Developer tools

AI coding assistant for security testing

Pickset · AI pair-programmer for authorized security testing on code you own

WatchingDraft scoreEmerging market · since 2021 · AI estimate

6PWAS score

Confidence

Based on 8 of 9 factors

Overview

AIThis description was written by a model from public signals. The facts behind it are listed under Evidence.

Problem: Enterprise developers and security teams need to perform security testing and create proof-of-concept exploits to identify vulnerabilities in their proprietary code, but widely-used AI coding assistants refuse to help with this work due to safety policies.
Solution concept: A developer-focused AI coding assistant that specifically allows and excels at security testing, vulnerability analysis, and proof-of-concept exploit generation for proprietary codebases, without the restrictions that general-purpose tools impose. It would be designed for legitimate security work within an organization's own systems.
Who has it: Enterprise security teams and developers working on proprietary codebases at companies paying for AI coding tools.
How they handle it today: Today, they work around restrictions by copying analysis from one AI tool (GitHub Copilot Enterprise) into another tool (Microsoft 365 Copilot) to generate the security testing or exploit proof-of-concept they need, then use those results in bug reports.
Why now: AI coding assistants have become standard tools in enterprise development, creating clear customer segments already accustomed to paying for AI assistance. The gap between what developers need for security work and what current paid tools allow has become frustrating enough to motivate workarounds.
How it could charge: Enterprise subscription pricing, similar to GitHub Copilot Enterprise, possibly with tiering based on team size or usage volume.

Verdict

Computed from the factor scores below, never written by a model. It decides nothing on its own: only the gate makes an opportunity a build candidate.

Score breakdown

A model sorted each factor into a rubric bucket; code turned buckets into numbers. Unknown factors are left out of the score and lower confidence instead.

Market validation

Confidence 30 · 2 evidence · Evidence shows scattered frustration with existing tools' restrictions on security testing, and users work around limitations, but no established market of security-focused AI assistants or widespread public demand signals.

Revenue evidence

Confidence 30 · 1 evidence · Evidence acknowledges enterprise customers pay for AI coding tools, but provides no sign that anyone currently pays specifically for a security testing AI assistant or that revenue exists in this narrow segment.

Growth

Unknown

No evidence of momentum in the security-focused AI coding assistant category or growth in demand for this specific capability.

Problem severity

Confidence 30 · 1 evidence · The problem is recurring friction: developers currently work around restrictions by copying between tools to access security testing capabilities, but workflows continue and the problem is solved through workarounds rather than blocking work entirely.

Economic proximity

Confidence 30 · Judged from the description · A security testing assistant is a productivity tool for developers; it sits upstream of decisions to fix vulnerabilities but does not directly automate revenue-generating sales, checkout, or cost-saving transactions.

Distribution

Confidence 30 · Judged from the description · This is a developer tool used by security teams within enterprises on proprietary code; results are internal bug reports and vulnerability findings, not public or embedded outputs that expose the product to non-users.

Buildability

Confidence 30 · Judged from the description · Building a credible security-focused AI assistant requires integrating multiple third-party code analysis APIs, training on security-relevant datasets, and careful safety review of outputs to avoid liability—more complex than commodity components but achievable with engineering effort.

Differentiation

Confidence 30 · 1 evidence · Users name a clear gap: general-purpose AI assistants block security testing work by policy, and the incumbents (GitHub Copilot Enterprise, Microsoft 365 Copilot) explicitly refuse this use case, leaving it unserved for developers who need it legitimately.

Retention and timing

Confidence 30 · Judged from the description · Security testing and vulnerability analysis are recurring workflows—developers perform them periodically as part of the development lifecycle—and there is a timing tailwind from increasing enterprise focus on security practices and compliance.

Risk penalties

Heavy regulationA tool explicitly designed to generate exploit proof-of-concepts and security testing code operates in a highly regulated space (data security, compliance frameworks like HIPAA/SOC2/PCI-DSS), and liability exposure is substantial if the tool is misused or if generated exploits cause unintended harm even within organizations.−15
Extreme competitionGitHub Copilot Enterprise and Microsoft 365 Copilot are entrenched competitors with massive resources; competing on security testing features requires not only overcoming safety restrictions but also matching general coding capability, and the incumbents could remove their restrictions if this segment becomes valuable.−6
Questionable data accessTraining and operating a security-focused code generation tool raises questions about data lineage: using open-source or public vulnerability data is defensible, but the tool may inadvertently learn from proprietary exploits or security research it should not use, creating licensing and IP risk.−9

Score history

6 · confidence 28 · config v1First score · 10 Oct 2026

AI coding assistant for security testing

Overview

Verdict

Build this business

Score breakdown

Risk penalties

Score history

Validation gate

Evidence · 3 items

Market validation

Revenue evidence

Differentiation

Market

Existing products

Build

Legal reconstruction check

Community