Depi
Depi is a proactive cybersecurity platform that maps the upstream attack surface—every dependency, maintainer, and CI/CD pipeline between an organization and a potential software supply chain compromise. Using agentic AI, it autonomously develops and validates exploit chains, demonstrating real attack paths rather than just listing CVEs. The platform has publicly documented novel techniques like npx dependency confusion and workflow-state confusion in GitHub Actions.
- Cybersecurity
- AI Agents
- Artificial Intelligence
- Software Only
- Developer Tools
Funding
Founders
Founder details are not available yet.
Product
Problem
Software supply chains are increasingly complex and vulnerable, with attackers exploiting trust boundaries in CI/CD pipelines, package managers, and reusable workflows. Traditional security tools often fail to detect these sophisticated attack vectors, leaving organizations exposed to backdoor compromises and data breaches.
Solution
Depi is a proactive cybersecurity platform that takes an offensive security perspective to identify and validate supply chain vulnerabilities. It maps every dependency, maintainer, and pipeline between an organization and a potential supply chain compromise, making the upstream attack surface visible. Using agentic AI, Depi autonomously develops and executes exploit chains, demonstrating exactly how attackers could compromise a software supply chain—including novel techniques like npx dependency confusion and workflow-state confusion in GitHub Actions. The platform provides security teams with concrete evidence of exploitable weaknesses, enabling them to prioritize and remediate risks before they are exploited. Depi is built on research from ethical hackers who have uncovered real-world vulnerabilities, including findings presented at DEF CON.
Target Audience
Primary customers are security teams and DevOps professionals in organizations that rely on complex software supply chains, including those using CI/CD pipelines, package managers, and third-party dependencies. The platform is also trusted by security researchers and engineering leaders at organizations like 1Password.
Features
- Agentic AI-driven exploit development that autonomously discovers, develops, and validates end-to-end attack chains
- Upstream graph mapping that visualizes dependencies, maintainers, registries (npm, PyPI, RubyGems, crates.io, container registries), and CI/CD pipelines
- Continuous scanning and attack modules for GitHub Actions pipelines, including detection of command injection, dependency confusion, and workflow-state confusion vulnerabilities
- Threat intelligence capabilities that track upstream movement and maintainer activity to identify risks early
- Fix Inbox feature that surfaces candidate patches ready to ship, streamlining remediation workflows
- Incident response tools that show blast radius immediately when a supply chain event occurs, not just a list of CVEs but the actual path to reach the organization
- Research-backed detection models informed by real-world vulnerabilities and bug bounty findings, including npx used confusion and find-comment exploit chains