# Airship

> Airship deploys autonomous security agents that continuously find and fix vulnerabilities across your APIs, web apps, code, infrastructure, and cloud.

Airship is an autonomous security platform that continuously discovers, validates, and remediates vulnerabilities across APIs, web applications, source code, binaries, firmware, and cloud infrastructure. It explores attack surfaces, verifies exploitable weaknesses, reviews code changes, and helps prevent vulnerable releases. Beyond proactive security testing, Airship investigates security incidents, identifies root causes, and accelerates resolution through autonomous remediation workflows.

- [Book a demo](https://cal.com/airship/discovery)
- [Docs](https://airshipsecurity.com/docs.md)
- [Pricing](https://airshipsecurity.com/pricing.md)
- [Changelog](https://airshipsecurity.com/changelog.md)
- [Source on GitHub](https://github.com/useairship/airship)

## What it does

- **APIs and web apps.** Autonomously test REST APIs, GraphQL endpoints, and web applications for exploitable vulnerabilities, backed by real exploit evidence.
- **Code, binaries, and firmware.** Analyze source code, pull requests, compiled binaries, and firmware to uncover security weaknesses, with or without source access.
- **Infrastructure and cloud.** Discover exposed services, insecure configurations, and exploitable weaknesses across cloud and infrastructure environments.
- **Security assurance.** Integrate security testing into CI/CD pipelines to review code changes, validate findings, and catch vulnerabilities before deployment.
- **Continuous threat discovery.** Continuously explore your attack surface and test emerging CVEs against your systems as new threats emerge.
- **Autonomous incident response.** Investigate security incidents, identify root causes, generate remediations, and verify fixes to accelerate resolution.
- **Automated remediation.** Generate patches, retest vulnerabilities, and deliver merge-ready pull requests for supported remediation workflows.

## Authorized testing

Only test systems you own or have explicit, documented permission to test. See [Authorized testing](https://airshipsecurity.com/docs/authorized-testing.md).

## Pricing

Custom pricing. Autonomous security agents for your whole stack, scoped to your team and your attack surface.

- Autonomous security testing for APIs and web apps
- Source code, binary, and firmware security testing
- Pull request and CI/CD security reviews
- Cloud and infrastructure security testing
- Continuous vulnerability and CVE testing
- Accelerated incident response and remediation
- Self-host on your own infrastructure
- SAML, SSO, and role-based access control
- Priority support and updates

[Talk to us](https://cal.com/airship/discovery): A short call with the founders. No commitment.

## FAQ

### What does Airship secure?

Airship deploys autonomous security agents across your APIs, web apps, code, infrastructure, and cloud. They discover your attack surface, validate findings with proof-of-exploit, and deliver merge-ready fixes.

### Is my source code safe?

Your source code is never stored or used for model training. All model providers operate under zero data retention agreements. Enterprise customers can self-host in their own VPC or air-gapped environment.

### How long does setup take?

Minutes. Connect your repository, and Airship's agents get to work right away. First results typically arrive within 5 minutes.

### How are findings validated?

Every finding ships with a proof-of-exploit and reproduction steps, validated against your live environment. No theoretical risks — only confirmed, exploitable vulnerabilities.

### Can Airship auto-fix vulnerabilities?

Yes. Airship generates a fix, retests to confirm the vulnerability is gone, and delivers a merge-ready pull request. Review, merge, done.

### Does it integrate with my CI pipeline?

Yes. Airship plugs into your CI/CD pipeline and reviews every pull request for security issues. Vulnerable code is flagged before it can be merged.

### Can I self-host Airship?

Yes. Enterprise customers can deploy in their own VPC, on-premise, or in an air-gapped environment with complete control over infrastructure.

### How is Airship different from traditional scanners?

Traditional scanners rely on known signatures and produce noisy results. Airship's agents understand your codebase, business logic, and architecture, delivering context-aware findings with proof-of-exploit and auto-fix.

### Does it provide continuous monitoring?

Yes. Airship runs continuously, not just at deploy time. Your attack surface is monitored around the clock, and new CVEs are tested against your systems automatically.