Your whole security team.Powered by your AI.
Alphaea is the agentic harness that runs on the model you bring. Code review, dependencies, secrets, infrastructure, live web apps and networks — one platform, from your first commit to your running system. Every finding ships a proof, and your AI proposes the fix.
We built the body. Your AI is the brain. No proof, no finding.
Reflected XSS in parameter q
Judge-validated · reproducible proof-of-exploit attached
Proof (curl)
curl -i 'https://app.example.com/search?q=<svg/onload=alert(1)>' 8 → 1
engines replace your stack
SAST · SCA · secrets · IaC · web · network · cloud · gate
3
ways to deploy
cloud · hybrid · self-hosted — your call on control
90%
of a scan spends no tokens
tested on every major model — minimal tokens, big savings
75%
lower than legacy platforms
you bring the AI — no inference markup
The Alphaea difference
You own the model. You own the data.
Every other scanner locks you into their engine and their cloud. Alphaea is model-agnostic and in-tenant: we provide the body, your AI does the thinking and picks up the work — across every layer.
Model-agnostic by design
Alphaea ships the logic — recon, exploit chains, code-review and hardening instruction sets, the proof gate. The thinking is done by whatever model you connect. Swap it whenever; behavior stays consistent.
You choose where it runs
Self-hosted or hybrid, no code, traffic, finding, or secret crosses your boundary — run a fully local model (Ollama/Llama, vLLM) for zero egress. On Cloud, your data is isolated per-tenant and never used for training. Your call, by tier.
It learns on your work
Your team's confirm / false-positive decisions become tenant-local learning data. Alphaea feeds it back to your model to sharpen every scan and flag false positives — the flywheel is yours, not a vendor's.
Model backend
Or bring a key
Alphaea provides the body
recon · exploit chains · proof gate · fix & harden instruction sets
Your model does the thinking
scan → prove → propose fix → applyOne platform, every layer
From your first commit to your live network.
Alphaea replaces the whole stack of point tools a security program stitches together — static analysis, SCA, secrets, IaC, DAST, network, and reporting — in one console, on your model.
Shift-left · code & supply chain
AI Code Review
Your model reads the source for injection, unsafe calls, auth/authz flaws, weak crypto, and unsafe deserialization — then proposes a hardened patch.
Dependencies & Secrets
Parses npm / PyPI / Maven / Go / Ruby manifests against the OSV feed, and finds committed keys, tokens & private keys across the tree.
Infrastructure as Code
Dockerfiles, Kubernetes, Terraform & compose — insecure defaults, root containers, world-open ingress. Uploaded configs match deterministically; otherwise your AI reviews.
Runtime · live systems
Web Application Scanning
Site-wide crawler + OWASP Top 10 / SANS 25. Every request captured; each validated finding ships a copy-paste curl proof-of-exploit.
Network Scanning (nmap)
Full nmap when installed, an automatic Python fallback when it isn't — ping, quick, full TCP, service/version, OS detection, NSE scripts, UDP.
Burp & ZAP round-trip
Push a finding straight to Burp Repeater; pull a raw request back in and Alphaea validates it. OWASP ZAP as a drop-in alternative.
DevSecOps · pipeline, cloud & compliance
Pipeline security gate
Scan on every build and pass or fail against your policy — severity limits, a weighted risk score, scan scope. A breach returns a non-zero exit and stops the merge. One line in GitHub Actions, GitLab or Jenkins.
Cloud posture
Connect AWS, Azure & GCP read-only and audit live misconfiguration — public buckets, open security groups, over-broad IAM, unencrypted stores — mapped to CIS benchmarks.
Framework mapping, your pick
Map and filter every finding by the frameworks you report against — MITRE ATT&CK, CIS, NIST, PCI DSS, ISO 27001 — selectable per engagement, straight into the report.
Every layer, one client-ready report.
Findings from source, dependencies, config, web and network land in the same report queue. Pick from a 203-entry knowledge base, let your AI draft custom findings into your own DB, score severity with your firm's methodology, and export to Word (.docx) or PDF in your template.
Tested token-optimization core · works on every model
Your AI does the thinking. Not the busywork.
Alphaea has a token-optimization core — rigorously tested across every famous model, Claude, OpenAI, Kimi, DeepSeek and local Llama — engineered so that whichever AI you connect, it runs on the fewest tokens possible. The deterministic engines do the heavy lifting first; your model is called only for the few decisions that truly need judgment. Most of every scan spends zero tokens — so you save real money on every single run.
| Capability | Alphaea built-in enginedeterministic · in-tenant · no data leaves | Your AIonly where judgment helps · your key | Token cost |
|---|---|---|---|
| Secrets discovery | Entropy + pattern engine finds keys, tokens & JWTs | not needed | $0 tokens |
| Dependencies (SCA) | Manifests matched to the OSV CVE feed | not needed | $0 tokens |
| Network (nmap) | Ports, services, versions, NSE scripts | not needed | $0 tokens |
| Recon & crawl | Spider maps the whole app + every input | not needed | $0 tokens |
| Headers · TLS · CORS | Deterministic configuration checks | not needed | $0 tokens |
| IaC / config | Rule packs flag insecure defaults | Reviews novel configs · writes the fix | few tokens |
| Cloud posture | CIS checks over your live cloud config | Explains & prioritizes | few tokens |
| Code review (SAST) | Heuristic sinks as a baseline | Reads the source · proposes hardened patch | your model |
| Web attack (DAST) | Injection points + validated proof gate | Plans payloads · chains requests | your model |
| False-positive review | Learned suppression from past calls | Judges the genuine edge cases | few tokens |
Green rows run entirely on Alphaea's engine — no model, no tokens, no data out. Your AI is invoked only for the reasoning steps, on the key you connect.
Cost per scan · by model
Whatever you run it on, Alphaea spends ~90% less.
| Model | Straight to the model | With Alphaea | You save / scan |
|---|---|---|---|
| ClaudeAnthropic | $90 | $9 | $81 (~90%) |
| OpenAIGPT | $70 | $7 | $63 (~90%) |
| KimiMoonshot | $15 | $1.50 | $13.50 (~90%) |
| DeepSeek | $6 | $0.60 | $5.40 (~90%) |
Illustrative cost of one representative full scan; blended model prices are approximate and vary by tier and region. The saving comes from Alphaea's tested token-optimization core running the deterministic engines first — and a local model (Llama / Ollama) runs at no per-token cost either way, on ~90% less compute.
Significant cost cut
You bring the AI, so there's no inference resold at a markup — and because most of a scan spends no tokens, even a hosted key costs cents. A local model costs nothing to run.
We take no data
Self-hosted or hybrid, nothing — no code, traffic, finding or secret — leaves your network; a local model means zero egress. On Cloud your data is isolated per-tenant and never used for training. Either way, keys are never shown back and secrets are stored only as a hash.
It captures the learning
Every confirm / false-positive your team makes becomes a tenant-local learning set. Alphaea replays it to silence repeat noise and feeds your model — saved for every future scan. The flywheel is yours, not a vendor's.
Find. Prove. Fix.
It doesn't just find it. Your AI fixes it.
Legacy scanners hand you a list and walk away. Alphaea closes the loop: your connected model writes a hardened, drop-in patch for the vulnerable code or config, shows you the exact diff, and waits for your approval.
Approve it and Alphaea applies the change — committing to a branch and opening a pull request when you've granted write access. Nothing is ever changed without your sign-off.
Dockerfile · container runs as root
- FROM python:latest- USER root+ FROM python:3.12-slim+ RUN useradd --create-home app+ USER appYour model wrote the patch. You approve. Alphaea commits it to a branch.
How it works
Connect. Scan. Prove. Fix. Report.
Five steps, one platform, your model — from a repository or a live URL all the way to a signed-off report.
Connect
Point Alphaea at a repo (upload, URL, fine-grained PAT, or GitHub App) or a live target — and connect your model.
Scan
Code, dependencies, secrets, IaC, web and network — the right engine for each layer, on your AI where reasoning is needed.
Prove
The Judge validates by reproduction. No proof-of-exploit, no finding — false positives never reach your report.
Fix
Your model proposes a hardened patch; you approve; Alphaea applies it and can open a PR when write access is granted.
Report
Every validated issue — from source to network — in one client-ready report, your template, .docx or PDF.
Pricing
Deploy your way. Priced by control.
Run Alphaea fully managed in our cloud, hybrid with a scanner inside your network, or entirely self-hosted in your own environment. The more sovereignty you keep in-house, the higher the tier — all on the AI you bring.
Founder dealFirst 20 Cloud customers — 25% off for life.$74 / user / mo, locked as long as you stay subscribed.
Cloud · SaaS
$99 / user / mo
Founder: $74 — first 20, locked for life
Fully managed. Nothing to install — sign in and scan. Every engine, on the AI key you connect.
- ✓Zero setup, always up to date
- ✓Bring your own AI (hosted key)
- ✓Per-tenant isolation — never used for training
- ✓CI/CD gate + client-ready reports
Hybrid · Connected
from $30k / yr
org-wide · annual
Our hosted console plus a lightweight scanner inside your network — reach private targets without exposing them.
- ✓Scan internal / private systems
- ✓Data stays in your network — only findings sync
- ✓Agent is plumbing only — no proprietary logic on-prem
- ✓SSO / SAML, RBAC, support SLA
Sovereign · Self-hosted
from $150k / yr
custom · multi-year term
The complete engine runs entirely in your environment — for organizations that must keep everything in-house.
- ✓Full engine in your VPC or air-gapped
- ✓Zero data egress — nothing ever leaves
- ✓Run fully local models (Ollama / vLLM)
- ✓Licensed build + support SLA, annual
Cloud & hybrid, priced sanely
A fraction of what the incumbents charge.
Competitor figures are typical reported annual costs for a mid-size program; their pricing is usually quote-based and scales with apps, users, and agents. Alphaea Cloud and Hybrid are flat and org-wide — code, supply chain, config, web, network and cloud in one, on your own AI. The Sovereign tier is priced for full in-house sovereignty rather than lowest cost.
Estimate your cost & savings
Alphaea Cloud is $99 / user / month and replaces your separate SAST, SCA, secrets, IaC, DAST & network tools. Drag the sliders — numbers update live.
Your model (for AI scans)
Capabilities you run
Your Alphaea price
Founder deal applied — locked for life
You keep vs a legacy stack
$50,785/yr
≈ 92% lower total cost
Deterministic engines (secrets, SCA, IaC rules, network) cost nothing to run. Illustrative estimate; the legacy figure is the combined mid-market license of the separate SAST / SCA / secrets / IaC / DAST / network tools Alphaea replaces. Your actual cost depends on model, volume, and code size.
Because you bring your own AI, there's no inference markup — a local model costs nothing to run, a hosted key costs cents. The token-lean backend does the rest: most of every scan never touches the model.
Latest Security Standards
A scan result that reads like an audit artifact.
Alphaea maps every validated finding — from source to network — to the frameworks your program already reports against.
Alphaea tests only systems you are explicitly authorized to test. Scope is defined in a signed manifest and enforced fail-closed; a live kill switch and per-engagement rate limits bound every scan, and no fix is applied without your approval.
Questions, answered
Everything a buyer wants to know.
No lock-in, no data leaving your walls, no five-figure license. Here's how.
Is my code and data safe?
Yes — and you pick the level. Self-hosted (Sovereign) or hybrid keeps everything in your network, and with a local model (Ollama/Llama) nothing — no code, traffic, finding, or secret — ever leaves your boundary. On Cloud, your data is isolated per-tenant and never used for training. Repository access is always scoped to the repos you grant, and no fix is applied without your explicit approval.
Which AI models can I connect?
Any of them. Kimi (Moonshot), Claude (Anthropic), OpenAI, DeepSeek, local Llama via Ollama, or your own self-hosted endpoint (vLLM). Alphaea is the harness; you bring the brain, and you can swap it whenever.
Do I need a GPU?
Not for a hosted key — you just paste it and go. A local model needs reasonable hardware, but the deterministic engines (secrets, SCA, IaC rules, network) need no AI at all, so most of a scan runs on any machine.
How is it so much cheaper than other tools?
Three reasons: you bring your own AI, so there's no inference resold at a markup; the backend is deterministic-first, so most of every scan spends zero tokens; and it's one flat per-user price instead of per-app, per-scan, five-figure licensing.
How does the auto-fix stay safe?
Your model proposes a hardened patch and shows you the exact diff. Nothing changes until you approve. On approval, Alphaea applies it and can open a pull request when you've granted write access — always with your sign-off.
Can I map findings to MITRE ATT&CK and other frameworks?
Yes. Every validated finding maps to OWASP Top 10 and CWE out of the box, and you pick the frameworks you report against per engagement — MITRE ATT&CK, CIS, NIST 800-53, PCI DSS 4.0 and ISO 27001. Findings and reports filter and group by your selection, so a scan reads like an audit artifact instead of a raw alert list.
Does it cover our cloud, not just our code?
Yes. Alongside code, web and network, Alphaea connects read-only to AWS, Azure and GCP and audits live posture — public buckets, open security groups, over-broad IAM, unencrypted stores — mapped to CIS benchmarks. Same console, same report, and it can gate your CI/CD pipeline on the result.
What's the Founder deal?
The first 20 customers lock in 25% off for life — $74 per user per month instead of $99 — for as long as the subscription stays active. Cancel and it reverts to standard pricing.
One platform. Every layer. Your AI.
Alphaea.ai is currently in development by ABC AI Hub.
We built the body. Your AI is the brain.
Or email contact@abcaihub.com