static-analysis
(12)
Swimm wants your old code to explain itself
The company that made documentation follow the code now delivers legacy modernization. Its wager: before AI can change a system safely, someone must establish what the system actually does.
Parasoft and the Art of Not Waiting
A bank loses five days a month waiting to test its software. Parasoft’s answer is to build a convincing substitute for the system everyone is waiting for - and get on with the work.
SDF Labs and the expensive art of finding out too late
A Seattle compiler startup asked why data developers had to send SQL to the cloud just to discover a mistake. Its answer ended up inside dbt - and changed the machinery beneath analytics engineering.
Black Duck Came Back From a $2.1 Billion Detour - Now It Wants to Police the AI Code Rush
The open source scanner sold for $565 million, disappeared inside Synopsys, then returned as the name of a $2.1 billion security business. Its next test is harder: checking code that machines can write faster than humans can review.
Code Climate
Code Climate is a New York-based software engineering intelligence company founded in 2011. It began with automated code review and quality analysis, grew into Velocity - an analytics platform that gives engineering leaders visibility into delivery, DORA metrics and team health - and has since repositioned around helping enterprise leaders measure and manage AI-native engineering transformation, pairing a data platform with Forward Deployed Engineers.
Veridise
Veridise is an Austin-based blockchain security company spun out of the UToPiA program-analysis research group at the University of Texas at Austin. It hardens Web3 by pairing expert human auditors with proprietary tools built on formal methods, fuzzing and program analysis. Veridise audits smart contracts, zero-knowledge circuits, blockchain implementations and dApps, and has completed 150+ audits for infrastructure protocols including Scroll, Linea, Succinct, Manta Network, RISC Zero and Semaphore.
Binarly
Binarly is a firmware and software supply chain security company that reads the code no one else looks at - the layer below the operating system. Its AI-powered Transparency Platform analyzes firmware binaries to surface known and unknown vulnerabilities, malicious implants, misconfigurations and cryptographic weaknesses, then builds a genuine software bill of materials by reconstructing dependencies from the binary itself rather than trusting a manifest. Founded in 2021 by veteran reverse engineers Alex Matrosov and Claudiu Teodorescu, the company has disclosed hundreds of high-impact firmware vulnerabilities, including the widely covered PKfail Secure Boot flaw.
Perforce Software
Perforce Software builds the version control, DevOps, and quality tools that large engineering teams lean on when their codebases and binary assets grow too big for ordinary tools. Its flagship - Helix Core, rebranded P4 in 2025 - moves enormous game studios, semiconductor designers, automakers, and defense programs along, while a portfolio gathered through acquisitions (Puppet, Perfecto, Delphix, Klocwork, Gliffy and more) extends from source control into static analysis, test automation, infrastructure automation, and test data management. Founded in 1995 and now backed by Clearlake Capital and Francisco Partners, Perforce powers more than half of the Global 500.
CodeRabbit
CodeRabbit is an AI-powered code review platform that reads every pull request, leaves line-by-line feedback, and helps engineering teams keep up with code now being written largely by other AIs. Founded in 2023 and headquartered in San Francisco, it serves more than 10,000 organizations including Chegg, Groupon, and Mercury.
Bito
Bito is a San Francisco-based AI developer tools company building agents that review pull requests and ground code generation in deep codebase context. Its AI Code Review agent plugs into GitHub, GitLab, and Bitbucket to flag bugs, security issues, and style problems before humans burn a single brain cell on them - and it speeds up PR merges by 89%, according to the company.
Semgrep
Semgrep is a San Francisco application-security company that builds a unified AppSec platform (Code/SAST, Supply Chain/SCA, and Secrets) used by engineering teams at Dropbox, Figma, Snowflake and others. Born out of an open-source tool originally written at Facebook, it lets security teams write code-like rules and ship them through CI - cutting false positives and pushing fixes back to developers.
ZeroPath
ZeroPath is an AI-native application security platform that automatically finds and fixes software vulnerabilities. Founded in 2024 by four security and engineering veterans - including a former Google Security Engineer and a former Tesla Red Team engineer - ZeroPath replaces noisy legacy SAST tools with an LLM-powered engine that understands code semantics, verifies exploitability, and generates working patches. Within a year of launch, over 1,000 organizations trust ZeroPath to scan more than 200,000 codebases per month.