Xygeni

Xygeni is an all-in-one application security platform from a Spanish vendor founded in 2021. It runs its own scanners across the software development lifecycle and layers ASPM on top of them.

The company raised a €4M Series A in June 2023, led by the Spanish investment firm Investing Profit Wisely. It has announced no funding round since.

What Xygeni is not is a pure aggregation hub in the ArmorCode mould. The scanners are Xygeni’s own, and the ASPM module is the consolidation surface sitting above them.

Two things stood out when I reviewed it. Its supply-chain side runs deeper than the category norm — SLSA provenance, in-toto attestation, and a malware early-warning feed — and its documentation names 51 third-party report formats it can import.

Xygeni sits in the ASPM category because that is where its consolidation story lives. But describing it only as ASPM undersells the breadth, and describing it only as a scanner suite misses the point of the platform.

What is Xygeni?

Xygeni is an application security platform that combines native scanning across the SDLC with a posture-management layer that consolidates findings into one prioritized risk view.

The native side covers SAST, SCA, secrets detection, IaC security, CI/CD pipeline security, container images, DAST, API security, build integrity, and anomaly detection.

The ASPM side inventories SDLC assets, maps code-to-cloud context, and ingests findings from other vendors’ scanners so the queue is not limited to what Xygeni itself found.

The company is headquartered in Valladolid, Spain. Jesús Martín is CEO and co-founder, Luís Rodríguez is CTO and co-founder, and Jesús Cuadrado is Chief Product Officer.

Does Xygeni upload your source code?

Not during a scan. Xygeni’s documentation states that scans execute locally inside your own network and only results are uploaded, so source code does not leave your infrastructure to be analyzed.

There is one documented exception: auto-remediation. When Xygeni generates a fix, the file being changed is uploaded and then removed from Xygeni’s systems immediately after the change.

So the accurate version of the claim is narrower than “source code never leaves”. Code stays local for scanning; the specific files you ask Xygeni to fix do transit its systems.

What are Xygeni’s key features?

Xygeni’s platform spans 11 modules: SAST, SCA, secrets, IaC, CI/CD security, container scanning, DAST, API security, build integrity, anomaly detection, and ASPM.

What does Xygeni scan?

Those 11 modules each inspect a different part of the SDLC. The table groups them the way the documentation does, pairing DAST with API security and folding container images into the scanners that cover them.

Which languages does Xygeni support?

Xygeni’s SAST covers 9 core languages natively, with curated rule packs adding 5 more.

That is a narrower language surface than SonarQube or Checkmarx offer. For teams on the JVM, .NET, or a JavaScript stack it is enough; for COBOL, ABAP, or Apex shops it is not.

How does Xygeni ingest third-party scanner findings?

Xygeni’s ASPM module ingests findings from 51 documented third-party report formats. The xygeni report-upload CLI command normalizes that output into the platform.

Three ingestion modes exist. The default converts and uploads a report file the tool already wrote to disk.

A pull mode has the scanner call the tool’s own API — SonarQube and SonarCloud, Kiuwan, Checkmarx One, Prisma Cloud, and Wiz CNAPP. A push mode accepts an inbound webhook instead.

Generic SARIF parsers cover every category, and CycloneDX and SPDX SBOMs can be ingested either as dependency inventory or as SCA findings. Anything that emits SARIF has a path in.

There is an important caveat. On the published pricing table, “Third Party Tools Integration (SAST, SCA, Secrets, and others)” is marked Enterprise-only, as are advanced correlation and complete application risk management.

The Team and Business tiers get the ASPM asset inventory, code-to-cloud context, and prioritization, but they only see Xygeni’s own findings. If ingesting your existing scanner estate is the reason you are looking, budget for Enterprise.

How does Xygeni handle software supply chain security?

Xygeni leans harder on software supply chain than most ASPM vendors. Its Malware Early Warning service flags suspicious packages as they are published, and researchers confirm the findings against the public registries.

The research output backs this up. Xygeni’s blog publishes named malware write-ups like QuietPolyfill and PointBlank, so there is a working threat-intelligence team behind the product.

Build Security is the other differentiator. SLSA provenance generation, in-toto attestations, artifact signature verification, and tampering detection each get their own module.

Xygeni also documents quantum-safe compliance with CBOM (cryptographic bill of materials) reporting. That is unusual in this category and worth a look if post-quantum readiness is on your roadmap.

What does Xygeni integrate with?

The platform connects to eight SCM and CI/CD systems: Azure Pipelines, Bitbucket, CircleCI, GitLab, GitHub, Jenkins, TravisCI, and Tekton. Dependency resolution covers 14 package managers.

Ticketing is thinner. Jira, GitHub Issues, GitHub Alerts, GitLab Alerts, and Slack are the documented targets — no Linear, no ServiceNow, no CMDB integration.

