Code Intelligence
A Bonn-based fuzzing platform that finds exploitable bugs in C/C++, Java, and other codebases directly inside CI/CD pipelines.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
Code Intelligence builds CI Fuzz, a developer-focused fuzz testing platform that integrates coverage-guided, feedback-based fuzzing into build systems and CI/CD pipelines (Jenkins, GitLab, Maven, Gradle, Bazel). Rather than relying on static pattern matching, the platform executes code with adversarially generated inputs to surface crashes, memory-safety bugs, and logic errors that static analyzers typically miss, then pinpoints the exact line of code responsible.
The company was founded in 2018 by Sergej Dechand, Khaled Yakdan, and Matthew Smith, spinning out of IT-security research at the University of Bonn, Germany. It also maintains Jazzer, an open-source Java fuzzing engine credited with surfacing over 500 vulnerabilities across more than 30 open-source projects. Named enterprise customers include Bosch, Continental, Deutsche Telekom, and automotive-software venture CARIAD, where fuzzing output is used to support compliance with standards like ISO 21434.
Code Intelligence raised a $12M Series A in June 2022 led by Tola Capital, with participation from High-Tech Gründerfonds (HTGF), bringing total funding to roughly $15.7M. Its differentiator is less about inventing fuzzing and more about packaging it for mainstream developer workflows in regulated, safety-critical industries like automotive and industrial systems, where undiscovered memory-safety bugs carry outsized real-world risk.
Innovation Matrix Assessment
Extended its open-source Jazzer engine to new languages and build-system integrations (Maven, Gradle, Bazel) over several years, but the pace is incremental rather than rapid category creation.
Integrates fuzz testing directly into developer CI/CD workflows, reducing the need for dedicated fuzzing specialists and surfacing bugs standard SAST tools miss.
Raised a confirmed $12M Series A (Tola Capital, HTGF, 2022) with independently reported named customers (Bosch, Continental, Deutsche Telekom, CARIAD), but no funding or growth signals found after 2022.
Fuzz testing is an established technique; Code Intelligence packages it for CI/CD rather than redefining how application security testing is done.
Jazzer's 500+ vulnerability finds across 30+ open-source projects is independently observable via public CVE/issue trackers; vendor claims of 'zero false positives' are not independently verified.
Memory-safety and logic-bug discovery stays relevant as automotive and embedded software face growing regulatory scrutiny (ISO 21434) and as AI-generated code increases the volume of untested logic.
Why CISOs Should Care
Gives engineering teams a way to catch exploitable memory-safety and logic bugs before release without needing a dedicated security-research team, particularly valuable in regulated embedded/automotive environments.
What Makes It Different
Combines coverage-guided fuzzing with native CI/CD integration and an open-source engine (Jazzer) that has a public track record of real-world finds, rather than relying solely on closed-source static analysis.
The Matrix Verdict
62/100 — INCREMENTAL INNOVATOR
An Incremental Innovator: a credible, well-evidenced fuzzing vendor with real enterprise customers and public open-source proof points, but fuzzing itself is a mature category and the company's growth signals are dated to 2022.
Editorial Note: Claims vs. Verified Findings
Named customers (Bosch, Continental, Deutsche Telekom, CARIAD) and the Jazzer open-source vulnerability count are independently traceable; 'zero false positive' and detection-accuracy marketing language comes from the vendor and is not independently verified.
Sources
Alternatives to Code Intelligence
Endor Labs
Reachability-based software composition analysis that filters open-source dependency risk down to what code paths are actually exploitable.
Apiiro
Builds a continuous 'code risk graph' that maps code, developers, and cloud deployment to prioritize AppSec findings by…
Socket
A software supply chain security platform that combines automated dependency analysis with human verification to catch malicious and…
JFrog
Public software supply chain security platform (Xray plus Advanced Security) that scans binaries and artifacts end-to-end from the…
ArmorCode
Tool-agnostic ASPM layer that correlates findings from 300+ existing security tools into one prioritized backlog, without running its…
ThreatLocker
CISO ReviewedZero Trust endpoint protection platform that blocks unknown applications by default through allowlisting, ringfencing, and storage control.