AppSecAI

AppSecAI, founded in 2023 by Bruce Fram, Michael Cartsonis, and Kevin Fealey and headquartered in Los Altos, California, builds AI tooling that triages and automatically fixes application security vulnerabilities surfaced by existing static analysis (SAST) tools. Its two products, Expert Triage Automation (ETA) and Expert Fix Automation (EFA), sit downstream of scanners like Checkmarx, Fortify, Veracode, and SonarQube: ETA re-validates SAST findings to cut false positives, and EFA generates production-ready code fixes for the findings that survive triage.

The founders previously built Contrast Security, giving the company real domain credibility in application security tooling, and its central claim, 97% triage accuracy compared with roughly 60% for SAST tools running alone, speaks directly to the alert-fatigue and vulnerability-backlog problem that most AppSec teams report as their top operational pain point. That figure is currently vendor-reported and has not been independently benchmarked in available sources.

AppSecAI is very early stage and thinly capitalized, having raised only a $400,000 seed round in August 2025 according to Crunchbase and Tracxn, a notably small amount for a company positioning itself against well-funded SAST and ASPM incumbents. For CISOs, AppSecAI is best treated as an early-stage bet on founder pedigree and a genuinely useful automation angle (fix generation, not just triage) rather than a proven, at-scale vendor; the funding gap relative to its ambitions is worth monitoring.