Skip to main content
Early access: get Pro free for 3 months →
DocsContact
Defend

Fix threats before
they become incidents.
Powered by breach intelligence
and live CVE data.

HZSec's AI assistant isn't a generic chatbot. It reads your scan results, matches your code against documented real-world breaches, and checks your dependencies against a live CVE feed — before you ask the first question.

Context-aware·Breach-matched·Live CVE feed
HZSec — AI Assistant
HZSec
▣ Scan Center
◈ Assistant
◎ Live Monitor
≡ Audit Log
⚙ Settings
Context: 4 findings · 2 breach matches · CVE DB synced 6h ago
HZSec Assistant
Found AWS key in config/prod.env:3. This matches the Uber 2022 pattern — exploited in <10 min after exposure. Here's the fix:
# config/prod.env
- AWS_ACCESS_KEY="AKIAIOSFODNN7EXAMPLE"
+ AWS_ACCESS_KEY=${AWS_KEY}
You
How do I rotate this key if it was already pushed?
Local-first·No cloud upload·Built for developers·Mac & Windows
Why This Matters

Generic security advice
lands wrong.

Asking a general AI tool “is my code secure?” doesn't work. It hasn't read your code, doesn't know your stack, and can't check CVEs against your actual dependencies.

Advice without context

Most AI tools give you textbook answers pulled from documentation. HZSec starts from your actual findings, your specific stack, and what's broken right now.

No breach history

Knowing that Log4Shell was exploited in under 2 hours after public disclosure changes how you prioritize. Generic AI doesn't carry that kind of operational context.

Stale threat data

CVEs are published every day. Without a live feed, security advice is based on last quarter's threat landscape — which is not the one you're defending against.

How It Works

Context loaded before
your first message.

01

Run a scan first

The assistant reads your findings before you type anything. No copy-pasting code, no manual context setup — it already knows what's broken.

02

Ask or get proactive alerts

Ask about a specific finding, or let the assistant surface high-priority issues it noticed. Every answer is grounded in your actual scan results.

03

Guided remediation

The assistant walks you through the fix step by step, explains why the pattern is dangerous, and references the real breach that matches your code.

04

Live Monitor watches the rest

Set a folder to watch. HZSec alerts you when a file change introduces a new finding — no manual rescan required.

Everything in the
Defend module.

A context-aware assistant, a live breach intelligence layer, real-time file monitoring, and agentic fixes — all running locally.

AI Assistant with codebase context

The assistant reads your scan results before your first message. No copy-pasting code, no manual context setup. It already knows what's broken and where.

Breach Intelligence layer

10+ documented real-world breaches are embedded as context. When your scan matches a breach pattern, you hear exactly how fast it was exploited and how.

Live CVE database

Connected to CISA and NVD feeds. The assistant can check your dependency versions against current CVEs and tell you which ones are actively exploited in the wild.

Live Monitor

Watch any folder for real-time change detection. When a file is modified in a way that introduces a new security finding, HZSec surfaces it immediately.

Managed API key (Pro)

On Pro, you don't need your own Anthropic key. HZSec manages it for you with 1,000 assistant messages per month included — no setup, no key rotation.

Agentic fixes with diff review

On supported findings, the assistant can propose and apply a code change directly. You see a full diff before anything is written — you stay in control.

What a conversation
actually looks like.

The assistant already knows your findings when you open it. Every answer references your code, your stack, and documented incidents.

HZSec — AI Assistant
HZSec
▣ Scan Center
◈ Assistant
◎ Live Monitor
≡ Audit Log
⚙ Settings
Context loaded: 4 findings · 2 breach case matches · CVE DB synced 6h ago
HZSec Assistant
I found an AWS access key in config/prod.env:3. This matches the Uber 2022 breach pattern — a hardcoded key in a config file, exploited in under 10 minutes after public exposure. The fix is to load it from your secrets manager instead:
# config/prod.env — proposed change
- AWS_ACCESS_KEY="AKIAIOSFODNN7EXAMPLE"
+ AWS_ACCESS_KEY=${AWS_KEY} # load from secrets manager
You
How do I rotate this key safely if it was already pushed to git?
HZSec Assistant
Assume the key is compromised. Revoke it in AWS IAM now, then issue a new one. Removing it from git history doesn't help — the old key was already readable by anyone with access to the repo at that point...
Why HZSec

Why not just use
an existing AI tool?

General-purpose AI is useful. But security assistance without code context, breach history, and live CVE data is just educated guessing.

vs ChatGPT

Broad security knowledge, good at explaining concepts. But it hasn't read your code, can't check your dependencies against live CVEs, and doesn't know which patterns actually caused real-world breaches at scale.

HZSec adds
  • Reads your scan results first
  • Live CVE database integration
  • Breach case context per finding
  • No copy-pasting code required
vs GitHub Copilot

Excellent at code completion and generation. Security suggestions are opportunistic — it flags patterns it recognizes inline, but there's no systematic scan, no severity ranking, and no remediation workflow.

HZSec adds
  • Systematic scan before assist
  • Severity-ranked findings
  • Fix workflow with diff review
  • Monitors for new issues live
vs Cloud AI security tools

Platforms that scan your repo by uploading it to their servers. Useful for org-level reporting, but requires repo permissions, sends your source code offsite, and runs on their schedule — not yours.

HZSec adds
  • Zero code egress, ever
  • Runs on-demand locally
  • No repo permissions needed
  • Works before pushing to git

Common questions
about the assistant.

Does the assistant access my source code?

The assistant uses your scan results and finding metadata — not raw source files. It knows what issues exist and where, but your code stays on your machine.

Do I need my own Anthropic API key?

On the free tier, yes. On Pro, HZSec provides a managed key with 1,000 messages/month included. You can also bring your own key at any tier for unlimited messages.

What is the Breach Intelligence layer?

10+ documented real-world breaches — Uber, Equifax, Verkada, Log4Shell, and others — are embedded as assistant context. When your scan matches a breach pattern, you hear the exact incident referenced.

What does Live Monitor watch for?

Any change to a watched file or folder is re-analyzed for security findings. If a modification introduces a new exposure, you're notified immediately without running a full scan.

Can I ask general security questions?

Yes. The assistant isn't limited to your current findings. You can ask about secure coding patterns, explore a CVE, or get a second opinion on a specific code snippet.

Is the assistant available offline?

The scan and Live Monitor run fully offline. The AI assistant requires a network connection to call the Anthropic API, but your code never leaves your machine as part of that call.

Context-aware security

Security intelligence that knows
your code before you ask.

Download HZSec and get an AI assistant pre-loaded with your findings, breach history, and live CVE data — running entirely on your machine.

Free tier free forever · Mac + Windows · 100% local processing