Legit Security
Israeli application security posture platform with native code scanners, reachability analysis and guardrails for AI coding agents
Quick Overview
| Company | Legit Security Ltd. |
|---|---|
| Category | Application Security Platforms (SAST, SCA, ASPM) |
| Headquarters | Israel, Israel |
| Founded | Not stated |
| EU Presence | Yes - Israel (counts as European for EP) |
| Data Location | Not stated on the pages reviewed |
| Open Source | No |
| GDPR Compliant | Not stated |
| Self-Hosting | Not stated |
| Main Features | AI-native ASPM, code security with reachability, SAST and SCA, secrets scanning, supply chain security, agentic remediation, VibeGuard for AI coding |
| Pricing | No public pricing found; demo on request |
| Best For | Security teams that need one risk view across repositories, pipelines and AI coding tools |
| Replaces | Black Duck, Veracode |
Detailed Review
Legit starts from posture rather than from a scanner. Its pitch is a single view of repositories, build systems and deployments, with its own scanners added for code security and reachability.
The website terms name Legit Security Ltd. and apply the law of the State of Israel, which EP accepts as European since October 2026.
Posture First, Scanners Second
The product menu leads with AI-native ASPM, then code security and supply chain security and governance. The code scanners are described as native, with reachability analysis meant to cut alert volume.
Guardrails for AI Coding Tools
VibeGuard is described as endpoint security for AI-generated code, and the platform feeds remediation guidance into tools such as Cursor, Claude Code and GitHub Copilot. Teams already using coding agents get a feature that older SAST suites lack.
An Open-Source Side Project
Legit publishes Legitify as an open-source tool, which gives engineers a way to look at its approach before a sales call.
Limitations to Consider
The only legal text reviewed is the website terms, so the entity that signs a customer order form is not confirmed. No price list is public, no data region is stated, and the platform is built around enterprise ASPM rather than a quick start for a five-person team, where Aikido Security is easier to try.
Who Should Use Legit Security
Security teams at mid-sized and large companies that want to rank risk across many repositories and pipelines.
Pros and Cons
Pros
- Posture view across repos, pipelines and deployments
- Reachability analysis to reduce noise
- Guardrails for AI coding tools
- Open-source Legitify project
Cons
- Order-form entity not confirmed from public pages
- No public pricing
- No stated data region
- Enterprise-oriented onboarding
Alternatives to Legit Security
Other European application security platforms (sast, sca, aspm) worth comparing before you decide:
Xygeni
Spain · Valladolid AppSec platform covering code, pipelines and package malware
Aikido Security
Belgium · Ghent suite joining code, container and cloud scanners in one dashboard
Codacy
Portugal · Lisbon code-quality platform that adds SAST, SCA and secrets checks
SonarQube
Switzerland · Swiss static analysis for code quality and security on every pull request
See all European application security platforms (sast, sca, aspm) or compare them directly against Black Duck on our alternatives page.
Frequently Asked Questions
Both. The platform leads with ASPM and also offers native code security scanners with reachability analysis.
The website terms name Legit Security Ltd. and apply Israeli law.
No public price list was found, so a demo or quote is needed.