Kiro (agent platform with security integrations) alternatives
Kiro (agent platform with security integrations) is listed under Code security and tagged FedRAMP. These 35 agents share at least one category with it, ordered by number of shared framework tags, then category (a relevance order, not a ranking).
All category-sharing alternatives
| Agent | Category | Shared framework tags | Compare |
|---|---|---|---|
| Aikido AI AutoFix Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ. | Code security | — | Kiro (agent platform with security integrations) vs Aikido AI AutoFix |
| Amazon Q Developer security scanning Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes. | Code security | — | Kiro (agent platform with security integrations) vs Amazon Q Developer security scanning |
| Black Duck Signal (agentic AI AppSec) Agentic AI application security tool (GA March 2026) with role- and task-based agents that analyse new code in any language, filter findings by exploitability and apply verified fixes, callable from Claude Code, Gemini and GitHub Copilot via MCP. | Code security | — | Kiro (agent platform with security integrations) vs Black Duck Signal (agentic AI AppSec) |
| Checkmarx One Assist Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd’s registered office is Ramat Gan, Israel. | Code security | — | Kiro (agent platform with security integrations) vs Checkmarx One Assist |
| Claude Code security review Anthropic automated security review in Claude Code: the /security-review command and the anthropics/claude-code-security-review GitHub Action for pull-request comments. | Code security | — | Kiro (agent platform with security integrations) vs Claude Code security review |
| Codacy AI Reviewer Hybrid AI pull-request reviewer from Codacy (Lisbon). Combines static analysis with LLM context; vendor pages include security-vulnerability feedback and suggested fixes. | Code security | — | Kiro (agent platform with security integrations) vs Codacy AI Reviewer |
| Cursor Bugbot Cursor’s AI pull-request reviewer. Official docs say it identifies bugs, security issues and code-quality problems and comments with explanations and suggested fixes. | Code security | — | Kiro (agent platform with security integrations) vs Cursor Bugbot |
| Cycode AI Teammates (Exploitability, Remediation and Change Impact agents) Cycode's AppSec AI agents that assess the exploitability of findings, generate fixes, analyse change impact and query the risk graph inside the Cycode platform. | Code security | — | Kiro (agent platform with security integrations) vs Cycode AI Teammates (Exploitability, Remediation and Change Impact agents) |
| Devin Cognition’s autonomous coding agent. Listed here only for documented Snyk MCP/CLI scanning and SonarQube/Snyk/Checkmarx IDE plugins — not as a dedicated security product. | Code security | — | Kiro (agent platform with security integrations) vs Devin |
| Endor Labs security agents (agentic triage and remediation) Pre-built AppSec agents that read Endor findings against your source, write SAST fixes or file exceptions, pick safe dependency upgrades and open PRs, and answer malware-exposure and CI/CD posture questions inside your coding agents. | Code security | — | Kiro (agent platform with security integrations) vs Endor Labs security agents (agentic triage and remediation) |
| Escape (AI pentesting and DAST) Offensive security platform using AI agents for attack surface discovery, business-logic DAST and multi-agent pentesting (Cascade) of APIs and web apps. | Code security | — | Kiro (agent platform with security integrations) vs Escape (AI pentesting and DAST) |
| Factory Droids Factory’s Droid coding agents. Listed here only because Factory’s own pages document Snyk Studio integration for scan/fix/verify inside Droid workflows. | Code security | — | Kiro (agent platform with security integrations) vs Factory Droids |
| GitHub Copilot Autofix LLM-generated suggested fixes for GitHub code-scanning alerts (CodeQL). Part of GitHub Code Security / Advanced Security; no separate Copilot subscription is required. | Code security | — | Kiro (agent platform with security integrations) vs GitHub Copilot Autofix |
| GitHub Copilot coding agent GitHub Copilot’s coding agent. Listed here only for the official workflow that assigns Dependabot security alerts to Copilot (or other agents) to open a draft fix PR. | Code security | — | Kiro (agent platform with security integrations) vs GitHub Copilot coding agent |
| GitLab Duo Vulnerability Resolution GitLab Duo features that explain SAST vulnerabilities and open merge requests with proposed AI remediations, including an agentic resolution flow. | Code security | — | Kiro (agent platform with security integrations) vs GitLab Duo Vulnerability Resolution |
| HCL AppScan RapidFix Agentic AI triage and auto-fix for SAST findings in HCL AppScan: an LLM pass reviews each finding's accuracy and severity, filters false positives, and a deterministic codemod framework writes fixes in repos and pull requests. | Code security | — | Kiro (agent platform with security integrations) vs HCL AppScan RapidFix |
| Kalpita CodeGuard Indian autonomous DevSecOps agent that scans each commit, generates a secure patch and opens a human-approved pull request. | Code security | — | Kiro (agent platform with security integrations) vs Kalpita CodeGuard |
