Skip to content
SPECIFICTION
Get listed

OX Security

ox.security

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit ox.security
Spec score 8.5 #5 of 25 in DevSecOps Platforms

What it is

OX Security is an application security platform that covers software from code through runtime, including protection in AI editors and IDEs. OX Code addresses SAST, software composition analysis, secrets and PII, SBOM, infrastructure as code, CI/CD, Git posture, containers, malicious dependencies and API discovery. OX Cloud includes runtime security, cloud posture tools, inventory and attack-path mapping; OX VibeSec applies organization-specific context to AI coding tools. OX Agentic Pentester performs AI-driven penetration testing, API assessments and proof-of-concept exploitation, with OWASP mapping. The platform lists more than 150 integrations, including GitHub, GitLab, AWS, Jira, Slack and ChatGPT. It supports hybrid deployment and lists on-premises options, SSO, automatic provisioning, MCP and API support. OX says it connects to existing tools without agents or complex setup. Pricing is available on request, based on active developers who committed code in connected source control in the past 90 days or are expected to contribute during the licensing period. The IDE extension supports Visual Studio Code and compatible environments such as Cursor, Windsurf and VSCodium.

Spec sheet

What it does
OX Security provides application security from AI-assisted coding through production runtime, linking findings back to their creation point.Read 15 Oct 2026 · ox.security
Deployment
OX says deployment takes minutes because it connects directly to existing tools without agents or complex setup.Read 30 Sep 2026 · ox.security
API
The public API retrieves applications, artifacts, issues, severity factors, and attack-path graphs, and supports policy and workflow integrations.Read 15 Oct 2026 · docs.ox.security
Integrations
Supported connections include GitHub, GitLab, Bitbucket, Azure Repos, Gerrit, AWS CodeCommit, Jenkins, Azure Pipelines, Docker Hub, JFrog, AWS, Google Cloud, Jira, Slack, Splunk, and many security scanners.Read 15 Oct 2026 · docs.ox.security
Compliance
OX states that SOC 2 Type II is available upon request and that it is GDPR compliant and ISO 27001:2022 certified.Read 30 Sep 2026 · ox.security
Headquarters
LinkedIn lists New York, New York as headquarters, while company databases identify Tel Aviv/Ramat Gan, Israel as the Israeli headquarters location.Read 15 Oct 2026 · linkedin.com
Founded
OX Security was founded in 2021.Read 15 Oct 2026 · linkedin.com
Agentic Pentester
The Agentic Pentester performs continuous AI-driven white-box web and API penetration testing, produces proof-of-concept exploits, maps findings to OWASP frameworks, and supplies remediation reports.Read 15 Oct 2026 · ox.security
Agentic pentesting
OX Agentic Pentester performs autonomous AI-driven pentesting, API security assessment, proof-of-concept exploitation and OWASP framework mapping.Read 30 Sep 2026 · ox.security
API limits
The documented API allowance is 1,000 requests per hour and 15,000 requests per day.Read 15 Oct 2026 · docs.ox.security
Automated remediation
No-code workflows can send Slack messages, open Jira tickets, create pull requests, change severity, and enforce pipeline blocks.Read 15 Oct 2026 · ox.security
CLI
OX documents a command-line scanner with pre-commit and pre-push Git hooks; the CLI scans only modified files and requires Node.js, npm, and Git.Read 15 Oct 2026 · docs.ox.security
Cloud security
OX Cloud provides AIDR, agentic attack-surface analysis, runtime security, CSPM, KSPM, DSPM, cloud inventory and attack-path mapping.Read 30 Sep 2026 · ox.security
Code security
OX Code covers SAST, SCA, secrets/PII, SBOM, IaC, CI/CD, Git posture, container scanning, malicious dependencies and API discovery.Read 30 Sep 2026 · ox.security
Company legal name
The vendor identifies itself legally as OX Appsec Security Ltd. and affiliates.Read 15 Oct 2026 · ox.security
Company size
LinkedIn lists the company size as 51–200 employees and displays 212 employees discoverable on the platform.Read 15 Oct 2026 · linkedin.com
Data controls
The Trust Center lists AWS compute hosted in the EU, MongoDB EU with data-at-rest encryption, Auth0 EU, Datadog EU and Azure OpenAI in the US for limited AI features.Read 30 Sep 2026 · ox.security
Deployment options
The platform lists on-prem deployment, enterprise-grade support, MCP and API support, SSO and automatic provisioning.Read 30 Sep 2026 · ox.security
Developer tools
OX CLI scans modified local repository files and supports Open Source Security, Code Security, SBOM, IaC and Secret/PII categories; the documentation marks it Early Access.Read 30 Sep 2026 · docs.ox.security
Documentation
The help center covers onboarding, scanners, integrations, policies, remediation, runtime sensors, multiple BOM types, workflows, reporting, administration, and API documentation.Read 15 Oct 2026 · docs.ox.security
Extension requirements