How does Xygeni’s AI pricing work?

The AI layer splits into DevAI (an IDE agent for detection and remediation) and CoreAI (risk intelligence and orchestration across Xygeni and third-party findings).

AI runs on a credit model. Autofix, triage, and attack-path explanations all consume credits that scale with code size and context, and operations pause when the balance runs out. Bringing your own LLM avoids the credit spend entirely.

How does Xygeni compare to Cycode, Aikido, and ArmorCode?

Read that ingest row as four different units, not a ranking. Xygeni counts report formats it can parse; the other three publish connector counts, which vendors do not define identically.

Xygeni vs Cycode

Cycode is the closest architectural peer. Both run native scanners and both put an ASPM correlation layer on top, so this is a comparison of scale and posture rather than shape.

Cycode is the heavier platform. Its Context Intelligence Graph maps code-to-runtime context with natural-language querying, it advertises 100+ ConnectorX integrations, and its next-generation SAST came from the Bearer acquisition in April 2024.

Cycode also carries the enterprise proof points. Named customers include NielsenIQ, Cribl, UBS, and Elastic, and its compliance automation spans SSDF, ISO, SOC 2, CIS, DORA, and PCI.

Xygeni counters on transparency and entry cost. Its pricing is published in euros with a permanent free tier, while Cycode requires a sales conversation before you learn what anything costs.

The trade-off is depth of consolidation, though the published numbers do not settle it. Cycode counts connectors and Xygeni counts report formats, so 100+ against 51 is not a like-for-like comparison.

What is comparable is the packaging. Xygeni gates third-party ingestion behind Enterprise; Cycode does not appear to gate it by tier at all.

Pick Cycode if you are consolidating a large, multi-business-unit scanner estate and need analyst-grade correlation with named enterprise references. Pick Xygeni if you want a single-vendor scanner stack with deeper build-integrity coverage and can live with a narrower third-party ingest surface.

Xygeni vs Aikido Security

Aikido Security is the sharper competitive threat, because it targets the same buyer: a team that wants one platform rather than five, without an enterprise procurement cycle.

Both bundle SAST, SCA, DAST, IaC, secrets, and container scanning into one product with a free tier. Both pitch noise reduction as the headline benefit.

Aikido is further ahead on adoption and on runtime. It reports 50,000+ organizations, names customers like Revolut and the Premier League, holds SOC 2 Type II and ISO 27001:2022, and ships the Zen in-app firewall for production protection.

Aikido’s pricing model is also friendlier to growing teams: flat-rate with unlimited users. Xygeni prices by contributor, counting anyone with at least one commit to a scanned repository in the past 90 days, so cost tracks headcount.

Xygeni’s edge is supply-chain depth. Build integrity with SLSA and in-toto attestations, pipeline malicious-command detection, anomaly detection on developer behaviour, and CBOM reporting have no direct Aikido equivalent.

Xygeni is also the only one of the two with a documented on-premise distribution, which matters for regulated environments that cannot use a pure SaaS backend.

Pick Aikido for reported adoption scale (50,000+ organizations), flat per-team pricing, and runtime protection in the same subscription. Pick Xygeni if the risk you are actually funding is software supply chain integrity: build attestation, pipeline tampering, registry malware.

Xygeni vs ArmorCode

ArmorCode sits at the opposite end of the ASPM design space. It runs no scanners of its own and exists purely to ingest, deduplicate, correlate, and route what your existing tools already produce.

That difference decides the comparison. ArmorCode reports 320+ integrations and over 40 billion findings processed, and it was named a Leader in the IDC MarketScape: Worldwide ASPM 2025 Vendor Assessment.

The two counts measure different things: ArmorCode publishes integrations, Xygeni publishes report formats. The scope gap is still visible, and Xygeni holds no comparable analyst placement.

If your problem is a dozen scanners producing an unmanageable duplicate backlog, ArmorCode is built for exactly that.

Xygeni’s answer is to remove the scanner sprawl rather than manage it. One vendor for SAST, SCA, secrets, IaC, CI/CD, and DAST means far less to correlate in the first place.

Cost follows from that. ArmorCode is an enterprise purchase on top of the scanner licences you already pay for; Xygeni replaces several of those licences and starts at €0.

Pick ArmorCode if you have already standardized on best-of-breed scanners and need a neutral orchestration layer above them. Pick Xygeni if you are early enough to consolidate the scanners themselves instead of buying a manager for them.

How much does Xygeni cost?

Xygeni costs €0 on the Free plan, €3,300 per year for Team, and €5,900 per year for Business. Enterprise is a custom quote.

The figures come from Xygeni’s pricing page .

The Free plan covers SAST, SCA, secrets security, and the IDE plugin. No credit card is required and there is no time limit. It is a permanent tier, not a trial.