| OpenHands Vulnerability Fixer (agent platform with security integrations) Agent platform with security integrations, not a dedicated AppSec scanner: OpenHands' open-source Vulnerability Fixer runs Trivy scans or ingests Snyk, Veracode or Checkmarx reports, then has OpenHands agents write and test fixes and open GitHub PRs. | Code security | — | Kiro (agent platform with security integrations) vs OpenHands Vulnerability Fixer (agent platform with security integrations) |
| Phoenix Purple (Phoenix Security) UK AI code-security agent platform with reachability-validated scanning, PR scanning, IDE/agent integrations and an agent that writes risk-tiered fix PRs. | Code security | — | Kiro (agent platform with security integrations) vs Phoenix Purple (Phoenix Security) |
| Pixee (automated triage and fix) Security 'harness' that triages SAST/SCA/DAST/secrets findings for exploitability, opens fix pull requests with the analysis attached, works inside coding agents, and builds design-stage threat models. | Code security | — | Kiro (agent platform with security integrations) vs Pixee (automated triage and fix) |
| Qodo multi-agent code review Agentic pull-request review platform (formerly CodiumAI) that flags bugs, security issues and rule violations with organisational context. A general code reviewer, not a dedicated SAST scanner. | Code security | — | Kiro (agent platform with security integrations) vs Qodo multi-agent code review |
| Semgrep Multimodal Semgrep’s AI layer (successor branding to Semgrep Assistant) for detection, triage, remediation guidance and optional autofix on the Semgrep AppSec Platform. | Code security | — | Kiro (agent platform with security integrations) vs Semgrep Multimodal |
| SonarQube AI CodeFix Sonar LLM-generated fix suggestions for a documented subset of SonarQube issues, in Cloud Team/Enterprise and Server Enterprise/Data Center editions. | Code security | — | Kiro (agent platform with security integrations) vs SonarQube AI CodeFix |
| Tembo Agent orchestration platform (not a dedicated AppSec scanner) that opens auto-fix PRs from Snyk vulnerability scans and Sentry production errors. | Code security | — | Kiro (agent platform with security integrations) vs Tembo |
| Veracode Fix Veracode’s AI-assisted remediation for SAST flaws and SCA dependency vulnerabilities, with suggested patches in IDE, CLI and SCM workflows. | Code security | — | Kiro (agent platform with security integrations) vs Veracode Fix |
| Xygeni DevAI and CoreAI (agentic AppSec) Agentic AppSec from Valladolid-based Xygeni: DevAI scans code in the IDE and generates validated fixes (including for AI-generated code), while CoreAI prioritises risk and orchestrates remediation PRs across the platform. | Code security | — | Kiro (agent platform with security integrations) vs Xygeni DevAI and CoreAI (agentic AppSec) |
| ZeroPath (AI-native SAST and autofix) AI-native AppSec platform that finds business-logic and auth flaws, validates findings from existing SAST tools, runs PR security reviews and generates one-click patches refined in natural language. | Code security | — | Kiro (agent platform with security integrations) vs ZeroPath (AI-native SAST and autofix) |
| Aikido Attack AI Pentesting Belgian autonomous AI pentest: many agents map the app, test attack paths and re-exploit each finding to confirm it, with a same-day audit-grade report. | Security | — | — |
| AWS Continuum for penetration testing (formerly AWS Security Agent) AWS frontier agent (formerly AWS Security Agent) that runs on-demand penetration tests of your applications with tailored multi-step attack scenarios, reproducible proof and ready-to-implement fixes, billed per task-hour. | Security | — | — |
| Equixly Agentic AI Hacker (continuous API pentesting) Italian offensive-security platform whose agentic AI hacker continuously maps APIs and applications, chains API interactions to find exploitable flaws, and validates findings for remediation. | Security | — | — |
| Hadrian Nova (agentic pentesting) On-demand penetration testing run by a fleet of AI hacker agents, paired with Hadrian Atlas for continuous external exposure management. | Security | — | — |
| Intruder AI Pentesting On-demand, code-aware web-app pentesting by AI agents built by Intruder's CREST-certified testers, with audit-ready reports in hours and issue-level 'micro pentests' to triage scanner findings. | Security | — | — |
| Maze AI Agents (Maze Cloud and Maze Code) UK AI agents that investigate every cloud and code vulnerability with code-to-cloud context, decide exploitability and deliver fixes. | Security | — | — |
| RunSybil Sybil (AI offensive security / autonomous pentesting) AI offensive security platform whose agents run black- or white-box autonomous pentests, chain vulnerabilities across code, APIs, cloud and infrastructure, reproduce every finding, and re-test on each deployment. | Security | — | — |
| Snyk Developer-first application security platform; Snyk Agent Fix (formerly DeepCode AI Fix) generates and validates AI-suggested remediations for Snyk Code findings. | Security | — | — |
Order is mechanical (shared dataset tags, then same primary category) — a relevance order, not a ranking or quality judgement. Framework tags indicate relevance, not certification.