1 / 14

Heeler · Introduction

You can’t defer risk anymore.

Prevent it and fix it at machine speed.

AI is uncovering vulnerabilities faster than ever, and attackers use AI to weaponize them, often within a day. A backlog is no longer a place risk can wait. Burn down the backlog with deterministic fixes, exploitable first. Heeler automates security at every stage of the AI SDLC, from prompt to runtime.

01
Heeler Origins
02
Why now
03
The platform
04
Context
05
Prevention
06
Autotriage and remediation at scale
07
How Heeler compares
08
Pricing

keyboard

Use the arrow keys or the dots on the right

01 · Heeler Origins

Built by people who lived the AppSec backlog.

We spent years on the front lines of application security, watching the gap between security and development grow. AppSec teams were buried in findings while developers raced to ship.

flag

June 2023

Co-founders launch Heeler.

The goal: build security into how software is actually made, instead of bolting it on after.

hub

The foundation

The Context Engine.

A model of your code, cloud, owners and business impact, built automatically. Every guardrail, triage decision and fix reads from it.

smart_toy

Then AI arrived

Context and determinism became essential.

Agents began writing code faster than any team could review it. An LLM on its own can give a different answer each run, so security needed full context and the same answer every time. That is how Heeler was built.

all_inclusive

Today

Prevent, fix and operate, automatically.

One platform that secures the AI SDLC at machine speed, and keeps your team in control without adding headcount.

01 · The team

The people building Heeler.

A team of 11, all in product and engineering, and all former Rapid7. We met at Rapid7: some of us from the pre-IPO days, some when Rapid7 acquired DivvyCloud.

Leadership

Christopher Hertz

Chief Executive Officer

James Green

Chief Product Officer

Christopher DeRamus

Chief Information Security Officer

Board

Dave Zilberman

Board Member

Tae Hea Nahm

Board Observer

Backed by

01 · Customers

Trusted by AI-forward teams.

02 · Why now

The vulnpocalypse is here.

More vulnerabilities than ever, often exploited within a day, and the same team to fix them. The math no longer works, and every open finding is real risk.

+51%

vulnerabilities published, first half of 2026 vs 2025

38%

of exploited CVEs hit before, on or within 7 days of disclosure

<1 day

for a frontier model to turn known vulnerabilities into working exploits

~60%

of breaches happened when a patch was already available

02 · Why now

To survive the vulnpocalypse, AppSec has to adapt now.

trending_up

From security debt and exposure

arrow_downward

shield

To prevention

Stop new risk where it starts: in the agent, at the commit and on the pull request.

inbox

From triage by hand

arrow_downward

balance

To automated decisions

Every finding ranked the moment it lands, from what runs and what it reaches.

confirmation_number

From tickets

arrow_downward

bolt

To deterministic agentic fixes

The fix version is calculated, not guessed. An agent makes the change, validates it in your CI and repairs what breaks. Your team merges it.

03 · The platform

One automated loop: prevent, decide, fix.

Heeler stops risk as code is written, ranks and routes every finding on its own, and fixes it with merge-ready pull requests. People step in only to merge and grant exceptions.

person

People stay in charge

merge

Merge the fix

gavel

Grant exceptions

tune

Set once: tiers, SLOs, guardrails

03 · Coverage

The loop runs across all nine areas of risk.

Every area reads from the same Context Engine, so each finding is validated, fixed and prevented with the same picture of your code, cloud, business and people.

Validated, fixed, prevented, automated

smart_toy

Coding Agents

Skills, hooks, MCP and instruction files, scored and gated

package_2

SCA

Reachability from the call graph

code

SAST

Taint flow, source to sink

local_shipping

Supply Chain

Malicious packages and safe versions

account_tree

CI/CD

Pipeline and workflow risk

gavel

Licenses

License policy and SBOM on demand

key

Secrets

Validated live against the provider

deployed_code

Containers

Image risk mapped to running services

cloud

IaC

Misconfigurations before they deploy

04 · Context Engine

Context is the difference. Heeler builds it on its own.

Many tools hand your code to an LLM and hope it reasons its way to the right answer. Security cannot run on hope: the same finding has to get the same answer every time. Heeler gathers the context itself, from your catalog and ownership to what actually runs, so it can be deterministic wherever security requires it, and use AI where it helps.

Book a demo See what it gathers ↓

05 · Prevention

Prevention at every step, from before the first line to the merge.

MCP and Agent Skills guide the agent while it plans and writes. The Workstation Sensor watches what it does, the CLI stops bad commits, and PR Guardrails gate the merge. Each layer catches what the one before it could not.

As the agent writes

Agent Skills

Scans the agent runs on the change in hand.

As the agent acts

Workstation Sensor

Risky prompts, commands and injected instructions.

At the keyboard

Heeler CLI

Blocks the commit, fails the build in CI.

At merge

PR Guardrails

Your policy as a check on every PR.

06 · Autotriage

Fix what can hurt you first.

Autotriage sets Heeler Risk on each dependency and code finding: Urgent, Plan or Defer. It asks how critical the service is, whether an attacker can reach the flaw, and whether it is under attack. Teams get a short list to fix now.

