Graph powered AI scanning that reads your whole repo, not just the diff. SAST, SCA, secrets, IaC, container, and exploit validation in one agentic engine so it catches the crossfile, crossrepo vulnerability chains context less scanners miss. FAST rules only to DEEP multipass AI, your choice per scan. Bring your own LLM key or run on Phoenix credits.
Overview
AI coding agents push partial changes across multiple repos every minute. Traditional SAST sees one file, one diff, one repo at a time: so it misses the vulnerability an agent introduced through an indirect call chain crossing three services, and it buries you in false positives doing it.
Phoenix Purple builds a persistent knowledge graph of your entire codebase call graph, taint flows, entry point scoring, service topology and runs every scan against it. The result is reachability aware findings, sub 10% false positives, and exploit grade output instead of a 40,000 line to do list.
One engine replaces the stack: SAST, SCA/SBOM, secret detection, IaC, container, DAST (roadmap), threat modeling, and exploit validation: all agentic, all graph-informed.
Three scan modes, your call per scan:
FAST Deterministic + 2,204 Phoenix rules, deterministic, <15s, free. Every PR. SMART rules + selective AI validation, graph-enriched, <45s. DEEP multi-pass adversarial AI (Hunt to Judge then Verify), <180s. Pre-release and high-risk repos.
What's in the box:
Graph powered PR scanning pipelineless via GitHub App (webhook to graph overlay then Check Run + inline annotations). Zero pipeline config. Multi repo correlation cross-service vulnerability chain detection. Three "clean" repos, one exploitable path. Exploit Hunt: triple-pass adversarial validation, runnable PoC scripts, not just descriptions. Guardrail generation confirmed findings become permanent .mdc coding rules your agents obey. Scaffolding pre-commit vulnerability prevention and secure by default generation. MCP server 20+ tools for Claude Code, Cursor, and Windsurf. SCA lifecycle OPEN / RESOLVED / REAPPEARED tracking with triage carry over across rescans.
Languages: TypeScript, JavaScript, Java, Kotlin, Python, Go, Rust.
Billing, your way: Bring your own OpenAI / Anthropic / Google key for zero token markup and the cleanest annual budget, or run on Phoenix credit bundles for a fixed monthly line item. Start self serve on Pro; move to Enterprise for dedicated isolation, SSO, and org scale rate limits. Developer first and fully independent Purple needs no other Phoenix product to run.
Highlights
- Graph powered analysis Purple builds a three layer knowledge graph (code, security, architecture) and runs every scan against the whole repo, not just the diff. It catches cross file and cross repo vulnerability chains that contextless SAST misses, with reachabilityaware findings and sub 10% false positives from multi pass adversarial AI validation.
- One engine, every scan type SAST, SCA/SBOM, secrets, IaC, and container scanning plus Zero Day Hunt and threat modeling, unified. Choose speed per scan: FAST (2,204 rules, <15s, free), SMART (AI validated, <45s), or DEEP (multi pass adversarial, <180s). Pipelineless PR scanning via GitHub App zero pipeline config.
- Exploit grade output that ships fixes Exploit Hunt generates runnable PoC scripts, not just descriptions. Confirmed findings become permanent .mdc guardrails your coding agents obey. 20+ MCP tools wire Purple directly into Claude Code, Cursor, and Windsurf. Seven languages: TS, JS, Java, Kotlin, Python, Go, Rust.
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
BYOKEnt25_Users | Enterprise Metered base system (no credit) 25 users | $15,000.00 |
TieredEnt25_Users | TieredEnt25_Users | $6,250.00 |
Dimensions summary
This Enterprise listing offers two contract options, each sized for 25 users. The BYOKEnt25_Users option provides a metered base system where you bring your own encryption key, with no included credit. The TieredEnt25_Users option uses a tiered structure for the same 25-user Enterprise base. Both are sold as contracts with a minimum 12-month commitment. You choose between the two based on whether you prefer encryption-key control with metered usage or a tiered arrangement. Pricing scales by the number of 25-user units you purchase. Add-on services may be billed separately from these base options.
Top-of-mind questions for buyers
Each option covers 25 users. A user is anyone you grant access to the platform, each with a unique login. The Enterprise base includes 20 admins plus single sign-on and directory integration. You buy units in blocks of 25 users and add more units as your team grows.
BYOKEnt25_Users is a metered base system where you supply your own encryption key, with no credit included; charges accrue by metered usage. TieredEnt25_Users uses a tiered structure for the same 25-user base. Choose metered usage with key control, or a tiered arrangement, based on how you prefer cost to behave.
Add-on services bill separately. These include dark web monitoring, third-party supply chain posture, external attack surface scans, premium and enterprise cyber threat intelligence, and professional configuration services. Token-based credits for AI remediation and advanced threat intel feeds are also add-ons. The metered base system carries no included credit.
phoenix.security+2
Helpful?
Vendor refund policy
All fees are non-cancellable and non-refundable except as required by law.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
Email support at support@phoenix.security with a 24-hour response time for the Pro tier. Enterprise plans include dedicated support channels, SSO, and org-scale rate limits. Documentation and getting-started guides are available at docs.phoenix.security.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
PhoenixAI Enterprise is a real-time analytical database for AI agents and customer-facing analytics. It serves sub-second SQL across streaming data and your Apache Iceberg lakehouse, with minimal data movement.
Phoenix Security is an Application Security Posture Management (ASPM) platform that cuts vulnerability noise by up to 98% through code-to-cloud reachability analysis, contextual deduplication, and automated ownership attribution. The platform correlates findings across SAST, SCA, container, and cloud scanners into a single prioritized backlog scored by the 4D Risk Model: exploitability, exposure, reachability, and business impact. PYRUS metadata routes every finding to the accountable team using AWS tags, Kubernetes labels, CODEOWNERS, Backstage, and ServiceNow.Three AI agents Researcher (Intelligence), Analyzer (attack paths), and Remediator (patches, fix bundles, code fixes) accelerate remediation 10x without removing human control.Built for AWS-native workloads on EKS, ECS, Fargate, and Lambda. Named a Major Player in the IDC MarketScape: Worldwide ASPM 2025.
PhoenixAI Enterprise is a real-time analytical database for AI agents and customer-facing analytics. It serves sub-second SQL across streaming data and your Apache Iceberg lakehouse, with minimal data movement.
Ensure your AWS environment is secure, compliant, and optimized for performance with PurpleBox’s Security and Compliance Review. Our experienced team leverages AWS Well-Architected best practices to evaluate your workloads, identify risks, and implement solutions tailored to your business.
PurpleBox provides specialized security assessment and penetration testing services designed for the Financial Services and Fintech industries. As these sectors embrace digital transformation and cloud adoption, they have become prime targets for cyber threats. We offer comprehensive security assessments focused on protecting sensitive financial data and ensuring compliance with industry regulations. Our services cover key AWS components like EC2, S3, RDS, and Lambda, helping fintech companies strengthen their security posture and reduce risks in an increasingly complex threat landscape.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.