Pixee

Pixee automates application-security triage and remediation, integrating with existing code scanners and delivering fixes as pull requests. Its approach combines AI agents and deterministic code transformations to address security backlogs as generative AI accelerates code production. Founded by Surag Patel and Arshan Dabirsiaghi, the company chose to concentrate on resolving findings from tools enterprises already use. Patel summarized that decision in Decibel’s founder interview: “Pixee is not here to help you find new vulnerabilities.”[4][7]

Before Pixee, its founders worked together at Contrast Security. Their earlier work supplies context for the security expertise and product experience they brought to the company.[4]

Dabirsiaghi co-founded Contrast Security with Jeff Williams and served as its Chief Scientist. Patel previously led product and marketing at 41st Parameter, which Experian acquired, before becoming Contrast’s Chief Strategy Officer. In the Decibel interview, Patel recalled joining Contrast in 2016 and working closely with Dabirsiaghi over the next seven years on pricing, rebrands, product launches and scaling the business.[4]

Dabirsiaghi recalled that as Contrast matured, both wanted to try something new. Their conversations moved from “If I’m going to build something, it’d be with you,” to “Okay. Let’s do this.” They subsequently founded Pixee together.[4]

Pixee introduced Pixeebot in an August 31, 2023 post, updated on October 8, bylined Patel and signed “Arshan & Surag.” Built as a GitHub App and powered by the open-source Codemodder framework, Pixeebot proactively hardened code, advised on pull requests and responded to vulnerability scans. The introduction connected this work to code generated by LLM tools: security needed to produce code changes rather than leave developers with reports and tickets.[2]

At Latent Space’s February 2024 anniversary event, Pixee and RWKV won the demo prizes. In the recording published March 9, software engineer Ryan at Pixee demonstrated recently shipped Sonar integration and automatic remediation of findings from other tools. His example showed why even a minor fix mattered: a developer might complete it in a minute, but repeatedly handling such changes across large backlogs consumed substantial time.[1]

The demo also distinguished fixing code from deciding whether a finding deserved action. Ryan showed a triage CLI that downloaded and categorized backlog issues, used codebase context and an LLM to explain their relevance, and prompted the user before updating their status. Pixee delivered remediation through a GitHub App and also offered command-line use for developers working on smaller projects.[1]

By May 2025, Pixee’s enterprise workflow combined scanner integration, agentic AI and deterministic techniques to understand findings, change code and open ready-to-merge pull requests. The platform also offered on-premises deployment to keep sensitive data, intellectual property and source code under customers’ control.[7][6]

Axios reported a $15 million seed round on May 22, 2025. That day, TEDCO announced a recent $1.5 million investment through its Cybersecurity Investment Fund, identifying Pixee as Baltimore-based and Patel as co-founder and CEO. Wing also announced its support alongside Decibel and angel investors in May 2025.[5][6][7]

In Wing’s investment announcement, Jake Flomenberg reported that early enterprise adopters saw a 91% reduction in developer time spent on remediation, 74% faster triage and 87% of automated fixes merged without modification. These investor-reported outcomes came without a stated sample size, measurement period or methodology.[7]

In an October 31, 2025 evaluation account, updated November 3, Dabirsiaghi reported 89% vulnerability-classification accuracy for Pixee’s agent versus around 51% for a generic software-engineering agent using a leading reasoning model. The internal, human-labeled benchmark mixed open-source vulnerabilities, anonymized examples from consenting customers, handcrafted cases and synthetic cases. Tasks included false-positive classification and severity assessment; some cases intentionally lacked enough information for a decision. The account did not identify the comparator model or dataset size.[9]

Pixee announced Pixee SCA on December 16, 2025, extending its approach to dependency-vulnerability triage. Research and coding agents investigated vulnerabilities, determined exploitability conditions and assessed the application. Dabirsiaghi argued that a call graph alone could not establish exploitability: deployment, data flow, API arguments and configuration also mattered.[10]

The announcement illustrated the workflow with CVE-2025-11226 in the Java logging library logback, flagged by an SCA tool in StirlingPDF. The vulnerability concerned file writes when a user could control elements of logging configuration. Pixee reported classifying the finding as “Not Exploitable” in that application, presenting the relevant conditions and whether they were present.[10]

In the SCA announcement, Pixee explicitly emphasized “Resolution” rather than “Remediation” as its platform framing. This framing made validation and evidence part of the outcome: a finding could be resolved through an application-specific assessment, while findings that required code changes proceeded to remediation.[10]