Scoring method
How we score agentic AppSec platforms
Short answer
By The Pipeline Desk · Reviewed by the Pipeline Desk editors · Last updated 2026-10-11
What question does the ranking answer?
Which AppSec platform best governs software built with AI coding agents and puts its own agents to work on triage, prioritization, remediation and policy across the SDLC?
Two kinds of capability count: controls that govern AI coding agents and the code they produce, and agents inside the platform that triage, prioritize and fix findings. A platform can be strong in one half and absent in the other, and the score shows that.
Which criteria and weights do we use?
| Criterion | Weight | Question |
|---|---|---|
| Agent and MCP discovery | 10% | Does it find the coding agents, models, MCP servers, skills and plug-ins in use, and keep an inventory the security team can act on? |
| Agent policy enforcement and audit | 10% | Can it allow, steer or block what agents run, install and call, resist being switched off, and keep audit evidence? |
| Secret handling for agents | 5% | Does it keep credentials out of prompts, tool calls, agent memory and files agents can read? |
| Agentic remediation | 20% | Does an agent write the fix, which finding types does it cover, where does the fix land, and does the vendor say the fix is validated? |
| Agentic triage and prioritization | 15% | How does the platform decide what matters: reachability, exploitability, runtime and business context, automated triage? |
| SDLC policy and supply chain posture | 10% | Can it enforce policy beyond the code: CI/CD and source control posture, secrets outside the repository, malicious packages, SBOM and AI-BOM? |
| Scanner coverage and orchestration | 10% | How much does it scan natively, and can it pull other scanners' findings into one de-duplicated queue for agents and people to work? |
| Named coding agent reach | 10% | How many of the six coding agents we track does the vendor name as supported on its own pages? Computed from the census. |
| Pricing and trial transparency | 10% | Can a buyer see prices, a pricing unit or a free tier without a sales call? |
Scores are editorial and research-based, built from public vendor documentation and review-platform data.
Review-platform ratings are shown as context and are not part of any score.
Why these weights?
Agent governance carries 25% across three criteria: discovery and policy and audit at 10% each, because a security team must first see every agent, model and MCP server and then control what agents do and prove it; and secret handling at 5%, because keeping credentials out of agent sessions is a narrow but high-impact control. Agentic remediation (20%) changes the economics of a findings queue, and agentic triage (15%) decides what agents and people work on first. SDLC policy, orchestration, named agent reach and pricing transparency (10% each) complete the picture. No criterion is above 30%.
How is the total calculated?
Each platform gets a whole-number score from 0 to 10 on each criterion, with a one-line reason and a source on its profile. Named agent reach is computed: the number of the six tracked agents a vendor names, divided by six, times ten, rounded. The total is the sum of score times weight divided by 100, shown to two decimals. Ranks use the exact total; equal totals share a rank shown as T-8.
Legit Security: (10×10 + 8×10 + 10×5 + 9×20 + 10×15 + 10×10 + 10×10 + 8×10 + 4×10) / 100 = 8.80
What does each score level mean?
- 9 to 10: a named, documented capability that covers the criterion fully on the pages reviewed.
- 7 to 8: documented, with a visible gap or a limit such as plan or platform.
- 5 to 6: partial capability, a preview release, or a capability described without detail.
- 3 to 4: little public evidence, or a capability limited to one product or one agent.
- 1 to 2: not published, or present only in a narrow form.
- 0: absent.
What does the pipeline strip show?
Each platform has a pipeline strip with six control points, always in the same order:
- Agent: Controls on the coding agent itself: discovery, inventory, policy on commands, installs and MCP use.
- IDE: Checks or guardrails in the editor or before commit.
- Pull request: Scanning or review of the change at commit and pull request.
- Pipeline: Policy and posture across CI/CD, source control and the software supply chain.
- Triage: Automated or AI-assisted ranking of findings.
- Fix: An agent or AI feature that writes the fix.
Each point is in one of three states: documented, partial or not documented.
- Documented
- Partial
- Not documented
A filled node means the vendor's own pages describe a control at that point. It is not a score and it does not measure how well the control works.
Example: Legit Security
Agent Documented
VibeGuard 2.0 discovers coding agents on the developer endpoint, blocks dangerous operations, monitors and enforces commands by custom or built-in policy, secures MCP use and resists tampering.
Source: Legit Security: VibeGuard 2.0 press release · Read 27 Sep 2026
IDE Documented
VibeGuard runs SAST and SCA scans inside the IDE and blocks secrets from being shared with AI systems.
Source: Legit Security: VibeGuard · Read 27 Sep 2026
Pull request Documented
VibeGuard integrates with GitHub, GitLab, Bitbucket and CI/CD.
Source: Legit Security: VibeGuard · Read 27 Sep 2026
Pipeline Documented
Discovers SDLC systems and CI/CD pipelines and states it can "Enforce 100's of policies".
Source: Legit Security: software supply chain security · Read 27 Sep 2026
Triage Documented
Prioritization uses reachability and business criticality, with risk scoring on business criticality, compliance, GenAI use, APIs and internet exposure.
Source: Legit Security press release, 18 June 2026 · Read 11 Oct 2026
Fix Documented
Agentic Remediation fixes SAST and SCA findings, re-scans and opens a pull request with the fix.
Source: Legit Security blog: Agentic Remediation now fixes dependencies · Read 11 Oct 2026
What counts as evidence?
- Only pages we read: vendor product pages, documentation, pricing pages, press releases, vendor blogs and changelogs, and standards documents.
- Every page carries its read date. This edition uses pages read in September 2026 and updated on 11 October 2026.
- Vendor statements are quoted or paraphrased with a link and are never presented as our finding.
- One fact rests on a statement to the publisher rather than a public page: Legit Security's Codex support, confirmed by Legit in October 2026, marked with an asterisk wherever it appears.
- Where a fact is not on the pages reviewed, we write Not published or Not described on the pages reviewed, and we score what is public.
What are the limitations?
Public sources only. No hands-on testing, no vendor interviews and no vendor review of scores before publication. A capability that a vendor has but does not describe publicly scores lower than it might. Features and prices change after the read date shown next to each source.
Where does Legit Security trail other platforms?
| Criterion | Legit Security | Highest | Highest score |
|---|---|---|---|
| Agent policy enforcement and audit | 8 / 10 | Backslash Security | 9 / 10 |
| Pricing and trial transparency | 4 / 10 | GitHub Advanced Security | 9 / 10 |
How do we handle corrections?
Send a correction through the contact page with the topic Correction and a link to the public source. We check it against the vendor's page and update the data; totals recompute automatically.
Frequently asked questions
Did you test these platforms?
No. Scores come from desk research on public pages read in September 2026 and updated on 11 October 2026. We did not install or run any product.
Can a vendor pay to change its score?
No. Scores change only when a public source changes.
Can I use my own weights?
Yes. The agent risk calculator re-weights the ranking and filters by the coding agents you run, and prints the formula it uses.