Pixee is your purple team.
It builds a threat model of your application and studies it the way an attacker would. Then it proves which vulnerabilities are real and opens the fix as a pull request.
Your whole security program feeds Pixee.
Designs and tickets, code and pull requests, pen-test and bug-bounty reports, your own harnesses and the scanners you already run. Pixee checks them all against a threat model of your application, then sends back a verdict with the evidence behind it and the fix as a pull request.
Four agents, one job each.
Each one shows its work, so you can check it.
Today in the product as Foresight, Pixee Beacon and Triage & Fix.
Catch it in the design, before there's code to scan.
Pixee reads specs and tickets before code exists and flags the security promises they miss, while the fix is still an edit to the spec.
Foresight →Reset links never expire
The spec sends a reset link by email but sets no expiry and no single-use rule.
Before it looks for bugs, Pixee threat-models your application from the code.
Your scanners report findings one at a time. Pixee builds one model of how your application fits together, then follows the paths through it and shows you the ones that reach something an attacker wants.
Public API gateway
Passes client headers through to internal services.
Billing service
Trusts the user header without checking who set it.
Admin actions
Any caller can act as any user, including an admin.
Critical- 1Map
Builds a threat model from your code, with its entry points, trust boundaries and sensitive assets.
- 2Follow
Traces paths from an entry point across the trust boundaries and keeps the ones that end at a sensitive asset.
- 3Prove
A verifier tries to disprove every lead. Pixee shows what it examined, what it found and what it ruled out.
Keep every scanner you run. Get a verdict on what they find.
Pixee investigates findings from your scanners, pen tests and bug bounty alongside its own, and writes down each verdict with the evidence behind it.
User input reaches the query in OrderRepository
No sanitizer on the path from the request parameter to the query string.
fewer false positives
Real vulnerabilities come back as pull requests.
Pixee writes the fix in your conventions and opens a merge-ready pull request. Your developers review it like any other change.
Triage & Fix →Use a parameterized query in OrderRepository
+ "… WHERE id = ?", id
Matches how OrderRepository already builds its other queries.
end-to-end resolution rate, triage and fix
What each agent records.
Each agent writes down what it found and decided, so you can see why.
MoneyGram runs Pixee in its GitLab pipelines.
MoneyGram serves 60 million active customers across 200 countries and territories and nearly 500,000 locations.
of findings processed automatically
hours saved across triage and fixes
What is a purple team in application security?
A purple team puts attacker and defender work together: one side finds how an application can be broken, the other side fixes it. Pixee does both on your repositories. It threat-models your code, follows the attack paths, decides which findings are real and opens merge-ready fixes for your developers to review.
How does Pixee build a threat model from code?
Pixee reads your code and maps its entry points, trust boundaries and sensitive assets. It traces paths from an entry point across those boundaries and keeps the ones that reach a sensitive asset. A verifier then tries to disprove every lead, and Pixee shows what it examined, what it found and what it ruled out.
Does Pixee replace my scanners?
No. Keep the scanners you run. Pixee takes their findings through native integrations or any tool that emits SARIF, along with pen-test and bug-bounty reports. It investigates those findings next to its own, writes down each verdict with the evidence behind it, and cuts false positives by up to 95%.
Do my developers approve every fix?
Yes. Pixee opens each fix as a pull request written in your code's conventions, and your developers review it like any other change. Nothing merges on its own. Across the Pixee customer cohort in 2025, the end-to-end resolution rate was 94%, from scanner finding to a handled decision.
Watch Pixee work a repository end to end.
We'll walk through a real run: the threat model, what Pixee found, what it dismissed and why, and the fixes it wrote.
Book a demo
94% and up to 95%: Pixee customer cohort, 2025 · 96% and 6,500+: MoneyGram case study