Team adds the things that make the platform usable day to day: AI SAST autofix, SCA reachability and autofix, secrets auto-revocation, IaC security, CI/CD security, container images, and the SDLC inventory.

Business adds malicious-command detection across pipelines, IaC, and container images, plus supply-chain compliance reporting against the CIS and OpenSSF benchmarks.

Enterprise is where DAST, API security, code quality, anomaly detection, build security, SSO, the REST API, on-premise deployment, and third-party ASPM ingestion live.

Two pricing mechanics deserve attention before you model a budget. Contributors are counted as any identity that committed to a scanned repository in the past 90 days, so a busy quarter raises the bill.

And AI is metered separately in credits, not bundled. Autofix, triage, and attack-path explanations all draw down a monthly allowance that scales with how much code each operation has to read.

What are Xygeni’s limitations?

The documented footprint is smaller than the category leaders’. The third-party catalogue is narrower, the site names no enterprise reference customers, and there is no IDC or Gartner placement to point at.

Third-party ingestion is Enterprise-only. The single capability that makes an ASPM tool an ASPM tool is gated to the top tier, which weakens the mid-market pitch considerably.

Language coverage is mid-sized. Nine core SAST languages plus five rule-pack languages will not satisfy teams running COBOL, ABAP, Apex, or Ruby as primary stacks.

No published detector count. Xygeni maintains a public detector catalogue, but neither the docs nor the marketing site state a total rule count, so rule-depth comparisons against established SAST vendors are not possible from public sources.

Ticketing and workflow integrations are thin. Jira, GitHub, GitLab, and Slack cover the basics, but there is no documented CMDB integration, no SLA tracking, and no remediation-velocity reporting — all standard in enterprise ASPM.

Analyst recognition is limited to awards. The Global InfoSec Awards from Cyber Defense Magazine (Hot Company in ASPM 2026, Hot Company in GenAI Application Security) are industry awards, not the same class of evidence as an IDC MarketScape or Gartner placement.

When should you use Xygeni?

Xygeni fits best where the goal is consolidation before orchestration. If you are running four or five point tools and want one vendor instead, the native scanner breadth is the argument.

It suits small to mid-sized engineering organizations well. The free tier is usable enough for a real evaluation, and the published Team and Business tiers each include 10 contributors.

Above 10 committers the maths stops being public. Xygeni does not publish a per-contributor overage price, so any team larger than that needs a quote before the cost is knowable.

Supply-chain-sensitive teams get the most differentiated value. Build attestation, pipeline tampering detection, registry malware monitoring, and CBOM reporting are the parts of the platform with the least direct competition.

European organizations have a secondary reason to look. Pricing in euros, EU-based engineering, and a documented on-premise distribution simplify procurement under NIS2 and the Cyber Resilience Act .

It fits less well when you already own a mature best-of-breed stack. If Snyk , Semgrep , and Wiz are entrenched, you want an orchestration layer, and you will be paying Enterprise prices to get Xygeni to ingest them.

It is also the wrong choice if SAST depth on an unsupported language is the requirement, or if procurement demands Gartner or IDC placement before signing.

What are the alternatives to Xygeni?

The closest Xygeni alternatives are Aikido Security, Cycode, ArmorCode, OX Security, DefectDojo, and Snyk. Which one fits depends on which half of Xygeni you are buying: the scanner suite or the posture layer.

For the wider field, the ASPM tools category page compares 19 platforms against the same criteria.

Teams already running open-source scanners should also weigh the DIY route. Trivy , Checkov , Gitleaks , and Semgrep into DefectDojo covers most of Xygeni’s Team tier at licence cost zero, paid for in engineering time instead.

How do you get started with Xygeni?

The free tier makes evaluation genuinely cheap, and you do not need to connect a repository to see the product.

1. Sign up for the free plan — no credit card, 5 contributors, up to 10 repositories, 200 scans per month. Preloaded demo projects let you browse example findings before touching your own code.
2. Scan without a repo connection first — the Xygeni CLI runs against a local filesystem folder, so you can point it at a checkout and see the finding quality before granting SCM access.
3. Connect an SCM and run a full scan — GitHub, GitLab, Bitbucket, or Azure Repos. A scan applies every analysis your plan includes: SAST, dependencies, inventory, secrets, SCA, IaC, and malware.
4. Wire it into CI and set guardrails — add the scanner to your pipeline, then configure security gates so builds fail on the risk classes you actually care about.

If you plan to ingest findings from other scanners, request an Enterprise quote early. That capability is not in the tiers you can self-serve, so a Team-tier trial will not tell you whether the consolidation story works for your estate.

For a broader view of how posture management fits alongside your existing scanners, see the ASPM tools category page and the ASPM vs ASOC guide.

Frequently Asked Questions