Software already builds software.
Now it can secure itself, too.

Very. We find previously unknown vulnerabilities in software billions of people depend on, including the Linux kernel that powers Android phones and servers around the world. We collaborate with leading AI labs and defence organizations. You can read our public disclosures and inspect the fixes.

That’s Zero, by the way. Who said security had to look boring?

We’re an applied AI and cybersecurity research lab. We find previously unknown vulnerabilities and turn that research into security people can use. Our first product brings that work into your development workflow, finding and fixing weaknesses while you build.

Attackers are quick to adopt new technology. AI is no exception: it helps them investigate more targets, discover vulnerabilities and develop exploits faster. Security needs to keep pace with both the attackers and the software your team is shipping.

We put agents to work continuously, investigating attack paths and preparing fixes as your software changes. Recent incidents involving agents taking unauthorized actions also show why that power needs carefully designed infrastructure around it.

Good. Keep what works for you. Tools like these focus heavily on application security, especially web apps and APIs. Our research goes deeper into the software underneath: operating systems, kernels and the components your applications depend on. Our Linux kernel discoveries show that work in practice.

Our specialty is novel vulnerability research: finding weaknesses nobody has reported before. In one published analysis, 70% of exploited vulnerabilities were zero-days. Matching your software against known CVEs alone won’t uncover those.

We combine that research with ongoing investigations and fix PRs in your existing workflow. Set it up once, then let the work run in the background. The value is deeper investigation with less work for your team.

And yes, you get Zero.

Codebase scans, PR reviews, secret detection, vulnerability monitoring and pentesting. Our agents investigate different attack paths in parallel and combine what they find to uncover problems across your software. We learn how you build, recommend what to test and how often, and turn confirmed findings into fix PRs.

Your source code, dependencies, websites, APIs, apps, cloud infrastructure, operating systems and AI systems. We investigate how these parts connect, because an attack can start in one place and reach something much more valuable elsewhere.

Your web app is only part of the picture. Operating systems accounted for 44% of exploited zero-days (2025), making them the largest category. Your security needs to reach the software underneath your application, too.

Yes. The product currently offers white-box pentesting: agents use access to your code to investigate how your software could be exploited. We also use black-box and grey-box testing in our research, approaching systems from the outside or with limited access. We’re bringing those capabilities into the product next.

You want problems fixed, not a longer backlog. That’s why we reproduce findings to confirm they’re real, prioritise them by business impact and open PRs with fixes for you or your agent to review. Enterprise adds independent verification that the fixes actually resolve the vulnerabilities.

Your team spends less time investigating alerts and working out what to change, and more time getting repairs shipped.

No. Your workflow is the interface. We handle the testing in the background and bring findings and fix PRs into the tools you already use. No dashboard to babysit, no scans you have to remember to start. Want to run an investigation yourself? You can, through the CLI.

Coding agents put more engineering power in your hands. We’re doing the same for security: agents that investigate, test and prepare fixes while you build. The point is to give you time back, not another tool to operate.

Agents do the security work: planning investigations, exploring attack paths, writing tools when they need them and preparing fixes. We select models for different tasks, and agents combine their findings.

The entire workflow is built around delegating that work, from investigation to repair. You shouldn’t have to supervise every step to get a useful result.

You get the research, models and hacking tools behind our discoveries in software billions of devices and governments rely on. Real attack paths and verified findings help guide new investigations. Our public disclosures and upstream fixes let you inspect the work behind the product.

Yes. You can run the open-source harness through the CLI in your CI/CD pipeline and make security testing part of how you build and release.

With the managed service, we handle the infrastructure and ongoing testing, with findings and fix PRs arriving in your development workflow. Your engineers or coding agents can review the work where they already build.

Tests run in fresh, disposable virtual-machine sandboxes, with isolation below the guest operating system, at the virtualization layer. This separates agent execution from your environment. Runs have time limits, and their sandboxes are torn down afterwards.

Incidents involving Mythos demonstrated what can happen when agents gain unintended access to real systems. That’s why the infrastructure around the model matters. We combine isolated execution with defined testing scope and enterprise approval controls, so your team can delegate work while retaining control over what gets tested and what changes are applied.

Yes. You set the scope, budget and where approvals are required. Agents carry out the work without needing someone to direct every step.

Your team can review the evidence and fix PRs, require approval before changes are merged, and track what was tested and changed. We work with you on deployment requirements and how the service fits your existing processes.

The engine is free to inspect, run and extend with your own models and tools. No 0.security account required.

With the managed service, we run the infrastructure, select the models and put our research to work on your software. You’re paying for the security work being handled.

Agents write and run their own tools on the fly, then reuse them. We’re building on this with evaluated improvements to their tools and workflows.

Put simply: if an agent needs a tool it doesn’t have, it can build one. To improve over time, it tries changes, checks whether they help and keeps the better version.

Software is already writing itself. This closes the loop: software that builds, secures and improves itself.

Our first product is a step toward that future, making security part of how software evolves. We want the developer shipping alone, the startup moving quickly and the enterprise running critical systems to benefit from the same research.

Connect GitHub and choose your project. Your first security test is on us, with results arriving as checks finish.

We learn how you build, then recommend ongoing testing and a usage-based price. You approve the plan and budget before paid work starts. Set up the ongoing work once; you don’t need to configure every run yourself.