How Pisteyo used Claude Code to build a security and compliance platform that replaces a scan priced like an annual audit with one that runs on every commit.
Live
Pisteyo used Claude Code to build Leonidus, a security and compliance platform that finds vulnerabilities, secrets and compliance gaps in code and in live applications. Established enterprise scanners are sold as annual contracts, with published 2026 figures running $20,000 to $40,000 a year for a company of 51 to 200 people, before audit fees. That pricing shape is why scanning is treated as a periodic event. Leonidus was built in six days, covers 167 compliance frameworks, and scans for $5 to $15, which makes running it on every commit the obvious choice. It is in production today, scanning code for two external clients and for Pisteyo's own products.
Leonidus was built for CloudOMax and runs as a production security and compliance platform at penta.pisteyo.ai. It serves engineering teams, security and compliance officers, and managed service providers who run reviews across many client accounts. It is in production today, scanning code for two external clients, a healthcare third-party administrator and a change-management firm, alongside Pisteyo's own products.
Enterprise security scanning has always been sold the way audits are sold. Established platforms are sold as annual contracts, with published 2026 figures running $20,000 to $40,000 a year for a company of 51 to 200 people, before audit fees. That pricing shape is why organizations buy one scan, once a year, and treat the result as a certificate rather than a signal.
A staged delivery designed for quality, compliance, and trust — moving from scope to a production-ready capability without disrupting the business.
Scoped the platform as one product rather than four, so compliance posture, static analysis, dynamic testing and dependency scanning would share a single set of findings.
Wrote each compliance framework as a single ticket carrying its publisher, its canonical source and its expected control count.
Ran an automated loop that handed the oldest ticket to Claude Code, then filed each result into one of two queues: finished, or needs a human.
Built the four scan engines and the control-mapping layer that turns a raw finding into cited evidence.
Shipped the integration surface: a downloadable Claude Skill, a local MCP server, and a remote MCP endpoint exposing ten tools.
Added the pre-deploy gate, with a signed callback and retries, so a pipeline can block on a verdict.
The honest view: every deployment meets real-world constraints. Here is what was hard, and the deliberate choices that kept quality high and risk low.
167 frameworks and 2,805 controls is a year of manual authorship. Writing each framework as a ticket with its publisher, canonical source and expected control count let an automated loop build the library in a week, with a needs-a-human queue for anything it could not finish.
A report that summarizes a regulation is not audit evidence. Every control carries a link to its authoritative source, so a finding cites the regulation itself.
Framework detection replaced framework selection. The platform reads the codebase and ranks frameworks as required, recommended or optional, with a confidence score and a reason.
The overnight build loop built and verified a package for publication, then stopped and left the irreversible publish step for a person to approve.
The headline change is not that scanning got cheaper. It is that scanning got frequent, and the cost is what made frequency possible.
“It's really amazing how fast we can build with AI now and how thorough of a tool we can build that offers an alternative to expensive incumbents at a fraction of the cost”
The near-term roadmap moves from finding problems to attesting to controls. Each control gets a pre-drafted answer pulled from the platform's own procedure library, so preparing for an audit becomes review rather than authorship. The pattern generalizes well past security: any obligation that can be expressed as a set of controls can be checked continuously rather than annually, as long as the checks can be automated and the evidence cites an authoritative source.
Source code, dependencies, live URLs and secrets. Four engines run under one platform: static analysis, dynamic testing against a running application, dependency analysis and secret detection. A quick pass runs roughly 1,500 checks in five to ten minutes; a deep pass adds crawling, active fuzzing and injection probes across roughly 3,500 checks.
Every finding is evaluated against 167 frameworks and 2,805 controls, and each control carries a link to its authoritative source. The report points at the regulation itself rather than a vendor's paraphrase, so the output stands up as auditor-grade evidence rather than a starting point.
No. Leonidus reads the codebase, its dependencies and its structure, then ranks frameworks as required, recommended or optional, each with a confidence score and a stated reason. Framework detection replaces framework selection.
Inside the tool they already work in. Leonidus ships a Claude Skill, a local MCP server and a remote MCP endpoint exposing ten tools. An engineer adds one file to the repository, sets one environment variable, then asks their own Claude Code session to run a review. Findings come back as markdown, sorted by severity.
No. It runs on Azure and is model-agnostic by design, so any frontier model can be routed into the pipeline and model choice is a configuration decision per stage. Claude models run the analysis stage, interpreting raw findings and assessing a codebase's threat posture.
The same operator-led approach — strategy, build, and measured adoption — applied to your workflows.
