AppSec hiring
How AI Triage and Auto-Fix Close the AppSec Talent Gap
DerTriage ranks SAST findings by real risk and DerCodeFix proposes code fixes. A small security team clears the backlog without endless manual triage.
On-premise DerTriage and DerCodeFix AI assistants suppress false positives by up to 90% and generate context-aware code fix suggestions — fully offline, including air-gapped environments.
Securing the world's best teams
Meet DerTriage and DerCodeFix
How DerScanner AI agents help your team
DerTriage evaluates each SAST finding for exploitability and real-world impact. DerCodeFix produces context-aware code fix suggestions. Both run fully on-premises with no external API calls.
Air-gap deployment
No exposure outside the perimeter
Both agents deploy as part of DerScanner on-premise architecture. No internet at runtime, no data exfiltration risk, and no training on customer code.
Data privacy
Your code is not training data
DerScanner does not store your code and does not use it for machine learning. Built for defense, finance, healthcare, and government workflows.
DerTriage
Up to 90% fewer false positives
DerTriage evaluates exploitability and impact of each SAST finding. Detections unlikely to be exploitable get suppressed — the team reviews actual risks instead of noise.
DerCodeFix
Context-aware code fix suggestions
DerCodeFix generates targeted recommendations for the language, framework, and exact location of each finding. Developers see what to change, ready to review and apply.
- CI/CD pipelines
- IDE plugins
- Same SAST project
Workflow
Fits the existing pipeline
Results surface through the same tools your team already uses — Jenkins, TeamCity, Azure DevOps, GitLab CI; IntelliJ IDEA, Eclipse, Visual Studio.
NEW | DERAI-LITE
Run AI triage on the hardware already in place
DerAI-Lite is a lightweight edition of DerTriage and DerCodeFix. It needs less memory, runs without a graphics card and installs on the same server as DerScanner SAST.
0 GPUs
AI agents run on the server CPU
1 server
SAST and both AI agents on one host
Requirements
Standard edition
DerAI-Lite
Graphics card
Required
Not required
Memory footprint
Standard
Reduced
Where it runs
On-premise, air-gapped
On the SAST server, air-gapped
DerTriage and DerCodeFix features
Full
Same as standard
How it works
How DerScanner AI Agents Work
Scan
DerScanner runs a SAST scan against the source code or binary across 43 languages. All analysis runs locally on your premises.
Triage
DerTriage evaluates each finding by code structure, framework behaviour, and business logic. Non-exploitable detections are suppressed before they reach developers.
Prioritize
Surviving findings are ranked by severity and mapped to OWASP Top 10, CWE/SANS Top 25, OWASP MASVS, PCI DSS 4.0.1, and HIPAA.
Fix
DerCodeFix proposes a code change for each finding. Developers review and apply it.
Teams already shipping with DerScanner
When looking for the scanner to build our secure development process on, we evaluated the capabilities of global leading vendors. We were surprised with the very convenient licensing model along with the capabilities of the product. DerScanner addresses our main challenge of checking the health of our product's code.
We use DerScanner to support our secure code review and SAST services. Its broad language support, reliable static analysis, and actionable findings help our consultants deliver consistent, high-quality security assessments.
Frequently asked questions
DerTriage is DerScanner's on-premise AI triage assistant. It evaluates each SAST finding for exploitability and real-world impact, suppressing detections that are unlikely to be exploitable. The result is up to 90% fewer false positives reaching developer queues – without external API calls or data leaving your environment.
DerCodeFix is DerScanner's on-premise AI fix generation assistant. For each prioritized finding, it produces context-aware code fix suggestions tailored to the language, framework, and code location of the vulnerability. Like DerTriage, DerCodeFix runs fully offline and air-gapped.
No. Both modules run fully on-premises, including in air-gapped environments with no internet access. The AI architecture released in June 2025 was specifically built to operate offline. Source code, findings, and fix suggestions stay inside your infrastructure end-to-end.
No. DerScanner does not store customer code and does not use it for machine learning. The AI modules run on infrastructure you control, and customer data never leaves your environment.
DerTriage analyzes how each vulnerability behaves in the context of your actual code – framework patterns, data flows, business logic – rather than matching surface-level signatures. Findings unlikely to be exploitable are suppressed before they reach developer queues, reducing false positives by up to 90%.
Yes. DerCodeFix produces context-aware code fix suggestions tailored to the specific language, framework, and code location of each finding. Developers see the proposed code change directly in the finding view, ready to review and apply.
No. DerCodeFix generates the fix suggestion; developers review and apply it within their IDE or CI/CD workflow. The human-in-the-loop approach is intentional – automatic code modification in production environments creates risk that human review prevents.
DerTriage and DerCodeFix activate as options during SAST scan setup. They operate on SAST findings from source code analysis and binary analysis across all 43 supported languages, including Delphi, Pascal, Perl, Scala, COBOL, and ABAP.
Yes. The on-premise, air-gapped architecture, combined with no-training-on-customer-data policy and MITRE CWE compatibility, makes DerScanner suitable for defense, finance, healthcare, and government workflows. Compliance reports cover PCI DSS 4.0.1, HIPAA, and OWASP standards.
Cloud-based tools require sending source code or findings to a vendor cloud for AI processing. DerTriage and DerCodeFix run fully offline on infrastructure you control – your code never leaves your perimeter, and DerScanner does not train on it. This makes the platform suitable for air-gapped environments and regulated workflows.
DerAI-Lite is a lightweight edition of DerTriage and DerCodeFix. It needs less memory, runs on the server CPU without a graphics card and installs on the same server as DerScanner SAST.
No. Both AI agents run on the server CPU, so one host covers SAST, DerTriage and DerCodeFix.
The standard edition requires a graphics card. DerAI-Lite runs without one, uses less memory and installs on the SAST server. DerTriage and DerCodeFix features are the same in both editions.
Run DerTriage and DerCodeFix on in-house code.
- Run AI triage and fix suggestions fully on-premise.
- Try DerAI-Lite on the same server as SAST — no GPU required.
- Keep source code and findings inside your perimeter.
Prefer email? company@derscanner.com