Deployed on AWS
Graph powered AI scanning that reads your whole repo, not just the diff. SAST, SCA, secrets, IaC, container, and exploit validation in one agentic engine so it catches the crossfile, crossrepo vulnerability chains context less scanners miss. FAST rules only to DEEP multipass AI, your choice per scan. Bring your own LLM key or run on Phoenix credits.
5
Overview
AI coding agents push partial changes across multiple repos every minute. Traditional SAST sees one file, one diff, one repo at a time: so it misses the vulnerability an agent introduced through an indirect call chain crossing three services, and it buries you in false positives doing it.
Phoenix Purple builds a persistent knowledge graph of your entire codebase call graph, taint flows, entry point scoring, service topology and runs every scan against it. The result is reachability aware findings, sub 10% false positives, and exploit grade output instead of a 40,000 line to do list.
One engine replaces the stack: SAST, SCA/SBOM, secret detection, IaC, container, DAST (roadmap), threat modeling, and exploit validation: all agentic, all graph-informed.
Three scan modes, your call per scan:
FAST Deterministic + 2,204 Phoenix rules, deterministic, <15s, free. Every PR. SMART rules + selective AI validation, graph-enriched, <45s. DEEP multi-pass adversarial AI (Hunt to Judge then Verify), <180s. Pre-release and high-risk repos.
What's in the box:
Graph powered PR scanning pipelineless via GitHub App (webhook to graph overlay then Check Run + inline annotations). Zero pipeline config. Multi repo correlation cross-service vulnerability chain detection. Three "clean" repos, one exploitable path. Exploit Hunt: triple-pass adversarial validation, runnable PoC scripts, not just descriptions. Guardrail generation confirmed findings become permanent .mdc coding rules your agents obey. Scaffolding pre-commit vulnerability prevention and secure by default generation. MCP server 20+ tools for Claude Code, Cursor, and Windsurf. SCA lifecycle OPEN / RESOLVED / REAPPEARED tracking with triage carry over across rescans.
Languages: TypeScript, JavaScript, Java, Kotlin, Python, Go, Rust.
Billing, your way: Bring your own OpenAI / Anthropic / Google key for zero token markup and the cleanest annual budget, or run on Phoenix credit bundles for a fixed monthly line item. Start self serve on Pro; move to Enterprise for dedicated isolation, SSO, and org scale rate limits. Developer first and fully independent Purple needs no other Phoenix product to run.
Highlights
- Graph powered analysis Purple builds a three layer knowledge graph (code, security, architecture) and runs every scan against the whole repo, not just the diff. It catches cross file and cross repo vulnerability chains that contextless SAST misses, with reachabilityaware findings and sub 10% false positives from multi pass adversarial AI validation.
- One engine, every scan type SAST, SCA/SBOM, secrets, IaC, and container scanning plus Zero Day Hunt and threat modeling, unified. Choose speed per scan: FAST (2,204 rules, <15s, free), SMART (AI validated, <45s), or DEEP (multi pass adversarial, <180s). Pipelineless PR scanning via GitHub App zero pipeline config.
- Exploit grade output that ships fixes Exploit Hunt generates runnable PoC scripts, not just descriptions. Confirmed findings become permanent .mdc guardrails your coding agents obey. 20+ MCP tools wire Purple directly into Claude Code, Cursor, and Windsurf. Seven languages: TS, JS, Java, Kotlin, Python, Go, Rust.
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
BYOKPro15Users | Metered base system (no credit) 15 users | $4,500.00 |
TieredPro15Users | Tiered Pro Users | $1,800.00 |
Dimensions summary
Phoenix Security Purple Pro offers two contract options, both covering 15 users. The BYOKPro15Users dimension is a metered base system that lets you bring your own encryption key, with no credit included. The TieredPro15Users dimension prices Pro users on a tiered basis. Both run as fixed-term contracts rather than hourly or purely usage-based billing. You pick the dimension that matches your encryption and user-licensing needs for a 15-user deployment. Each is billed independently, so there is no stacking of tiers or instance sizes here.
Top-of-mind questions for buyers
A user is an account granted access to the platform, which the vendor describes as security admins plus guests. Each contract covers 15 users. The vendor's support team can help you identify how many user licences you need during onboarding, and you can add more as your team grows.
BYOKPro15Users lets you bring your own encryption key and runs as a metered base system with no credit included. TieredPro15Users prices Pro users on a tiered basis. Both cover 15 users on a contract. Choose BYOK if you manage your own encryption keys; choose Tiered for standard user-based pricing.
You can upgrade your licence at any time by contacting the vendor; added assets are supported with flexible planning. If you exceed your authorized asset limit after the licence and grace period expire, the account transitions to a standard account, and the vendor may suspend it 30 days after that downgrade if unresolved.
phoenix.security+2
Helpful?
Vendor refund policy
All fees are non-cancellable and non-refundable except as required by law.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
Email support at support@phoenix.security with a 24-hour response time for the Pro tier. Enterprise plans include dedicated support channels, SSO, and org-scale rate limits. Documentation and getting-started guides are available at docs.phoenix.security.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Graph powered AI scanning that reads your whole repo, not just the diff. SAST, SCA, secrets, IaC, container, and exploit validation in one agentic engine so it catches the crossfile, crossrepo vulnerability chains context less scanners miss. FAST rules only to DEEP multipass AI, your choice per scan. Bring your own LLM key or run on Phoenix credits.
