depthfirst

depthfirst, founded in 2024 in San Francisco by people from DeepMind, Databricks and Faire, trains its own security models and puts them to work across the software stack.

Its code analysis traces business logic, data flows and cross-service calls in place of rule-based static testing. For open source, a dependency firewall screens for malicious packages and a reachability check reports only vulnerabilities with a real execution path.

Agentic pentesting attacks running applications to confirm exploitability and retests after a fix, and secrets detection covers repositories, pipelines and runtime. Its first in-house model, Dfs-mini1, targets smart contract security.

The company lists AngelList, MoonPay, Supabase and Chainguard among its customers.