The Age of the Scanner Is Over
Finding vulnerabilities got cheap. Fixing them didn't.
AI is writing more of your code, and scanner licenses priced by lines of code or committers climb right along with it. DefectDojo brings findings from any engine, legacy or LLM-based, into one system of action. Sensei, DefectDojo's AI, scans your repositories and opens pull requests that fix the findings.
AI Code Volume Is Outrunning Scanner Budgets
Scanner pricing tied to lines of code, committers, or applications was built for code written at human speed. Your budget probably didn't grow with it, and finding vulnerabilities is turning into something several AI providers can sell you.
From Finding to Pull Request in One Platform
Software security used to be limited by how fast teams could find vulnerabilities. Anthropic says it's now limited by how fast they can verify, disclose, and patch them. Sensei, DefectDojo's AI scan-and-fix add-on for DefectDojo Pro, is built for that gap.
Connect a repository
Onboard repositories from GitHub, GitLab, Bitbucket, or Azure DevOps, including GitHub Enterprise Server, self-managed GitLab, and Bitbucket Server or Data Center.
Scan and import
Scan on demand, or automatically when a pull request opens. Results arrive as DefectDojo findings, working from the same deduplicated data as every other tool in your stack.
Review fix candidates
After each scan, Sensei stages the findings that match your criteria. No fix is generated and no LLM cost is incurred until you approve.
Open the fix
Approve a candidate, or click Fix on a finding, and Sensei opens a pull request against the branch you choose. On GitLab, it's a merge request.
Fix from the PR
Comment /fix on a pull request in GitHub, GitLab, or Bitbucket and Sensei pushes a remediation straight to that PR.
Replace the Scanner Without Rebuilding the Program
Sensei can replace the code scanners you pay for today. Run it next to your incumbent, compare the results, and cancel the contract once Sensei earns the job. DefectDojo keeps your findings, SLAs, and reporting in place, so switching engines never means starting over.
360+ Parsers, Plus a Path for Anything New
Every parser works in both Community Edition and DefectDojo Pro. A new engine without a native parser can come in through Generic Findings Import, or through the Universal Parser in DefectDojo Pro (Beta).
Prove It, Then Cut It
Run Sensei and your incumbent scanner as separate tests in the same engagement, compare what each one finds, then retire the one that isn't earning its price.
One Finding, Not Two
DefectDojo Pro deduplicates across tools, so two engines reporting the same vulnerability don't double your queue.
Negotiating Power at Renewal
Your findings, SLAs, and compliance reporting live in DefectDojo, not in a vendor's console, so you can walk away from a contract that stops earning its price.
You Decide What Sensei Fixes
Sensei clears the well-understood fixes so your engineers can spend their time on the vulnerabilities that need human judgment.
Preview First
No fix is generated and no LLM cost is incurred until someone approves it.
Access by Role
Configuring Sensei takes a global Maintainer or Owner role. Triggering a fix takes at least Writer access to the finding's asset.
Spend You Can See
Sensei usage is metered against your DefectDojo Pro license and shown at the top of the Sensei hub.
A Record of Every Run
Scan Activity logs each scan and fix run with its trigger, its status, and the pull request it produced.
Sensei Runs on DefectDojo Pro
Every Sensei fix starts from the same deduplicated findings as the rest of your stack.
| Capability | DefectDojo ProCloud · On-prem · Air-gapped | Pro + SenseiAdd-on for DefectDojo Pro |
|---|---|---|
| The system of action | ||
| Ingestion | 360+ parsers plus 140+ Upstream Connectors | |
| New engines | Universal Parser (Beta) | |
| Deduplication | Cross-tool | |
| Triage | AI-assisted triage | |
| SLAs | Enforcement | |
| Scan and fix | ||
| Repository scanning | Not included | GitHub, GitLab, Bitbucket, and Azure DevOps, including self-hosted options |
| Fixes | Not included | Opened as a pull request against the branch you choose |
| Approval | Not included | Preview first: no fix and no LLM cost until you approve |
| Fix from the PR | Not included | Comment /fix and Sensei pushes a remediation to that PR |
| Spend | Not included | Metered against your DefectDojo Pro license |
| See Pro pricing | Book a demo | |
Questions Practitioners Ask
Does Sensei replace my scanners?
Yes. Sensei does the job you pay a code scanner to do, then goes further: it scans your connected repositories, imports the results as DefectDojo findings, and opens pull requests that fix them. Run it beside your current scanner, compare the results, and retire the contract.
Can I bring an LLM-based scanner DefectDojo doesn't have a parser for yet?
Yes. Convert its output to the Generic Findings Import format in either edition, or map its JSON, CSV, or XML report directly with the Universal Parser in DefectDojo Pro, currently in Beta.
Is Sensei available in Community Edition?
No. Sensei is an add-on for DefectDojo Pro. Community Edition stays free with 360+ parsers and same-tool deduplication.
Which source control providers does Sensei support?
GitHub (github.com and GitHub Enterprise Server), GitLab (gitlab.com and self-managed), Bitbucket (Cloud and Server or Data Center), and Azure DevOps. Commenting /fix on a pull request works everywhere except Azure DevOps.
Do I control when AI runs and what it costs?
Yes. Fixes are preview-first, so nothing is generated and no LLM cost is incurred until you approve. Sensei usage is metered against your DefectDojo Pro license.