The IDE extension requires Visual Studio Code 1.96 or newer, the VS Code Git extension, and an OX account with API access.Read 15 Oct 2026 · marketplace.visualstudio.com
Funding
OX announced a $60 million Series B in May 2025, bringing total disclosed funding to $94 million.Read 15 Oct 2026 · prnewswire.com
IDE extension
The VS Code-compatible extension scans local changes for open-source, code, SBOM, IaC, and secret/PII issues and links results to source lines.Read 15 Oct 2026 · marketplace.visualstudio.com
Integration examples
Supported integrations include GitHub, GitLab, Bitbucket, Azure Repos, AWS, Azure, Jira, Asana, Slack, Microsoft Teams, Splunk and ChatGPT.Read 30 Sep 2026 · ox.security
Integration methods
Connectors can use managed apps, identity-based authentication, API tokens, or broker connectivity for restricted networks.Read 15 Oct 2026 · docs.ox.security
Licence
OX software is proprietary; terms grant a revocable, non-exclusive access licence and reserve OX ownership of the software and related intellectual property.Read 15 Oct 2026 · ox.security
Limit: documentation
Some G2 reviewers report that documentation is not sufficiently detailed or comprehensive.Read 15 Oct 2026 · g2.com
Limit: missing capabilities
A Capterra reviewer says some key features needed for a fully equipped deployment were still missing or under development.Read 15 Oct 2026 · capterra.com
Limit: product maturity
Reviewers note occasional bugs, a learning curve, incomplete feature coverage, and a need for more reporting customization.Read 15 Oct 2026 · g2.com
Microsoft Teams app
OX Security Alerts is a Microsoft Teams app that distributes discovered security issues to selected workspace channels and can send data over the Internet.Read 15 Oct 2026 · marketplace.microsoft.com
Notable news
OX announced its Active ASPM platform on January 31, 2024, combining native scanners, contextual prioritization, attack-path analysis, and automated workflows.Read 15 Oct 2026 · ox.security
OX Cloud
OX Cloud includes runtime security, agentic attack-surface analysis, cloud and Kubernetes posture management, data-security posture management, cloud inventory, and attack-path mapping.Read 15 Oct 2026 · ox.security
OX Code
OX Code covers SAST, SCA, secrets and PII, SBOM, IaC, CI/CD, Git posture, containers, malicious dependencies, pipeline blocking, IDE/CLI scanning, and AI remediation.Read 15 Oct 2026 · ox.security
Pipeline BOM
The platform builds a pipeline bill of materials covering source, CI/CD, registries, cloud, artifacts, APIs, and SaaS connections.Read 15 Oct 2026 · ox.security
Praise: integration and usability
Reviewers repeatedly praise fast or easy deployment, broad integrations, intuitive interfaces, and centralized visibility across security tools.Read 15 Oct 2026 · g2.com
Praise: support
Reviewers commonly describe OX support as responsive, knowledgeable, and quick to resolve implementation issues and bugs.Read 15 Oct 2026 · capterra.com
Pricing metric
Pricing is based on active developers who committed code in connected source control during the past 90 days or are expected to contribute during the licensing period.Read 30 Sep 2026 · ox.security
Prioritization
OX correlates findings with exploitability, reachability, business impact, and application context to reduce duplicated or low-value alerts.Read 15 Oct 2026 · ox.security
Product pillars
The current platform is organized into OX VibeSec, OX Code, OX Cloud, and OX Agentic Pentester.Read 15 Oct 2026 · ox.security
Product scope
OX is an enterprise-grade platform securing applications from code to runtime with real-time protection in AI editors and IDEs.Read 30 Sep 2026 · ox.security
Rating on Capterra
4.7 out of 5 from 3 reviewsRead 15 Oct 2026 · capterra.com
Rating on G2
4.8 out of 5 from 51 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights ASPM
4.7 out of 5 from 18 reviewsRead 15 Oct 2026 · gartner.com
Rating on Gartner Peer Insights supply-chain security
4.8 out of 5 from 9 reviewsRead 15 Oct 2026 · gartner.com
Rating on GetApp
4.7 out of 5 from 3 reviewsRead 15 Oct 2026 · getapp.com
Security architecture
The trust center lists EU-hosted AWS compute, EU MongoDB, EU Auth0, EU Datadog, and limited US Azure OpenAI processing as subprocessors.Read 15 Oct 2026 · ox.security
Security certifications
OX states that SOC 2 Type II materials are available on request and that it is ISO 27001:2022 certified and GDPR compliant.Read 15 Oct 2026 · ox.security
Self-hosting
The pricing page lists an on-premises deployment option, and the IDE documentation supports custom API endpoints for on-premises environments.Read 15 Oct 2026 · ox.security
Terms limitation
OX disclaims uninterrupted or error-free operation, warns that services can be unavailable for maintenance, and does not guarantee prevention of cyberattacks.Read 15 Oct 2026 · ox.security
VibeSec
VibeSec governs AI users, agents, MCPs, skills, and generated code to prevent insecure decisions before code is created.Read 15 Oct 2026 · ox.security