Phoenix Security is an Application Security Posture Management (ASPM) platform that cuts vulnerability noise by up to 98% through code-to-cloud reachability analysis, contextual deduplication, and automated ownership attribution. The platform correlates findings across SAST, SCA, container, and cloud scanners into a single prioritized backlog scored by the 4D Risk Model: exploitability, exposure, reachability, and business impact. PYRUS metadata routes every finding to the accountable team using AWS tags, Kubernetes labels, CODEOWNERS, Backstage, and ServiceNow.Three AI agents Researcher (Intelligence), Analyzer (attack paths), and Remediator (patches, fix bundles, code fixes) accelerate remediation 10x without removing human control.Built for AWS-native workloads on EKS, ECS, Fargate, and Lambda. Named a Major Player in the IDC MarketScape: Worldwide ASPM 2025.
PhoenixDX is one of Australia’s fastest-growing digital transformation companies. We specialise in rapid application development leveraging the OutSystems platform with the latest techniques and top talent.
PhoenixAI Anywhere is a real-time analytical database for AI agents and customer-facing analytics. It serves sub-second SQL across streaming data and your Apache Iceberg lakehouse, with minimal data movement.
Customer reviews
Information Technology and Services
Phoenix security help organization prioritize and contextualize vulnerabilities software
Reviewed on Apr 12, 2024
Review provided by G2
What do you like best about the product?
Simple UI level of customization
Effortless User Experience with Simple UI
Phoenix Security's platform offers a straightforward, intuitive user interface that makes complex tasks feel simple. Even for teams with varying technical skills, navigating through Phoenix's dashboard is a breeze. This simplicity ensures that you can focus more on strategic decision-making rather than wrestling with complicated software.
Customization Like No Other
Customization is where Phoenix Security truly shines. Whether you're tailoring dashboards or setting up specific alerts for new vulnerability patterns, Phoenix allows every user to tweak the system to fit their unique needs perfectly. This level of personalization ensures that regardless of your organization's size or sector, Phoenix adapts seamlessly to your security framework.
Unparalleled Customer Support
Phoenix Security doesn’t just deliver great software; their customer support team goes above and beyond to ensure user satisfaction. Accessible, knowledgeable, and friendly, the support staff are always ready to assist with any queries or issues, ensuring minimal downtime and maximum efficiency for your security operations.
Monitoring New Vulnerability Patterns with Ease
With an ever-evolving landscape of threats, Phoenix Security remains ahead of the curve by allowing users to easily monitor and respond to new patterns of vulnerabilities. This proactive approach not only enhances security but also empowers teams to tackle potential threats before they escalate.
Streamlined Integration
Integrating Phoenix Security into your existing systems is a smooth and straightforward process. The platform’s compatibility with numerous third-party tools and services means that you can set up a comprehensive security environment without the usual hassles associated with software integrations.
Effortless User Experience with Simple UI
Phoenix Security's platform offers a straightforward, intuitive user interface that makes complex tasks feel simple. Even for teams with varying technical skills, navigating through Phoenix's dashboard is a breeze. This simplicity ensures that you can focus more on strategic decision-making rather than wrestling with complicated software.
Customization Like No Other
Customization is where Phoenix Security truly shines. Whether you're tailoring dashboards or setting up specific alerts for new vulnerability patterns, Phoenix allows every user to tweak the system to fit their unique needs perfectly. This level of personalization ensures that regardless of your organization's size or sector, Phoenix adapts seamlessly to your security framework.
Unparalleled Customer Support
Phoenix Security doesn’t just deliver great software; their customer support team goes above and beyond to ensure user satisfaction. Accessible, knowledgeable, and friendly, the support staff are always ready to assist with any queries or issues, ensuring minimal downtime and maximum efficiency for your security operations.
Monitoring New Vulnerability Patterns with Ease
With an ever-evolving landscape of threats, Phoenix Security remains ahead of the curve by allowing users to easily monitor and respond to new patterns of vulnerabilities. This proactive approach not only enhances security but also empowers teams to tackle potential threats before they escalate.
Streamlined Integration
Integrating Phoenix Security into your existing systems is a smooth and straightforward process. The platform’s compatibility with numerous third-party tools and services means that you can set up a comprehensive security environment without the usual hassles associated with software integrations.
What do you dislike about the product?
While Phoenix Security boasts a comprehensive suite of features designed to cater to all aspects of vulnerability management, new users might find the vast array of options a bit overwhelming at first. However, this potential complexity is adeptly mitigated by Phoenix's excellent onboarding resources. The platform includes a highly intuitive chatbot and a detailed knowledge base, ensuring that help is always at hand. This means that any initial steepness in the learning curve quickly flattens out, allowing users to maximize the platform’s capabilities effectively.
What problems is the product solving and how is that benefiting you?
One of the standout features of Phoenix Security is its ability to help teams prioritize vulnerabilities, especially for software deployed in the cloud. This capability is crucial for businesses operating in cloud environments, where security threats can evolve rapidly and unpredictably. Phoenix Security’s intelligent analysis tools streamline the vulnerability management process by highlighting critical issues that require immediate attention. This not only saves valuable time but also optimizes resource allocation, ensuring that your team can focus on the most pressing vulnerabilities. With Phoenix Security, businesses can enhance their security posture efficiently, safeguarding their cloud-deployed assets against potential threats with greater precision and effectiveness.