Best SAST Tools

The Invicti Web + API (formerly Acunetix) legacy is built on runtime accuracy, speed, and proof your team can trust.

All the security tools we used were slow, confusing, overpriced and noisy. So we built better ones.

Amnify scans code, cloud accounts and running applications for security problems, and runs penetration tests against them. It opens fixes as pull requests that can be reviewed and merged.

Apiiro provides supply chain security capabilities as part of its application security platform, with a focus on inventorying software components, tracing code-to-runtime relationships, and detecting supply chain risk across SCM

APX Labs appears to operate in application security testing, but the available public results do not identify a distinct APX Labs DAST/SAST product page or a clear commercial profile.

Black Duck (formerly Synopsys Software Integrity Group) provides a comprehensive application security platform focusing on Software Composition Analysis (SCA) and static/dynamic testing.

I could not verify that a distinct vendor named Burgus Security has a documented Application Security product from the provided results.

Checkmarx One is an application security software platform built to help enterprises secure every stage of the SDLC while reducing engineering costs and accelerating development.

Product security agents that work with your team.

Founded in 2012 by developers Jaime Jorge and João Caxaria to help engineering teams raise the bar for code quality and security.

CodeWall is an autonomous application security testing vendor that focuses on black-box assessment of live applications and APIs rather than source-code analysis.

Contrast Security provides an IAST platform that embeds agents into running applications, instrumenting code with sensors for real-time vulnerability detection and attack telemetry.

Application security that actually fixes the work, not just reports it.

Corridor is a security vendor centered on application security scanning during code generation and testing, positioning its ACSM layer to catch vulnerabilities before they reach later SDLC stages.

CROSS-INTEL is a cybersecurity vendor that builds the Pyris platform. The platform is offered as six products for offensive testing, attack surface, threat intelligence, SOC operations, identity and third-party risk, alongside managed services and advisory delivered by the same team.

Cytix is a security testing platform positioned around application-risk analysis and targeted testing for changes in the SDLC.

Code Security for AI-enabled Teams.

Datadog is the leading observability and security platform for the AI era, providing businesses with unified visibility across the technology stack to manage complexity at scale.

Data Theorem is a leading provider in modern application security. Its core mission is to analyze and secure any modern application anytime, anywhere.

DefendLab is an application security platform focused on SAST and DAST-style testing for engineering-heavy product security teams.

depthfirst is an applied AI lab pioneering the future to secure software, and we're just getting started.

Our mission is build secure software, without slowing down

Endor Labs is a software supply chain security platform focused on open source governance and CI/CD risk detection. The platform targets DevSecOps teams seeking to reduce alert fatigue while maintaining security posture.

A complete platform for security investigations of digital objects that brings tools, knowledge and teams together. Empower your experts with software and hardware security assessments.

Fencer is the platform we wish we had.

Since 2001, Fluid Attacks has been committed to growing as a team and developing its own technology to contribute to global cybersecurity.

OpenText is a leading Cloud and AI company that provides organizations around the world with a comprehensive suite of Business AI, Business Clouds, and Business Technology.

Gecko Security is an application security testing vendor focused on finding exploitable code-level vulnerabilities that traditional rules-based SAST often misses.

GitHub CodeQL is a semantic code analysis engine that performs static application security testing (SAST) by building a queryable database of code facts and running predetermined vulnerability detection queries.

We're the company behind GitLab, the intelligent orchestration platform where teams and their AI agents ship secure software faster.

HCL AppScan is an enterprise application security testing platform acquired from IBM in 2019. It provides integrated DAST, SAST, IAST, SCA, and API security testing across cloud and on-premises deployments.

Heeler is an application security vendor focused on SAST-centric code analysis and remediation workflows, with product messaging that also spans adjacent AppSec functions such as secrets and open-source risk.

At AI Speed, Runtime Is the Only Source of Truth

Midair is the platform described on the Interpretica homepage. It combines static code analysis, distributed testing and runtime monitoring for embedded, networked and complex software systems. The page says it is intended for embedded devices, high-performance servers and complex environments.

Kiuwan provides a suite of application security tools centered on Static Application Security Testing (SAST) via Kiuwan Code Security, which scans source code for vulnerabilities like SQL injection, XSS, CSRF, broken

Konvu Agents prove what's exploitable and ship the fix, at attacker speed.

Mend.io is the security platform built for every risk, across application security and AI security, securing the code layer, the AI layer, and the attack surface between them.

Miggo delivers an Application Detection and Response (ADR) platform that monitors application behavior at runtime to neutralize threats.

Nullify is an application security platform centered on SAST and DAST workflows, with continuous code scanning and live endpoint testing aimed at finding exploitable issues before merge or release.

OX Security is an enterprise software supply chain security platform that focuses on securing code, dependencies, build pipelines, and container artifacts across the SDLC.

Software is changing faster than ever. We're building security that evolves with it: continuous, autonomous, and always on.

We believe security should compound over time, instead of resetting after every incident. Security posture shouldn't degrade when an engineer leaves, or a codebase scales.

Pradeo is a mobile security vendor focused on mobile threat defense for smartphones, tablets, and mobile applications.

Previty is a compliance platform that checks enterprise applications, including source code repositories and documentation, against IT policies, standards or guidelines supplied by the customer. It runs automated compliance checks, including on every code commit, and tracks compliance KPIs over time. It can also validate planned applications from diagrams and documents before coding begins.

Agentic development has made shipping secure products harder than ever. We built Prime to be the trusted advisor that knows your architecture.

Qodo empowers engineering teams to standardize code quality and code review to move fast with AI

Reykur is a continuous product security platform for the software development lifecycle. It builds a living threat model from tickets, docs, infrastructure-as-code and source code, and scores each risk from 0 to 10. Controls are raised in trackers, coding agent plans and pull requests, and audit evidence is collected as work happens.

Semgrep is a developer-focused SAST platform that combines static analysis with multimodal AI reasoning to detect vulnerabilities in source code.

Snyk is an application security platform providing SAST (static code analysis), DAST (runtime testing), and SCA (software composition analysis) capabilities integrated into CI/CD pipelines.

Sonar helps developers deliver high quality and secure software by analyzing code they write, AI-generated code, and code leveraged from third parties (like open source libraries).

Synopsys is the leader in engineering solutions from silicon to systems, enabling customers to rapidly innovate AI-powered products.

Veracode is a cloud-native application security platform providing SAST, DAST, SCA, and runtime analysis capabilities.

Every tool finds what. Veriom finds why. Your security tools found thousands of vulnerabilities last month. Not one of them told you why they exist. Veriom does.

In the era of AI-generated code and rapid deployment, traditional security is falling behind.

Wiz is a cloud security posture management (CSPM) platform that detects and remediates misconfigurations across multi-cloud environments (AWS, Azure, GCP) and infrastructure-as-code templates.

ZeroPath is an application security vendor centered on AI-native SAST and dynamic testing for running applications.