AppSec (SAST/DAST/SCA)

autofixCSPMCVE tracking+6

Amnify scans code, cloud accounts and running applications for security problems, and runs penetration tests against them. It opens fixes as pull requests that can be reviewed and merged.

APX Labs

Dynamic web application scanning+5

APX Labs appears to operate in application security testing, but the available public results do not identify a distinct APX Labs DAST/SAST product page or a clear commercial profile.

ArmorCode

Reachable package vulnerability analysis+10

ArmorCode is redefining security governance in the AI era as the agentic control plane for Unified Exposure Management.

The Security Platform for The New Agentic AI Fabric.

Black Duck

Static application security testing+9

10 products

Black Duck (formerly Synopsys Software Integrity Group) provides a comprehensive application security platform focusing on Software Composition Analysis (SCA) and static/dynamic testing.

BlinkOps

Agentic SOC & Investigations

5 products

BlinkOps is an agentic security automation platform that utilizes AI-driven agents to handle end-to-end security operations tasks including alert triage, investigation, and incident containment.

AI agents investigate incoming alerts+7

Bright Security

Dynamic API security testing+8

Bright Security (formerly NeuraLegion) provides an AI-powered Dynamic Application Security Testing (DAST) and API security platform built for developer-centric workflows.

Burgus Security

I could not verify that a distinct vendor named Burgus Security has a documented Application Security product from the provided results.

Burp Suite

Burp Suite is PortSwigger’s web application DAST platform, used to crawl running applications, map attack surface, and run active and passive vulnerability scans without source-code instrumentation.

Checkmarx

Automated threat modeling+7

Checkmarx One is an application security software platform built to help enterprises secure every stage of the SDLC while reducing engineering costs and accelerating development.

Clearly AI is an AI-native security orchestration platform that automates the early stages of the Secure Software Development Lifecycle (SSDLC).

Clover Security

Design security review automationContinuous threat modeling+9

Product security agents that work with your team.

Cobalt.io

Pentest & Red Team

Static application security testing+11

Only Cobalt brings together the four critical elements of modern offensive security: elite human expertise, a context-aware platform, AI-powered orchestration, and the industry's largest dataset of real-world pentest results.

Founded in 2012 by developers Jaime Jorge and João Caxaria to help engineering teams raise the bar for code quality and security.

CodeWall

Static source code analysis+9

CodeWall is an autonomous application security testing vendor that focuses on black-box assessment of live applications and APIs rather than source-code analysis.

Contrast Security

8 products

Contrast Security provides an IAST platform that embeds agents into running applications, instrumenting code with sensors for real-time vulnerability detection and attack telemetry.

Corgea

Detects and fixes insecure codeBusiness logic flaw detectionSource and sink tracing+9

Application security that actually fixes the work, not just reports it.

Corridor

Static code vulnerability scanning+5

Corridor is a security vendor centered on application security scanning during code generation and testing, positioning its ACSM layer to catch vulnerabilities before they reach later SDLC stages.

CROSS-INTEL

advisorymanaged servicesMISP+3

CROSS-INTEL is a cybersecurity vendor that builds the Pyris platform. The platform is offered as six products for offensive testing, attack surface, threat intelligence, SOC operations, identity and third-party risk, alongside managed services and advisory delivered by the same team.

Cycode

Software Supply Chain & SBOM

3 products

AI Writes The Code. We Secure And Govern It.

Cytix

Change-based security testing+9

Cytix is a security testing platform positioned around application-risk analysis and targeted testing for changes in the SDLC.

Dam Secure

Dynamic application security testingStatic application security testingAutomated attack simulation+6

Code Security for AI-enabled Teams.

Datadog

API Security

8 products

Datadog is the leading observability and security platform for the AI era, providing businesses with unified visibility across the technology stack to manage complexity at scale.

Data Theorem is a leading provider in modern application security. Its core mission is to analyze and secure any modern application anytime, anywhere.

Continuous API discoveryAPI health analysis+9

DefendLab

AI-native SAST and DAST scanning+10

DefendLab is an application security platform focused on SAST and DAST-style testing for engineering-heavy product security teams.

depthfirst

Business-logic vulnerability detection+8

depthfirst is an applied AI lab pioneering the future to secure software, and we're just getting started.