Book a demo See how it decides

CVE-2025-24813

tomcat-embed-core 10.1.34

checkout-api

How critical is the service?

High

Tier 1 · Production

Can an attacker reach it?

High

Function reachable

Runtime library reachable

Internet accessible

Mitigated: No

Chaining: reaches PII datastore

Is it under attack?

High

Exploit threat: Confirmed

No LLM involved

Urgent

Fix within 14 days

06 · Re-evaluated

Priorities follow your environment as it changes.

Flip what is true about one real CVE and watch the level move. Heeler does this on its own whenever your environment changes. No re-triage meeting.

CVE-2025-24813

tomcat-embed-core 10.1.34

checkout-api

Tier 1 · Production

Tier 1 Tier 2 Tier 3 Tier 4

Mission-critical. Business impact High.

Function reachable

Your code calls the vulnerable function

Runtime library reachable

The library runs in the deployment

Internet accessible

Measured from the live deployment

Mitigated: No

e.g. Tomcat default servlet is read-only

Exploit threat

None Likely · EPSS 0.40+Confirmed

Heeler Risk

Urgent

Fix within 14 days

Plan

Fix within 60 days

Defer

Track it, 120 days

Try it: turn off Internet accessible, or add a mitigation.

06 · Remediation at scale

Burn down the backlog with fixes engineers can trust.

Heeler sequences the whole backlog, exploitable first, and works through it for you. Every fix is calculated, proven in your CI and opened merge-ready, so engineers review instead of research and AppSec stops chasing tickets.

Sequence the whole backlog

Exploitable first, then everything else
Every finding gets an SLO, nothing is skipped
Re-sequenced as your environment changes
Deadlines tracked and reminded for you

Autotriage →

Deterministic fixes

Never trades one CVE for another
No upgrade that breaks your build
Least disruptive, not the newest
One PR clears the package’s CVEs

SCA Auto-fix →

Proven by the fix agent

Never review a fix that won’t build
Builds the way your repo builds
Works behind private registries
Unproven fixes arrive as drafts

SAST Auto-fix →

Repair loop

Edits your code to clear failures
Developers comment; it revises
Takes feedback from review bots
Merge-ready when every check is green

Agent Executions →

06 · Ownership and routing

Every fix goes to the team that owns it.

Autotriage decides how urgent it is. Heeler then walks the ownership you already keep, from a rule for one package down to the repository's team, and stops at the first real team. That team gets a ticket, a message and an Auto-fix pull request.

07 · How Heeler compares

Heeler replaces three categories of tools.

Not another tool for your stack. One platform that retires three categories of them, and finishes the job each one only started.

Traditional scanning tools

Heeler adds cloud context for true exploitability and the ownership context to automate it. Post-Mythos, AppSec fixes what is actually dangerous first, at machine speed.

Snyk Mend GitHub Advanced Security Semgrep Endor Labs GitLab Ultimate SonarQube Socket JFrog Advanced Security Checkmarx Veracode

Remediation point solutions

Deterministic fixing built into one platform. No stitching together a separate tool for each part of the AI SDLC.

Pixee Backline

ASPM and all-in-one platforms

All their context and automation, but post-Mythos you need fixes at machine speed, not posture management.

Ox Security Wiz Code Cortex Cloud Arnica ArmorCode Apiiro Cycode Aikido DepthFirst

See every head-to-head comparison →

08 · Pricing

One price per developer. The whole platform.

Priced per contributing developer: anyone who committed to a monitored private repository in the last 90 days. AI agents that commit for a developer count under that developer.

Contributing developers

Per developer, per month

$35

1–199 devs

$30

200–299

$25

300–499

$21

500–999

$19

1,000–1,499

$17

1,500+

Every tier includes the whole platform: SCA, SAST, secrets, IaC, containers, CI/CD and agent file security, Auto-fix, Autotriage, PR Guardrails, MCP, Agent Skills, CLI, the Workstation Sensor, workflows, SSO and enterprise support.

Your rate

$21

per developer per month

Per year

$126,000

Billed annually, with quarterly true-ups as your contributing-developer count changes.

Heeler

Prevent it. Fix it.

At machine speed.

You can’t defer risk anymore.Prevent it and fix it at machine speed.

Built by people who lived the AppSec backlog.

The people building Heeler.

Trusted by AI-forward teams.

The vulnpocalypse is here.

To survive the vulnpocalypse, AppSec has to adapt now.

One automated loop: prevent, decide, fix.

The loop runs across all nine areas of risk.

Context is the difference. Heeler builds it on its own.

Prevention at every step, from before the first line to the merge.

Fix what can hurt you first.

Priorities follow your environment as it changes.

Burn down the backlog with fixes engineers can trust.

Sequence the whole backlog

Deterministic fixes

Proven by the fix agent

Repair loop

Every fix goes to the team that owns it.

Heeler replaces three categories of tools.

One price per developer. The whole platform.

Prevent it. Fix it.At machine speed.

You can’t defer risk anymore.

Prevent it and fix it at machine speed.

Prevent it. Fix it.

At machine speed.