CybeDefend Review (2026): Pricing, Features & Honest Verdict

TLDR

CybeDefend is a French code security platform whose new VibeDefend command wires those scanners and your own business rules into Claude Code, Codex, Windsurf and Copilot at the moment the agent writes code. Clever, candid about data handling, still young. Best for: small teams shipping with coding agents. Price: from $19/mo billed yearly, free plan yes. Rating: 7/10.

What is CybeDefend?

We found CybeDefend on Product Hunt, where it launched on 28 September 2026 with VibeDefend, a one-line installer that puts security checks inside coding agents. The company behind it is CybeDefend SAS, registered in Lille, France, and started in January 2025 according to its about page. It runs the platform in two isolated regions, EU on Scaleway and US on Google Cloud, and self-hosts open-weight Mistral models instead of calling any outside AI API.

The platform itself is a fairly conventional application security suite: static analysis, dependency and licence scanning, secret detection, infrastructure-as-code and CI pipeline checks, container image scanning, plus AI triage and patch generation on top. Under the hood it wraps open-source engines (Opengrep, Trivy, KICS, Checkov, Syft, OSV, Gitleaks) with its own rules and a code graph. The marketing site says so openly, which we appreciated. This was a second Product Hunt launch; the first, in April 2025, was for the scanning platform alone.

What Are CybeDefend’s Key Features?

VibeDefend: rules and guards inside the agent

One command, npx -y @cybedefend/vibedefend@latest install, registers CybeDefend’s MCP server plus a hook layer in every agent it finds. We confirmed the package on the npm registry: version 1.4.4, published 24 September 2026, Node 18.17 or later. Before each edit, the hooks inject the business and security rules that apply to the file being changed. On any tool call, Action Guards evaluate the command and hard-block a denied one: a destructive sudo, a schema drop, a raw .env read, or a package that does not exist on the registry.

Business rules mined from your code

The part that separates CybeDefend from a plain scanner is its knowledge graph. Turn on the AI features and the platform builds a graph of file paths and short descriptions of what each file does, then derives rules such as tenant scoping on queries or an authorization ceiling on refunds. At the end of a substantive session VibeDefend runs a gap analysis and proposes rules you relied on but never wrote down, which you accept or reject from an inbox at the next session start.

The company published a controlled study on GitHub (Apache-2.0 licence, 49 business rules, three arms, blind audits) and its marketing site claims 89% of rules followed exactly with VibeDefend versus 12% without. We did not rerun it, so treat those figures as vendor numbers, though publishing the protocol and transcripts is more than most rivals do.

The scanning platform and AutoFix

Connect GitHub or GitLab and the platform clones each repo into a throwaway container, runs every scanner, keeps only the findings with file and line, and destroys the code. Findings are scored with CVSS 4.0, EPSS and a composite CybeRisk score, deduplicated across tools by Cybe Analysis, and Cybe AutoFix generates patches the agent applies. Reachability analysis tells you whether a vulnerable dependency is used. The Featurebase changelog shows monthly releases through 13 September 2026, including malware detection in dependencies and an organisation-wide findings endpoint for GRC and SIEM exports.

Region choice and self-hosted models

You pick EU or US at signup and nothing crosses that line. The subprocessor list names Scaleway (Paris and Amsterdam) for the EU region and Google Cloud for the US, and states that prompts and completions run on Mistral open-weight models CybeDefend operates itself. The terms, privacy policy and DPA all repeat that customer code never trains a model. For a European team with a GDPR or NIS2 brief this is the strongest argument on the site.

What Is It Like to Use CybeDefend?

Setup is quick: run the installer, pick a region, sign in through the browser, choose which detected agents to wire. Agent support is uneven, though, and the docs are candid about it. Claude Code, Codex and the other big agent editor get the full set of hooks. Windsurf only injects rules on writes and gets guards through an MCP fallback. VS Code Copilot has no Action Guards yet. Codex also requires you to trust the hooks by hand after install, or they stay dormant.

The dashboard side is a standard AppSec console with projects, a findings list, policies, reports and a chat assistant. IDE plugins exist for VS Code and the JetBrains family; the VS Code marketplace listing shows version 1.0.8 and just 25 installs, so most usage clearly arrives through agents rather than the editor plugin. A separate CLI (v2.1.1, released 12 September 2026 on GitHub under Apache-2.0) covers local and CI scans on macOS, Linux and Windows.

Where Does CybeDefend Fall Short?

The pricing page is less transparent than its own “no asterisks” line suggests. The headline card prices ($19, $229 and $640 a month) are annual-billing rates. The page’s JavaScript and its JSON-LD carry the real monthly prices: $21, $249 and $699. Those “Save 10%” and “Save 8%” badges are simply the gap between the two. The plan finder further down the same page quietly quotes $249 for the Team plan the card above prices at $229.