Detectify

EASM

Automated threat modelingSecurity design review enforcement+7

Detectify is the application security platform that gives modern security teams ultimate control over their actual attack surface, delivering proprietary vulnerability data designed for both humans and agents.

Our mission is build secure software, without slowing down

eShard

Pentest & Red Team

Static, dynamic, and stress testing+9

A complete platform for security investigations of digital objects that brings tools, knowledge and teams together. Empower your experts with software and hardware security assessments.

Fencer

Continuous DAST scanningBlack-box runtime probingExact finding location+8

Fencer is the platform we wish we had.

Fluid Attacks

Since 2001, Fluid Attacks has been committed to growing as a team and developing its own technology to contribute to global cybersecurity.

Fortify by OpenText

Semantic code analysis queries+10

OpenText is a leading Cloud and AI company that provides organizations around the world with a comprehensive suite of Business AI, Business Clouds, and Business Technology.

Gecko Security is an application security testing vendor focused on finding exploitable code-level vulnerabilities that traditional rules-based SAST often misses.

GitHub CodeQL is a semantic code analysis engine that performs static application security testing (SAST) by building a queryable database of code facts and running predetermined vulnerability detection queries.

GitLab

Automated SAST in CI/CD pipelines+10

We're the company behind GitLab, the intelligent orchestration platform where teams and their AI agents ship secure software faster.

HCL AppScan

Crawl and attack live web apps+11

HCL AppScan is an application security testing platform focused on DAST and SAST, delivered through products such as AppScan Standard, AppScan Source, AppScan Enterprise, and AppScan on Cloud.

HCLTech (AppScan)

Context-aware SAST scanning+10

HCL AppScan is an enterprise application security testing platform acquired from IBM in 2019. It provides integrated DAST, SAST, IAST, SCA, and API security testing across cloud and on-premises deployments.

Heeler is an application security vendor focused on SAST-centric code analysis and remediation workflows, with product messaging that also spans adjacent AppSec functions such as secrets and open-source risk.

Impart

Runtime web application scanningBlack-box attack simulationAPI security testing+8

At AI Speed, Runtime Is the Only Source of Truth

Interpretica

AI feedback loopdistributed testing+5

Midair is the platform described on the Interpretica homepage. It combines static code analysis, distributed testing and runtime monitoring for embedded, networked and complex software systems. The page says it is intended for embedded devices, high-performance servers and complex environments.

Invicti

Proof-based DAST scanning+10

Invicti Security combines DAST leaders Netsparker and Acunetix into a DAST-first ASPM platform for enterprise web application and API security.

Kiuwan

IDE and CI/CD pipeline integration+8

Kiuwan provides a suite of application security tools centered on Static Application Security Testing (SAST) via Kiuwan Code Security, which scans source code for vulnerabilities like SQL injection, XSS, CSRF, broken

Konvu

Konvu Agents prove what's exploitable and ship the fix, at attacker speed.

Mattersec Labs Inc.

AI security auditfix verificationrelease testing+1

MATT is an AI security audit that tests a product with the attack patterns AI models use. It ranks the findings by business cost and re-proves each fix on every release.

Mend.io

Mend.io is the security platform built for every risk, across application security and AI security, securing the code layer, the AI layer, and the attack surface between them.

Miggo Security

Runtime application behavior monitoring+11

Miggo delivers an Application Detection and Response (ADR) platform that monitors application behavior at runtime to neutralize threats.

Mobb

AI Runtime & Agent Security

Mobb is a code remediation product positioned around static application security testing workflows rather than a standalone scanner.

Nokod Security

Agent discovery and ownership mapping+4

Nokod Security is a security vendor focused on runtime protection for AI agents and citizen-built automations, especially in no-code and low-code environments.

Nullify

Software Supply Chain & SBOM

Nullify is an application security platform centered on SAST and DAST workflows, with continuous code scanning and live endpoint testing aimed at finding exploitable issues before merge or release.

AI code security SAST+10

OX Security

7 products

OX Security is an enterprise software supply chain security platform that focuses on securing code, dependencies, build pipelines, and container artifacts across the SDLC.

Software is changing faster than ever. We're building security that evolves with it: continuous, autonomous, and always on.

