Cycode launches agentic code scanning & attack chaining

Cycode has launched Agentic Code Scanning and Attack Chaining in its software security platform, aiming to address the trade-off between cost and precision in code analysis.

The release adds a new layer to Cycode's existing code-scanning setup by combining deterministic and AI-based analysis in a single system. Rather than relying on one scanning method across all code, the platform chooses which engine to use for each task and combines the results into a single risk view.

The system applies four forms of scanning to the same code base: deterministic static application security testing, AI-assisted creation and updating of deterministic rules, rule-based findings combined with AI-based exploitability analysis, and a new agentic code-scanning layer above the others.

Agentic scanning

Cycode says the agentic layer works from a threat model, decides what code to inspect for each vulnerability class, and attempts to disprove every finding before surfacing it. It also allocates work so cheaper scanning methods handle known vulnerability classes first, while AI analysis is used where rule-based systems are less effective.

Cycode is also introducing Attack Chaining, a feature that links separate findings across files into what it describes as a multi-step attack path. The goal is to give security teams a view of how apparently isolated issues can combine into a practical exploit route.

That approach differs from common severity-scoring methods, which assess findings individually. In Cycode's model, a chain remains valid only if each linked weakness remains in place, allowing teams to break the path by fixing what it calls the cheapest link rather than treating every finding in isolation.

Attack paths

Attack-path analysis uses Cycode's Context Intelligence Graph to map call relationships, ownership, and reachability. Those results can then be sent into its Agentic Workflows tooling, where teams can define automated actions based on trigger events, confidence thresholds, and controls.

The workflows can route findings to the engineer who wrote the code and return fixes as reviewable pull requests validated against the original finding. Each run produces an audit trail showing what triggered the workflow, what each agent did, and which control boundaries applied.

Benchmark results

Cycode backed the launch with benchmark results across 10 repositories in six programming languages. The test set included six real applications tied to published common vulnerabilities and exposures, as well as four deliberately vulnerable applications with answer keys the engine was not tuned against.

In those tests, Cycode says its deterministic engine identified three of the six published vulnerabilities, all involving injection or traversal flaws with code patterns that could be matched by rules. Agentic Code Scanning identified all six, including two authorization-related vulnerabilities that, according to the company, no rule engine in the test could detect.

One was a broken access control issue in Gitea, and another was a middleware authentication bypass in Next.js. Cycode argues that such flaws are difficult for rule engines because they depend on the absence of a required check rather than the presence of a known dangerous pattern.

The benchmarks also highlighted the high volume of findings from conventional scanning, Cycode says. In one example involving an arbitrary file-read flaw in MLflow, a taint rule produced 573 hits across the repository, with two in the file linked to the known vulnerability, within a total repository finding range of 173 to 701 without ranking or validation.

By contrast, Agentic Code Scanning returned one validated, root-caused finding for each common vulnerability and exposure in the test, according to Cycode. The company says the results came from single runs per repository using a reasoning-tier model against a pinned public corpus, and that it is publishing the corpus and configurations to allow independent reproduction.

Executive view

Lior Levy, Co-Founder and Chief Executive Officer of Cycode, framed the issue as one of tool selection rather than model quality alone. "Nobody got into application security to become a model economist," said Lior Levy, Co-Founder and Chief Executive Officer, Cycode. "Point a frontier model at everything and the bill compounds with every commit, fastest on the code least likely to hide anything," said Levy. "Point rules at everything and you're structurally blind to an entire class of vulnerability. Neither is a holistic strategy. The answer isn't a better model, but a system that decides which one runs where," added Levy.

The launch reflects a broader shift in application security as vendors try to incorporate generative AI without overwhelming development teams with cost, noise, or weak auditability. For buyers, a practical question has been whether to use large models on every code change, reserve them for high-value repositories, or rely on more predictable rule-based systems for routine checks.

Cycode's answer is to combine both approaches inside a single control layer. Agentic Code Scanning is available now.