Cycode has launched Agentic Code Scanning, a new capability designed to combine deterministic and agentic code analysis in a single system that determines which scanning engine should run where.
The company described Agentic Code Scanning as the fourth dimension of its holistic code defense approach. Rather than offering a standalone AI scanner, the Cycode platform uses different forms of analysis based on the vulnerability class, required precision and available budget.
According to Cycode, the approach is intended to address questions security teams face when adopting AI-assisted code review, including whether to use a frontier or more affordable model, scan every commit or run scans nightly, analyze every repository or prioritize critical assets, and explain to auditors which model produced each finding.
“Nobody got into application security to become a model economist,” said Lior Levy, co-founder and CEO of Cycode. “Point a frontier model at everything and the bill compounds with every commit, fastest on the code least likely to hide anything. Point rules at everything and you’re structurally blind to an entire class of vulnerability. Neither is a holistic strategy. The answer isn’t a better model, but a system that decides which one runs where.”
Four dimensions of code scanning
Cycode runs four dimensions of scanning against the same code and reconciles the results into a single view of risk.
The first dimension is deterministic static application security testing, or SAST, which uses pattern matching and taint rules across the integrated development environment, Model Context Protocol, pre-commit stage and pull request process. The company said this form of analysis operates in less than a second on a code diff and produces identical results during every run, making it suitable for blocking a merge.
The second dimension, AI SAST, uses a large language model to generate, update and customize deterministic SAST configurations. This allows rule-based scanning to improve over time while keeping its output reproducible.
The third dimension combines SAST with AI-based exploitability analysis. A rule engine identifies potential vulnerabilities before an LLM triages and ranks the findings and assesses their exploitability.
Agentic Code Scanning represents the fourth dimension. It creates a scanning plan from a threat model, ranks the code the model should examine for each vulnerability class and attempts to disprove every finding before reporting it.
This fourth dimension sits above the other three and determines which scanning methods run, in what order and within what budget. Less expensive methods address known vulnerability classes first, allowing model spending to focus on areas that deterministic rules cannot reach.
Connecting findings into attack paths
Cycode also introduced Attack Chaining capabilities that connect related findings across multiple files into a single, multi-step attack path.
Traditional application security findings are generally scored individually, even though attackers frequently combine several weaknesses during an exploit. Cycode’s approach follows the data flow from an untrusted source to a dangerous sink, using the company’s Context Intelligence Graph to ground each path in call relationships, code ownership and reachability.
Because an attack chain is disrupted when any individual link is broken, Cycode said remediation can focus on the least expensive or disruptive link to address instead of requiring developers to fix every finding in the path.
The results can also feed into Cycode’s Agentic Workflows as exploitability-qualified events. Teams define the triggering events, agent actions, confidence thresholds and controls once, and the workflow runs when the relevant event occurs.
Findings can then be routed to the engineer who wrote the code, with proposed fixes returned as reviewable pull requests and validated against the original finding. Each workflow produces an audit trail showing what triggered the process, what each agent did and which controls were applied.
Join our LinkedIn group Information Security Community!