Penetration testing servicesWeb application testingVulnerability assessments+6

Phoenix Security

Code-to-cloud reachability analysis+11

5 products

Phoenix Security is AI-native SDLC security. It covers your code from the moment it's written, by a person or by an AI assistant, to the fix in production. Most teams have more scanner findings than they can ever fix. Phoenix checks if the vulnerable code is reachable, from code to cloud. It removes duplicates and finds which team owns each issue. That cuts the noise by up to 98%. Then AI agents write the fix as a pull request. A person reviews it and decides. The agents help, they don't take over. Phoenix was named a Major Player in the IDC MarketScape for ASPM 2025.

Pi Security

Static application security testingDynamic application security testing+9

We believe security should compound over time, instead of resetting after every incident. Security posture shouldn't degrade when an engineer leaves, or a codebase scales.

Pradeo

Mobile Threat Defense

Mobile threat detection and response+10

Pradeo is a mobile security vendor focused on mobile threat defense for smartphones, tablets, and mobile applications.

Previty

compliance automationConfluence+6

Previty is a compliance platform that checks enterprise applications, including source code repositories and documentation, against IT policies, standards or guidelines supplied by the customer. It runs automated compliance checks, including on every code commit, and tracks compliance KPIs over time. It can also validate planned applications from diagrams and documents before coding begins.

PrimeSec Inc.

Static application security testing+3

Agentic development has made shipping secure products harder than ever. We built Prime to be the trusted advisor that knows your architecture.

Pulse Secure Pulse Policy Secure

NAC

Context-aware access controlAutomated BYOD onboarding+10

Secure Access Made Easy, Comprehensive, and Flexible

Qodo

Static application security testing+5

Qodo empowers engineering teams to standardize code quality and code review to move fast with AI

Qualys

Vulnerability Management

Continuous vulnerability scanning+10

Qualys provides Vulnerability Management, Detection and Response (VMDR), a cloud-based platform that automatically discovers assets across on-premises, cloud, and mobile environments, including unmanaged devices.

Rapid7

Vulnerability Management

9 products

Rapid7 is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience.

Raven.io provides a runtime application security platform that runs inside cloud-deployed applications to detect and block malicious code execution as it happens, independent of whether a CVE exists.

Runtime exploit prevention+5

Reykur

audit evidenceGitHubGitLab+7

Reykur is a continuous product security platform for the software development lifecycle. It builds a living threat model from tickets, docs, infrastructure-as-code and source code, and scores each risk from 0 to 10. Controls are raised in trackers, coding agent plans and pull requests, and audit evidence is collected as work happens.

Seezo

Map design reviews to standards+6

Automating Security Design Reviews with AI

Semgrep

Static application security testing+11

3 products

Semgrep is a developer-focused SAST platform that combines static analysis with multimodal AI reasoning to detect vulnerabilities in source code.

Snyk

Source code vulnerability scanning+8

5 products

Snyk is an application security platform providing SAST (static code analysis), DAST (runtime testing), and SCA (software composition analysis) capabilities integrated into CI/CD pipelines.

Sonar helps developers deliver high quality and secure software by analyzing code they write, AI-generated code, and code leveraged from third parties (like open source libraries).

Synopsys

AI agentsAPI integrationaudit logs+5

Synopsys is the leader in engineering solutions from silicon to systems, enabling customers to rapidly innovate AI-powered products.

Validato is a SaaS platform that provides a private, auditable ChatGPT-style environment and lets companies build custom AI agents trained on their internal knowledge. Administrators can see interaction logs, uploaded files, and keyword alerts, with role-based access control for users. The platform can run on a private cloud or a local deployment, depending on the security level a company requires.

Veracode

Dynamic web application security testing+10

7 products

Veracode is a cloud-native application security platform providing SAST, DAST, SCA, and runtime analysis capabilities.

Veriom

SAST scans source codebytecode+13

Every tool finds what. Veriom finds why. Your security tools found thousands of vulnerabilities last month. Not one of them told you why they exist. Veriom does.

Wapiti

Black-box web application scanningPayload injection fuzzing+10

Wapiti is an open-source black-box web application vulnerability scanner used in penetration testing to probe live sites for common flaws without source-code access.

Waratek

In the era of AI-generated code and rapid deployment, traditional security is falling behind.

Wiz

CSPM