Xygeni
Spanish application security platform that scans code, dependencies, secrets and CI/CD pipelines, and blocks malicious packages
Quick Overview
| Company | XYGENI SECURITY, S.L. |
|---|---|
| Category | Application Security Platforms (SAST, SCA, ASPM) |
| Headquarters | Valladolid, Spain |
| Founded | Not stated |
| EU Presence | Yes - Spain (EU) |
| Data Location | Not stated on the pages reviewed |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | Not stated |
| Main Features | SAST, SCA, secrets detection and auto-revocation, IaC security, CI/CD security, container images, malware protection, ASPM, IDE plugin |
| Pricing | Free plan (5 contributors, up to 10 repos, 200 scans per month); Team and Business plans priced by contributors and daily scans, figures load client-side |
| Best For | Teams that want pipeline and package-malware protection next to classic code scanning |
| Replaces | Black Duck, Veracode, Snyk |
Detailed Review
Xygeni puts the build pipeline on the same footing as the code. Besides SAST and SCA it lists CI/CD security, build integrity, anomaly detection and a Shield feature that blocks malicious packages before they run.
The platform terms name XYGENI SECURITY, S.L. as the provider, apply Spanish law and send disputes to the courts of Madrid, which gives European buyers an EU contract partner.
One Platform, Several Scan Types
The product list on the site runs from SAST and SCA through secrets security with auto-revocation, IaC and container images to an ASPM view of the whole inventory. A team replacing a single legacy SAST licence can start with the scanners and add the pipeline checks later.
Pricing by Contributors and Scans
The pricing page is built around the number of contributors and daily scans. The free plan includes 5 contributors, SAST, SCA, secrets and an IDE plugin for up to 10 repositories and 200 scans per month. The paid figures are filled in by a script, so confirm them in a quote.
Spanish Contract, Spanish Courts
The legal notice lists a Valladolid address and a commercial register entry, and the platform terms choose Spanish law. That is a simpler story for a procurement team than a US parent with a regional subsidiary.
Limitations to Consider
Xygeni is a smaller vendor than Black Duck, and the pages reviewed do not state a data region or a self-hosting option. Paid prices are not readable without JavaScript, so budgeting needs a quote. It does not cover the posture-first workflow of Legit Security, and for pure secrets work GitGuardian goes deeper.
Who Should Use Xygeni
Engineering teams in Europe that want scanners and pipeline protection from an EU company with a free entry plan.
Pros and Cons
Pros
- Spanish contracting entity under Spanish law
- Free plan includes SAST, SCA and secrets
- Covers CI/CD pipelines and malicious packages
- ASPM view across the inventory
- IDE plugin for early feedback
Cons
- Data region not stated on reviewed pages
- Paid prices load client-side
- Smaller vendor with fewer public references
- No self-hosting stated
Alternatives to Xygeni
Other European application security platforms (sast, sca, aspm) worth comparing before you decide:
Aikido Security
Belgium · Ghent suite joining code, container and cloud scanners in one dashboard
Codacy
Portugal · Lisbon code-quality platform that adds SAST, SCA and secrets checks
SonarQube
Switzerland · Swiss static analysis for code quality and security on every pull request
Legit Security
Israel · ASPM platform with native code scanners and AI coding guardrails
See all European application security platforms (sast, sca, aspm) or compare them directly against Black Duck on our alternatives page.
Frequently Asked Questions
The platform terms apply the law of Spain and submit disputes to the courts of Madrid, with XYGENI SECURITY, S.L. as the provider.
Yes. The free plan includes 5 contributors, SAST, SCA, secrets security and an IDE plugin for up to 10 repositories and 200 scans per month.
Its product list also names CI/CD security, build integrity, container images, IaC security and protection against malicious packages.