Claude Security and Ares both bring AI to application security, but they operate on opposite sides of the build-and-defend cycle. Claude Security is a source-code analysis tool; it reads a codebase the way a researcher would, flags vulnerabilities, and proposes patches inside Claude Code.
Ares is an autonomous offensive security platform. It engages running APIs, web applications, and mobile applications as a real adversary would, and proves exploitability rather than inferring it from source. The two are best understood as complementary; the matrix below shows where each is strongest.
Dynamic runtime testing (DAST)
Not in scope. Claude Security operates on source, not running systems.
Primary methodology. Dolos executes runtime tests against staging and production targets under contract.
Works without source code access
Requires a connected repository.
Black-box and gray-box modes. Useful for testing acquired companies, third-party APIs, and vendor systems.
Inferred from source. No interaction with the live API surface.
Purpose-built. The Hermes agent exercises every endpoint against the OWASP API Security Top 10.
Mobile application testing (iOS / Android)
Yes. Both Android and iOS
OWASP API Security Top 10 coverage
Partial — limited to what is observable in source (e.g., missing auth checks).
Full runtime-validated coverage in v2, including BOLA, BFLA, and unrestricted resource consumption.
Findings are surfaced individually.
Nemesis chains primitives into full kill-chains, modeling what a real operator would build.
Not in scope. Claude Security operates on source, not running systems.
Data-driven, accurate and updated in real time
Requires a connected repository.
Black-box and gray-box modes. Useful for testing acquired companies, third-party APIs, and vendor systems.
Inferred from source. No interaction with the live API surface.
Purpose-built. The Hermes agent exercises every endpoint against the OWASP API Security Top 10.
Yes. Both Android and iOS
Partial — limited to what is observable in source (e.g., missing auth checks).
Full runtime-validated coverage in v2, including BOLA, BFLA, and unrestricted resource consumption.
Findings are surfaced individually.
Nemesis chains primitives into full kill-chains, modeling what a real operator would build.