AI credits have no published price. Every plan lists a monthly credit quota and the docs describe add-on packs of 25 AutoFix, Security Champion or Analysis operations, but neither the pricing page nor the docs say what a pack costs or how many credits one AutoFix consumes. Unused credits expire at each reset. You only learn the real cost from inside the billing screen.

BLSA, the business-logic scanner, is sold as “early access” on the $640 Scale plan and “included” on Enterprise, yet the docs page says it is live for design partners only and not generally available. The Deeptech-labelled engine the about page celebrates is still, in September 2026, a roadmap item for most customers.

The VibeDefend installer is published under the Business Source License 1.1 and the repository linked from npm returned a 404 when we checked. You are installing hooks that see every edit and every shell command your agent runs, and you cannot read that code. SOC 2 Type II and ISO 27001 are both “audit under way”. All purchases are non-refundable and subscriptions auto-renew. The company is under two years old and by its own timeline had one engineer beyond the founders in January 2026.

How Much Does CybeDefend Cost?

CybeDefend starts at $19 a month on the Developer plan when billed yearly ($228 a year), or $21 month to month. In euros it is 19 EUR monthly or 204 EUR a year. Developer covers 3 repositories, 1 seat and 100 AI credits, with unlimited static scans, VibeDefend, IDE plugins, AutoFix and the Security Champion assistant included. Action Guards get 500 model-judged evaluations before falling back to regex rules.

Team is $229 a month billed yearly ($2,748) or $249 monthly, for 10 repositories, 5 seats and 1,500 credits, and adds container scanning, CI/CD gates, the HTTP API, Slack, Jira, Linear, RBAC and GRC exports. Extra repositories cost $12 and extra seats $24 a month, so a 20-repo, 10-seat team pays $469 on annual billing. Scale is $640 billed yearly ($7,680) or $699 monthly for 25 repositories, 15 seats and 5,000 credits, adding SBOM, policies and 90-day report retention. Enterprise is quoted, with SSO, private deployment and a 99.5% SLA.

The free plan is real: 10 static scans, 50 AI credits, no card, no expiry, and the site promises a promo code for half off your first paid month after the first scan. Startups can apply for 3 or 6 free months on any plan.

Against the field, Snyk’s Team plan starts at $25 a month billed monthly for teams of up to 10 developers, Semgrep charges $30 per contributor per month on Teams with a free edition up to 10 contributors, and Aikido lists Basic at $300 a month for 10 users. For a solo developer CybeDefend is the cheapest route to agent-time guards, and for a 10-person team its $229 Team plan lands below Semgrep’s $300.

Who is CybeDefend Best For?

Use CybeDefend if your team writes most of its code through Claude Code, Codex or Windsurf and you keep catching the same policy slips in PRs: missing tenant filters, unscoped deletes, secrets read straight from .env. The free tier costs nothing to try on one repo, the Developer plan is cheaper than any comparable per-seat scanner, and the EU region with self-hosted models will satisfy a data-protection officer who has already said no to US-hosted AI tools.

Skip CybeDefend if you need a mature, audited platform today. SOC 2 is not issued, BLSA is not shipping, the guard installer is closed source, and two of the five supported agents get partial coverage. Teams already paying for Snyk or Semgrep with a working CI gate gain the agent hooks but lose years of rule tuning. If your developers mostly use Copilot in VS Code, the headline feature does not apply yet.

Best CybeDefend Alternatives

Snyk

Snyk’s own plans page lists a Free tier and a Team plan from $25 a month, billed monthly, for teams of up to 10 developers, with 100 projects and 1,000 SAST tests a month. Its agent security and AI pentesting features sit behind an Enterprise subscription and a sales call, which is exactly the gap CybeDefend’s $19 plan attacks.

Semgrep

Semgrep’s pricing page shows a Free edition for up to 10 contributors and a Teams plan at $30 per contributor per month for Code and Supply Chain, with Secrets at $15 more, plus 20 AI credits per developer per month. It has the best custom-rule ecosystem of the three, but no equivalent of agent-time guards.

Aikido Security

Aikido’s pricing page offers a free Developer tier for 2 users with 10 repos and 10 AI autofixes a month, then Basic at $300 a month and Pro at $600 a month, each covering 10 users, with 10% off on annual billing. It bundles cloud, DAST and runtime protection CybeDefend does not have, at three to four times the price of CybeDefend’s Team plan.

Final Verdict: Is CybeDefend Worth It?

CybeDefend has found a real gap. Scanners that run on commit arrive after the agent has already written 400 lines, and rules files get ignored. Serving the rule at the moment of writing, and refusing the dangerous command before it runs, is the right layer, and CybeDefend has built it with more transparency about data handling than most security vendors twice its size. The free plan and the $19 Developer tier make trying it a zero-risk afternoon.

What holds it to 7/10 is maturity. Hidden monthly prices, unpriced credits, a business-logic engine still in design-partner mode, a closed-source installer and audits that are not finished all need another six months. Solo developers and small agent-heavy teams should install it now. Regulated buyers should bookmark it and come back when the SOC 2 report ships.