Plans and prices

Free services Free Up to 9 developer contributions · open-source projects may qualify with fair-use activation Read 15 Oct 2026 · ox.security
OX Agentic Pentester Priced on request Get Quote White-box web-app testing · Continuous pentesting · API assessment · Proof-of-concept exploits · OWASP mapping Read 30 Sep 2026 · ox.security
OX Cloud Priced on request Get Quote AIDR · Runtime security · CSPM · KSPM · DSPM · Cloud inventory · Attack path mapping Read 30 Sep 2026 · ox.security
OX Code Priced on request Get Quote SAST · SCA · Secrets/PII · SBOM · IaC · CI/CD · Container scanning · IDE and CLI Read 30 Sep 2026 · ox.security
OX Platform Priced on request Pricing is calculated by active developers; request a quote 150+ integrations · SSO and auto-provisioning · API/MCP support · on-premises option · enterprise support Read 15 Oct 2026 · ox.security
OX VibeSec Priced on request Get Quote Agent guidelines · MCP governance · Dependency vetting · Agent activity auditing Read 30 Sep 2026 · ox.security

Every OX Security plan and price →

Strong points and limits

Strong points

  • Covers code, cloud, runtime and AI coding tools.
  • Lists more than 150 third-party integrations.
  • Offers hybrid and on-premises deployment options.
  • IDE extension supports Visual Studio Code and compatible environments.

Limits

  • Pricing is available only on request.
  • CLI is marked Early Access.
  • Pricing is based on active developer counts.

Who it suits

OX suits organizations seeking application security coverage across code, cloud and runtime, including teams using AI coding tools. Its listed developer-based pricing and enterprise deployment options are geared toward organizational use.

Verdict

OX Security brings several application and cloud security functions together, with integrations and deployment options for organizational environments. Buyers should request pricing and clarify which capabilities and deployment arrangements fit their needs.

Where Specifiction places it

Alternatives to OX SecurityAll alternatives →