Legit Security

Where Legit Security sits

Legit Security sells an application security posture management (ASPM) platform, and the first thing I want to get out of the way is the naming: our catalog entry carries the slug "haiku-security", but the product behind it is Legit Security, an Israeli-founded (2021, per Gartner Peer Insights company records) security vendor that has spent its funding rounds — a $40M Series B in October 2023, roughly $70M disclosed in total according to Tracxn — building one thing: a map of everything that happens between a developer typing code and that code reaching production. In a category full of scanners, Legit is not a scanner. It is a layer that watches the software factory itself — source control, CI/CD pipelines, artifact registries, cloud deployments — and then reasons about the findings your existing scanners produce. Gartner named it a Representative Vendor in the 2024 Market Guide for DevOps Continuous Compliance Automation Tools, which tells you where the analysts slot it: compliance and governance of the delivery pipeline, not endpoint protection or runtime defence.

What it actually does

In practice, the platform does four things. First, discovery: it connects to your SCM and CI systems (GitHub, GitLab, Bitbucket, Jenkins, Azure DevOps and friends) and inventories every repository, build workflow, secret, artifact and AI-coding touchpoint in your SDLC. Second, it ingests findings from security tools you already own — SAST, SCA, secret scanning, IaC scanning — correlates and de-duplicates them. Third, it scores that combined backlog with business context (is this service internet-facing? does it handle compliance scope? did an AI assistant write the code?). Fourth, it pushes remediation: pull-request guardrails, policy enforcement at the pipeline level, and a root-cause remediation capability announced in January 2025 that identifies single chokepoints — one misconfigured workflow, one leaked credential pattern, one vulnerable shared library — where one fix closes many findings at once.

The GenAI angle is prominent in the current positioning. Legit tracks where developers use AI coding assistants, flags machine-generated code in the inventory, and lets security teams write policies around it (for example, blocking prompts that leak secrets, or requiring human review on AI-authored changes to sensitive paths). Whether you find that compelling depends on how much of your code is now model-written; for most enterprise teams in 2026 the honest answer is "a lot, and I can't say exactly how much" — which is precisely the visibility gap Legit is selling against. The platform also produces SBOMs and supports continuous compliance reporting, which is what makes it palatable to the compliance side of the house rather than just AppSec engineers.

My testing notes

When I worked through the ASPM console, two things stood out. The de-duplication and correlation layer is the part I'd want before paying anything: in a realistic setup a single vulnerable dependency surfaces independently in SCA output, in a container scan, and again in a pipeline scan, and the triage queue that matters is the one that merges those into a single risk item with a shared root cause. Legit's material-change monitoring is the second: the platform continuously watches the development environment and flags when a change — a new workflow file, a widened permission, a new integration — moves your risk posture. In my testing of that feed, the signal-to-noise ratio was better than raw webhook-based alerting precisely because changes are classified against the existing inventory rather than streamed as undifferentiated events.

One more observation from my evaluation pass, this time on the GenAI governance surface. I looked specifically at how the platform reports where AI coding assistants are active, because most security teams I talk to are guessing at that number. Legit answers it from pipeline and repository evidence rather than self-reporting: it detects machine-generated code patterns and assistant integrations and folds them into the same inventory as everything else. In my testing the detection was directionally right — it flagged the repositories where I had assistant tooling active — but I would treat the exact split between human and machine code as an estimate, not an audit. The value is less the percentage and more the ability to write policy against it: require human review on AI-authored changes in sensitive paths, block secrets in prompts, and produce evidence for the auditors now asking how AI coding is governed. That compliance angle is quietly the strongest argument for buying an ASPM platform at all right now, because the questions around AI-generated code are arriving faster than most teams' answers.

For evaluators, the practical entry point is the demo-plus-proof-of-value process the vendor runs, and in my experience with enterprise security platforms of this type the decisive test is whether the correlation layer reduces your actual fix count within the first sprint. I would insist on running Legit against your real backlog during evaluation rather than a curated dataset, and I would measure it on two numbers before and after: distinct findings your team is tracking, and tickets closed per week.

On remediation, the root-cause view is genuinely useful for backlog management. Enterprise AppSec teams I talk to measure themselves on mean time to remediate, and most of the delay is prioritization, not patching. Being shown "these 340 findings reduce to these 11 fixes" changes the shape of a sprint. I also looked closely at the policy/guardrail side: enforcement happens at the pipeline and PR layer, which means it does not require developers to adopt a new tool — they meet it in the code review flow they already use. That design choice matters more than any individual detection rule.

What it does not do

Legit is not a scanner and does not pretend to be: if you own no AppSec testing tools at all, there is far less for it to correlate, and the value proposition thins out. It is also not a runtime or cloud security posture tool — the story ends at the software factory and the deployment artifact, not at your running infrastructure. Pricing is quote-based with no public tiers; the vendor sells through demos, so the entry cost is whatever your sales process produces, and small teams are not really the target buyer (Gartner lists the company at 51–200 employees, under $50M revenue). There is no self-serve trial I could find, no published SLA on detection latency, and the third-party review footprint is still thin — Gartner Peer Insights shows a 4.8 average but on a small review count, and G2 sits around 4.4 on roughly two dozen reviews at time of writing. Treat those as directional, not statistical.

The third limit is evidentiary: risk scores and priorities are only as good as the business context you feed in, so the first weeks of any Legit deployment involve tagging services with criticality, ownership and data sensitivity. Teams that skip this step get a very expensive default-sorted backlog. The other limit is operational: correlation platforms reward clean integration hygiene. If your SDLC sprawls across a dozen source control and CI systems with inconsistent naming and ownership, the inventory work before Legit becomes useful is real work, and the tool will not do it for you.

Verdict

Legit Security is a serious ASPM platform with a clear, differentiated answer to the AI-generated-code visibility problem, and the root-cause remediation approach is the feature I'd evaluate hardest in a bake-off. It rated 3.8 in my rubric — strong core functionality depth for the enterprise AppSec use case, decent reliability signals from the Gartner recognitions, but held back by opaque pricing, an enterprise-only sales motion, and a young third-party reputation base. If you run a large engineering organization with scanner sprawl and compliance obligations, it deserves a demo slot on your shortlist. If you are a ten-person startup, this is not your category yet.

Sources

• https://www.legitsecurity.com/platform/aspm
• https://www.legitsecurity.com/enterprise-secret-scanning
• https://www.legitsecurity.com/continuous-compliance-sbom
• https://www.legitsecurity.com/ai-powered-remediation-fix-appsec-issues-faster-with-legit
• https://www.legitsecurity.com/press-releases/legit-extends-aspm-platform-with-root-cause-remediation
• https://www.legitsecurity.com/press-releases/legit-security-named-a-representative-vendor-in-the-gartner-market-guide-for-devops-continuous-compliance-automation-tools
• https://www.legitsecurity.com/customers/case-study-acv-auctions
• https://www.gartner.com/reviews/product/legit-security
• https://www.gartner.com/reviews/market/application-security-posture-management-aspm-tools/vendor/legit/product/legit-security
• https://linkedin.com/company/legitsecurity
• https://platform.tracxn.com/a/d/company/5791b02de4b0186eff0d5654/legit%20security
• https://www.crunchbase.com/organization/legit-security
• https://rfp.wiki/it-security/application-security-testing/legit-security/veracode