med | $9.51 | 24.6% | 32.7% |
| GPT 5.6 Luna | xhigh | $2.53 | 23.2% | 32.2% |
| GPT 5.6 Luna | high | $1.57 | 24.8% | 30.5% |
| GPT 5.6 Luna | med | $0.69 | 27.3% | 27.6% |
| Opus 5 | high | $22.66 | 39.4% | 42.2% |
| Opus 5 | med | $21.89 | 40.5% | 43.8% |
| Opus 5.5 | high | $8.42 | 48.5% | 51.5% |
| Opus 5.5 | med | $7.66 | 44.2% | 46.1% |
| Grok 4.5 | high | $7.70 | 29.5% | 38.9% |
| Grok 4.7 | xhigh | $19.94 | 23.9% | 34.0% |
| Grok 4.7 | high | $16.02 | 30.5% | 39.7% |
| Kimi K3 | max | $9.10 | 30.1% | 37.0% |
| Kimi K3 | high | $6.22 | 33.3% | 38.9% |
| Qwen 3.8 | max | $7.91 | 29.6% | 34.3% |
| GLM 5.2 | xhigh | $9.72 | 28.6% | 33.6% |
| GLM 5.2 | high | $4.09 | 30.8% | 34.1% |
| DeepSeek v4 Flash | max | $1.23 | 24.8% | 27.9% |
| DeepSeek v4 Flash | high | $1.03 | 26.8% | 28.4% |
| Gemini 3.6 Flash | high | $7.44 | 43.5% | 28.2% |
| Mythos 5* | — | $99.19 | 24.5% | 36.2% |
| Gemini 3.8 Flash | high | $8.03 | 41.4% | 42.8% |
| Muse Spark 1.3 | xhigh | $10.24 | 34.1% | 39.7% |
| DeepSeek v4.1 Flash | high | $1.69 | 36.4% | 44.5% |
| GPT 6 Luna | xhigh | $0.43 | 21.8% | 29.5% |
| GPT 6 Luna | high | $0.28 | 24.5% | 29.8% |
| GPT 6 Luna | med | $0.15 | 33.3% | 35.2% |
| GPT 6 Sol | xhigh | $13.30 | 15.7% | 24.8% |
| GPT 6 Sol | high | $6.45 | 18.9% | 28.5% |
| GPT 6 Sol | med | $3.43 | 22.6% | 31.1% |
| MiMo-v2.6 Flash | — | $0.86 | 24.4% | 33.5% |
| MiMo-v2.6 Pro | — | $1.38 | 18.1% | 27.2% |
These results will be updated as new models and harnesses are released.
* Run with Claude Security.
| | ||||||
|---|---|---|---|---|---|---|
| Thinking | NEW | KEPT | CLOSED | |||
| dfs-large1 | — | $1.34 | 75.6% | 45.8% | 95% | 86% |
| GPT 5.6 Sol | xhigh | $10.67 | 75.3% | 46.8% | 95% | 84.1% |
| GPT 5.6 Sol | high | $5.46 | 76.3% | 45.6% | 94.4% | 88.9% |
| GPT 5.6 Sol | med | $2.32 | 74.4% | 39.2% | 93.3% | 90.7% |
| GPT 5.6 Luna | xhigh | $0.62 | 71% | 38.9% | 89.3% | 84.8% |
| GPT 5.6 Luna | high | $0.30 | 71.3% | 32.5% | 92.4% | 89.1% |
| GPT 5.6 Luna | med | $0.13 | 65.1% | 22.2% | 79.2% | 94% |
| Opus 5 | high | $7.41 | 70.3% | 38.2% | 79.8% | 92.8% |
| Opus 5 | med | $5.48 | 71.3% | 37.4% | 83.8% | 92.8% |
| Opus 5.5 | high | $1.78 | 79.5% | 66.7% | 86.8% | 85.2% |
| Opus 5.5 | med | $1.34 | 75.3% | 47.7% | 91.5% | 86.8% |
| Grok 4.5 | high | $3.38 | 65.1% | 39.9% | 74.5% | 80.9% |
| Grok 4.7 | xhigh | $6.56 | 74.8% | 51.2% | 90.5% | 82.6% |
| Grok 4.7 | high | $6.46 | 70.3% | 43.9% | 86.3% | 80.8% |
| Kimi K3 | max | $6.34 | 60.3% | 35.5% | 72% | 73.4% |
| Kimi K3 | high | $4.18 | 60.1% | 31.4% | 75.3% | 73.5% |
| Qwen 3.8 | max | $2.99 | 72.7% | 33.6% | 95% | 89.6% |
| GLM 5.2 | xhigh | $2.04 | 61.4% | 25.5% | 85.6% | 73% |
| GLM 5.2 | high | $1.56 | 58.6% | 25.3% | 76.4% | 74.1% |
| DeepSeek v4 Flash | max | $0.79 | 66.8% | 28.4% | 83% | 89% |
| DeepSeek v4 Flash | high | $0.55 | 67.4% | 27.1% | 88.1% | 87% |
| Gemini 3.6 Flash | high | $1.51 | 61% | 18.3% | 68.9% | 96.5% |
| Mythos 5* | — | — | — | — | — | — |
| Gemini 3.8 Flash | high | $1.57 | 63.8% | 32% | 66.3% | 93.1% |
| Muse Spark 1.3 | xhigh | $3.12 | 72.8% | 47.1% | 85.1% | 86.2% |
| DeepSeek v4.1 Flash | high | $0.71 | 70.1% | 48.5% | 67.5% | 94.2% |
| GPT 6 Luna | xhigh | $0.12 | 72.1% | 44.4% | 89% | 82.9% |
| GPT 6 Luna | high | $0.09 | 72.4% | 45.8% | 91.2% | 80.1% |
| GPT 6 Luna | med | $0.07 | 69.5% | 36.1% | 87.4% | 85% |
| GPT 6 Sol | xhigh | $3.90 | 75.2% | 58.3% | 92.9% | 74.5% |
| GPT 6 Sol | high | $2.06 | 76.3% | 61.8% | 92% | 75% |
| GPT 6 Sol | med | $1.00 | 71.6% | 52.8% | 86.3% | 75.9% |
| MiMo-v2.6 Flash | — | $0.08 | 72.7% | 38.7% | 89.9% | 89.5% |
| MiMo-v2.6 Pro | — | $0.12 | 76.5% | 55.6% | 92.8% | 81.3% |
These results will be updated as new models and harnesses are released.
* Run with Claude Security.
depthfirst platform discovered, validated, and remediated hundreds of CVEs from open source projects.
- 193
- CVEs detected, discovered, validated and remediated using the depthfirst platform
- 64
- Popular open source projects are scanned and analyzed by depthfirst platform
-
Building a Faster, Cheaper Vulnerability Scanner With Jev
-
Containers Are No Longer a Security Boundary
-
Introducing dfbench v1: A cybersecurity benchmark for frontier models and agentic systems
-
Introducing dfs-large1: A New Frontier for Cybersecurity
-
Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem
-
Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities
