Assessment
AI Prompt Injection Defense
Adds input and output defences against prompt injection in your AI apps.
Assessment
AI Application Security Agent
Your code and dependencies are scanned continuously as you build, with severity-ranked findings sent where your team already works.
Vulnerable dependencies and risky code patterns are easy to ship when security checks only happen occasionally. This agent scans your code and dependencies on an ongoing basis, inside your GitHub or GitLab workflow, and ranks what it finds by severity. Findings go straight to Slack or Jira with remediation guidance, so the owner of that code sees them first.
- Code and dependencies scanned on every build or schedule
- Findings ranked by severity with a recommended fix
- Results posted to Slack or Jira where your team works
$5,400
20–30 working days
Optional maintenance $270/mo
What it is
AI Application Security Agent is an agent that scans your application code and dependencies for known vulnerabilities on an ongoing basis, embedded into your development workflow rather than run as a single check. Findings are ranked by severity and routed to Slack or Jira as they are found.
Why businesses buy it
Most small teams ship code faster than anyone can review it for security. Known vulnerabilities sit in dependencies for months because nobody looks until a customer questionnaire or an incident forces the issue. This agent makes scanning part of the normal build, so issues surface while they are still cheap to fix, without hiring a dedicated security engineer. The Scope Card names the repositories, controls and destinations before you order, and it implies no certification or guarantee.
Problems this solves
Vulnerable dependencies sit in your code unnoticed for months
The agent scans your application code and dependencies for known vulnerabilities on an ongoing basis. New issues are found as they appear, not at the next scheduled check.
Security scans happen once, then the code keeps changing
Scanning is built into your development workflow rather than run as a single check. Each change to code or dependencies can be covered as it lands.
Security alerts land in a tool nobody on the team opens
Findings are routed to Slack or Jira as they are found. They reach the channels and boards your developers already use and check every day.
Developers can't tell which vulnerabilities matter most
Every finding is ranked by severity. Your team can fix the serious issues first and schedule minor ones, without sorting a raw list by hand.
A good fit if
You ship code regularly and want vulnerable dependencies or risky code patterns caught before they reach production.
Your team already uses GitHub or GitLab and wants scanning that runs automatically on new builds, not a manual step.
You want findings routed to Slack or Jira so they reach whoever is already responsible for that part of the codebase.
You have never had continuous security scanning in your pipeline and want it running without hiring a dedicated security engineer.
Not the right fit if
You want a single written report as of today rather than an ongoing agent; see AI Security Audit, for a point-in-time review.
You want designs, architecture changes and new integrations threat-modeled before they are built, not code scanning; see AI Security Review Assistant.
Your concern is malicious input reaching your AI models, not your codebase; see AI Prompt Injection Defense, which is narrower and input-focused.
You want this combined with agent guardrails and centralized monitoring in one build; see AI Agent Security Layer, our broadest option.
How it works
- We connect to your repositories and build pipeline. Typically GitHub or GitLab, with the agent reading your codebase and dependency manifests such as package or requirements files.
- Scan rules are set from your stack and your policies. We configure which vulnerability classes and dependency risks matter most for your codebase, based on the languages and frameworks you actually use.
- Scans run on an ongoing schedule, not just once. Each new build or a regular interval you choose triggers a fresh pass across code and dependencies, so new risk introduced this week does not sit unnoticed for months.
- Findings are ranked by severity with remediation guidance. Each result explains what was found, why it matters, and the fix or upgrade path we recommend, rather than a raw scanner dump.
- Results land where your team already works. Findings post to Slack or Jira, so the person who owns that code sees it without opening a separate dashboard.
- You get a test report and a working configuration at launch. The 60-minute handoff walks through how the ongoing scans are set up and how to adjust the rules yourself later.
What you provide within 72 hours
Your portal lists these the moment you order. Delivery starts the working day after everything is in and your access is checked.
- Written authorization confirming which repositories and systems we may scan.
- The list of AI applications, repositories and systems you want in scope.
- Any existing security policies or standards your code should be checked against.
- Read access to your code repositories and build pipeline logs, as needed.
- A named IT or security owner who can triage findings after launch.
- Admin access and API keys for every connected system, shared by adding our team as a user or creating a key you control, never by email.
- One decision-maker who can approve the scan rules and sign off the launch.
The 72-hour rule. Send everything on your checklist, including access, within 72 hours of ordering so your build starts on time.
Timeline
Start
Repositories, scope and scan rules confirmed.
Weeks 1–2
Scanning agent built and tuned to your stack.
Week 3
Repository, build pipeline and alerting connections completed.
Weeks 3–4
Documented test scenarios run and results sent to you.
Week 4
Your review and two rounds of changes to the rules.
Go-live
Live, recorded handoff session, 30 days of support begin.
| Option | Delivery time | Price |
|---|---|---|
| Standard | 20–30 working days | $5,400 |
| Express | 15–25 working days | $6,200 |
| Rush | 10–20 working days | $7,000 |
What you receive at handover
- An application security agent scanning code and dependencies inside your development workflow
- Findings ranked by severity and routed to Slack or Jira
- Up to five controls, policies or monitors configured, covering up to three applications
- A control test log or findings report from testing
- An admin guide, a recorded handoff session and 30 days of post-launch support
Expected benefits and how to measure them
- Vulnerabilities can be caught soon after they appear.
- Developers can see issues where they already work.
- Security work can be prioritized by severity.
- Open vulnerabilities by severity
- Count them each month from Jira or the agent's findings.
- Time to fix critical findings
- Measure from Jira ticket creation to close, month by month.
- Vulnerabilities found after release
- Compare issues found in production with those caught during development.
Before you start: Export any known vulnerability list and record counts by severity. Note how long fixes typically take today.
These are things to track, not promised results. Outcomes depend on your data, your team and your market.
Running costs
The build price is one-time. Running the scanning agent costs roughly $20 to $300 a month in your own accounts, for hosting, logging and the monitoring tools it uses day to day.
AI model usage during the build and testing is billed the same way, directly to your accounts, so you keep ownership of every provider relationship involved.
Ask about running costsCustom requirements
If you need something outside the Scope Card, such as scanning across more than three repositories or systems, add a note at checkout. You get a written Change Quote, and that work only starts once you accept it. Larger or bespoke projects go through the Custom AI request form instead.
Request a custom versionKeep it running
We recommend monthly maintenance, which covers monitoring and a monthly allowance of change hours for things such as tuning scan rules or adding a new repository. It starts after the 30 days of included support and can be cancelled any month.
$270/mo (5% of the build price a month, includes 2 change hours)
Optional. Starts after the post-launch support period. Cancel any month.
How maintenance worksHow this compares
| Do it yourself with a SaaS tool | Hire a custom agency | Upmark Labs | |
|---|---|---|---|
| Price | A code scanning tool charges per repository or per seat, monthly | A security firm quotes after a scoping call | Ours is one fixed price, shown on this page before you buy |
| Scope | A code scanning tool covers whatever its default rule set finds | An agency agrees scope during the engagement | Ours is written on the Scope Card, up to 3 systems |
| Delivery | A code scanning tool still needs tuning before results are useful | A security firm engagement often takes weeks to schedule | Ours has a fixed delivery time shown before you buy, with faster options |
| Routing | A code scanning tool sends alerts to its own dashboard | An agency delivers reports on its own schedule | Ours posts findings to your Slack or Jira as they happen |
| Certification | A code scanning tool does not certify anything on its own | An agency may offer certification as a separate service | Ours is a review and monitoring workflow; no certification is implied |
Questions about this product
Does AI Application Security Agent run continuously or as a one-time scan?
It runs continuously, on an ongoing schedule or triggered by new builds, not as a single scan. That is the main difference from AI Security Audit, which delivers one written report and stops there. You get fresh findings as your codebase changes week to week, not only a snapshot from launch day.
What does AI Application Security Agent actually scan?
It scans your application code and dependency manifests, such as package or requirements files, for known vulnerabilities and risky patterns within the repositories you authorize. Findings are ranked by severity with remediation guidance, and posted to Slack or Jira rather than left sitting in a dashboard nobody checks.
How much does AI Application Security Agent cost to run each month?
Expect roughly $20 to $300 a month in your own accounts for hosting, logging and the monitoring tools the agent depends on. That range covers most small and mid-size codebases. We charge nothing per scan or per finding. The one-time build price, with each delivery speed, is shown in the panel on this page.
Does it fix vulnerabilities automatically?
No. It finds and ranks vulnerabilities and dependency risks, then routes them to your team with remediation guidance. A person always decides whether and how to apply a fix, since automatic changes to production code carry their own risk that we are not willing to take on for you.
How is this different from AI Security Review Assistant?
AI Application Security Agent scans your codebase broadly and continuously on a schedule, regardless of what changed. AI Security Review Assistant is narrower and reactive, reviewing individual pull requests and configuration changes as they happen. Many teams run both: the agent for coverage, the assistant for change-by-change review.
Can I add more repositories later?
Yes. Small adjustments to which repositories or branches are scanned fit inside the monthly change hours that come with maintenance. Adding scanning across a larger number of systems than the three included in scope comes through a Change Quote, priced and agreed with you before that work starts. This keeps the cost of growing your scanning coverage predictable rather than open-ended.
Who owns the scan configuration once it is live?
You do. The scan rules, the repository connections and the alerting setup all live in your own accounts, not a platform we control, so you can adjust or move them at any point without needing our involvement, even if you later change providers or bring security in-house. We keep no separate copy that would lock you into working with us going forward.
Catch vulnerable code before it ships, not after.
Order AI Application Security Agent and it starts scanning your repositories continuously, live on a fixed delivery date.
Works well with
Assessment
AI Security Review Assistant
Reviews designs, architecture changes and new integrations for security risk, using a threat model.
Assessment
AI Security Audit
Reviews your AI applications and agents for common security weaknesses.