OpenAna

What OpenAna is

OpenAna’s Ana is an engineering platform for software development, security, DevOps, AI/ML, and embedded systems. For security teams, it takes in findings, prioritizes vulnerabilities, and can generate fixes, submit pull requests, or apply fixes directly. Coverage includes SAST and DAST, SBOM and SCA remediation, secrets detection, infrastructure-as-code fixes, and API security remediation. Ana can incorporate accepted fixes and team feedback into later suggestions. It connects with tools such as GitHub, GitLab, Bitbucket, Jenkins, CircleCI, ArgoCD, Wiz, Snyk, Trivy, Jira, Slack, and Teams. Data options include SBOM, SARIF, JSON, and CSV, plus files, webhooks, REST, and GraphQL. OpenAna describes access controls, encryption, and audit trails, and says Ana can generate evidence for standards including ISO 27001, NIST, PCI-DSS, SOC 2, and HIPAA. Deployment options are SaaS or a customer VPC, with OpenAI, Anthropic, Mistral, and private on-premises models listed. Pricing is on request; there is no free plan.

Who it suits

It suits engineering and security teams seeking automated remediation across their development and operations tools. Organizations can choose SaaS or VPC deployment and select among the listed model options.

Limits

There is no free plan, and plan pricing is available on request. Basic provides a lite version, basic integrations, a shared instance, community support, standard security features, and basic analytics; Professional adds advanced integrations and features, while Enterprise adds dedicated infrastructure and custom options. LLM red teaming and automated penetration testing are currently marked coming soon.

Getting started

1. Visit the OpenAna website
2. Choose SaaS or customer VPC deployment
3. Select a Basic, Professional, or Enterprise plan
4. Connect supported repositories, security tools, CI systems, or collaboration apps
5. Provide supported findings or data through files, webhooks, REST, or GraphQL
6. Select an available model option and configure Ana's workflows

Verdict

OpenAna combines security remediation with broader engineering and DevOps capabilities. Teams should weigh its deployment and integration options against pricing on request and the absence of a free plan.