SILICON VALLEY, California — Cyfendo is focusing its UK outreach on the work development teams face after a software security alert: investigating the finding, preparing a repair and checking the result. The Silicon Valley company’s AI application security platform connects these tasks for small and medium-sized businesses, with developers reviewing the evidence before accepting code changes.
The UK government’s Cyber Security Breaches Survey 2025/2026 found that 31% of businesses were using AI, adopting it or actively considering doing so. Among that group,24% reported having cyber security practices or processes to manage the associated risks. These figures cover AI use broadly, rather than specifically AI-generated software, but provide context for businesses deciding how to manage new technology.
For a development team at a small or medium-sized business, a security finding can create a second project: establish whether the issue is real, work out what needs changing and check that the repair preserves the application’s normal behaviour. Cyfendo connects those tasks in a workflow that keeps the developer responsible for the final decision.
“Getting a security alert is only the beginning,” said Bryan Vuong, founder and CEO of Cyfendo. “Teams still need to understand whether the issue can be exploited, how to fix it, and whether the fix works without breaking the application. We built Cyfendo to help with that work and give developers evidence they can review before approving a change.”
Following a finding through to a tested fix
Consider an illustrative example: an application builds a database query by combining a command with text supplied by a user. A scanner may flag possible SQL injection. The next questions are whether that input can reach the query, whether it is handled safely along the way, and whether an attacker can change the query’s intended behaviour.
Cyfendo traces untrusted input through source code to sensitive operations. For supported findings, it uses an isolated environment to investigate exploitability and records evidence for review. It can then propose a code change, such as replacing a constructed query with a parameterised one, replay the demonstrated attack and run relevant existing application tests. This example illustrates the workflow; it is not a report of a particular customer incident.
The results describe what was tested in that environment. Production exposure also depends on configuration, permissions and other controls, and passing tests does not establish that an entire application is secure.
Developers inspect the evidence and proposed patch before deciding whether to accept it. Cyfendo does not directly merge patches into production software.
Use by development teams and security providers
The company is exploring relationships with UK managed security providers, distributors and testing consultancies serving small and medium-sized businesses. These discussions concern how code analysis and remediation checks could fit alongside existing testing and advisory services, including work between scheduled assessments.
Development teams can connect GitHub, GitLab or Bitbucket repositories, upload project files or use the command line. Cyfendo also supports workflows involving AI coding tools, allowing teams to assess the resulting application code as it changes.
Cloud scans run in temporary sandboxes that are destroyed when the scan ends, with encrypted findings retained. Private Scan keeps source code off Cyfendo’s servers. When configured with a local model, code remains on the customer’s machine; when configured with an external AI provider, requests are sent to that provider using the customer’s own key and are subject to its terms and settings.
Evidence and availability
Cyfendo’s website currently reports 1,210 critical-severity findings across 335 scanned codebases, approximately four per codebase, with about seven in ten findings rated high or critical. These are company scan statistics, not a representative survey of UK businesses.
In its published evaluation of OWASP Java Benchmark v1.2, Cyfendo reported 94.06% recall and 96.38% precision. Those figures measure detection on benchmark cases. They are company-reported results, do not constitute OWASP endorsement, and do not independently validate the platform’s patching performance.
The platform is available now. A free plan includes up to 10,000 lines of code, five scans per month and limited patch evaluation. Paid self-service plans start at US$99 per month and include proposed patches and higher scan limits.
UK businesses interested in evaluating the platform, and organisations considering partnerships, reseller or distribution arrangements, can contact contact@cyfendo.com. Product information is available at https://cyfendo.com.
About Cyfendo
Cyfendo Inc. is a Silicon Valley application security company founded by Bryan Vuong, a former engineering leader at Google and Meta. His experience includes AI, privacy, safety and security. Cyfendo helps development teams find software vulnerabilities, investigate exploitability and evaluate proposed fixes while retaining control over code changes.
Media contact
Wendy Nguyen | Cyfendo Inc.
contact@cyfendo.com | https://cyfendo.com
Sources for editors
UK government survey: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-
20252026/cyber-security-breaches-survey-20252026
Product information, scan statistics, pricing and benchmark methodology: https://cyfendo.com
