depthfirst

Today, we’re excited to introduce Agentic Pentesting on the depthfirst platform. Agentic Pentesting involves autonomous agents that attack your running application like a team of elite security researchers. Security teams can: - Find complex vulnerabilities in systems and running applications, with or without source code access - Confirm whether findings from code scans and other sources can be exploited at runtime - Run ad hoc agentic pentests or integrate them into CI/CD for new feature releases - Create tickets in Jira or Linear, or use depthfirst to autonomously remediate vulnerabilities - Replay an attack after remediation to verify that the vulnerability has been fixed We built Agentic Pentesting in close collaboration with our customers. We’re grateful to every security and engineering team that helped shape the product and to the depthfirst team that brought it to life. Learn more from the links in the comments.

We use Codex and other AI models at depthfirst. They’re useful for code review, and we run our Security Reviewer alongside them to see how each model performs when reviewing the same code. In one internal test repo, Codex raised 3,519 issues (123 security-related). depthfirst found 869 security issues at a >70% true-positive rate. We wrote about why security review needs deeper application context, how this context informs every pull request review on the depthfirst platform. Read more in the link in comments.

Our researchers built a vulnerability scanner that costs two cents per scan and completes a scan in around two seconds. The scanner is built with Jev, a classifier that outputs probabilities rather than generating tokens. On dfbench v1, our flagship model, it finds nearly as many real vulnerabilities as GPT-5.6 Luna, one of the most efficient models by cost per vulnerability. This new harness breaks vulnerability discovery into parallel tasks, making it possible to scan every package, repository, or commit quickly and at low cost before escalating the hardest cases to other frontier models on the depthfirst platform. Read more about how we built this in comments 👇

We're excited to share our new customer story with @ListenLabs! Listen Labs’ agentic SDLC enables developers to manage swarms of agents, so security reviews must deliver precise findings scale. When depthfirst flags a PR issue, it provides context, evidence, and recommended fixes, so agents can act on the finding before any human decides to merge, keeping security review in lockstep with development. Thank you Tobias Schindler and the Listen Labs team. Read the full customer story in the link in comments 👇

Our co-founder and CEO @qasimmith sat down with @SaraIttelson at Accel, one of our earliest investors, to discuss the forces reshaping security: Starting depthfirst. Building secure software at speed. Finding the TikTok vulnerability with our flagship model dfs-large1, a flaw that could have exposed millions of users’ private photos and allowed hackers to access their camera feeds and microphones without their knowledge, and recently covered by @washingtonpost. Full interview in the link in comments.

We are excited to introduce Dependency Firewall with On-Device Protection. It enforces security policies on devices and blocks malicious or untrusted packages across AI agents, applications, package managers, and registries. Centrally managed without changing how employees use their tools. Thread on supply chain attacks, how agents make this harder, and what device mode enables:

Introducing Bug Bounty Verification: forward any vulnerability report to depthfirst to validate them against the running application and check if they’re already in your queue. AI can produce a convincing vulnerability report with a single prompt. Validating whether the finding is real can still take security engineers 30 minutes to three hours. Reports that are wrong but plausible enough to investigate are where the triage cost compounds. depthfirst turns each report into the hypothesis for a targeted Agentic Pentesting run. It tests the claim against the application’s threat model, codebase, and running environment, then returns one of three verdicts: exploitable vulnerability, false positive, or needs deeper validation. Each verdict includes the requests, responses, and full run log, so security teams can inspect what the agent tried before accepting, rejecting, or escalating the report. Bug Bounty Verification is available now in Private Preview for depthfirst customers. Read more in the blog in the comments 👇

Reachability made software composition analysis more useful. Instead of stopping at “you have this CVE,” it asks whether the application can invoke the vulnerable behavior. But knowing the vulnerable behavior can execute does not tell you whether an attacker can exploit it. depthfirst translates each exploit into a set of atomic conditions: an exploit recipe. The agent evaluates that recipe against the repository at the current commit, considering application code, configuration, threat model, middleware, Dockerfiles, CI, CLI and build usage, and deployment artifacts. Each condition is marked as met, not met, or uncertain, with direct repository evidence behind the assessment. This lets teams prioritize confirmed attack paths, followed by findings requiring further investigation. Read more in the blog in the comments 👇

Today we are announcing dfbench, a cybersecurity benchmark we developed to evaluate frontier models and agentic systems. A few weeks ago we posted about how it is time to graduate from CyberGym Level 1 as the primary measure of cyber capability, in favor of newer benchmarks. Eventually every public benchmark saturates: Level 1 is now there, and it’s also not a great representation of what AppSec teams care about. dfbench is a held-out evaluation for frontier models doing open-ended defensive security work. It measures whether an agent can provide broad, actionable security coverage at sustainable cost. That requires enough coverage to get ahead of exploitation, enough precision that security teams can act on what the agent finds, and enough efficiency to keep that coverage current. We received access to all providers’ relevant trusted access programs so we could run these evals without model refusals. Both GPT 5.6 Sol and Luna are strong at detection, and Luna is incredibly cheap for its quality. Grok 4.5 provides a nice middle ground between performance and cost. Validation and differential analysis results suggest plenty of room for improvement among frontier models. Moving forward, we plan on working closely with the security community to safely evaluate the cyber capabilities of frontier models ahead of their release to the general public.

Introducing Threat Model: living security artifacts that capture each repository’s architecture, trust boundaries, attacker-controlled inputs, and assumptions so vulnerability discovery reflects how your application actually works. Most security tools start every finding from scratch. They identify suspicious code, assign a severity, and leave teams to reconstruct whether the path is reachable, what an attacker controls, which trust boundary is crossed, and what impact the issue has in that application. Threat Model gives depthfirst durable security context for each repository. Teams can review and edit assumptions, accept suggested updates as the codebase changes, and carry that context into future scans. Findings can then be evaluated against the application’s real architecture and security model instead of relearning the same context every time. Threat Model is available now in Private Preview for depthfirst customers. Read more about Threat Model in the blog in the comments 👇