AppSec (SAST/DAST/SCA)

Real-time malware detection+10

All the security tools we used were slow, confusing, overpriced and noisy. So we built better ones.

AlgoSec

NAC

Policy-based network access enforcement+11

AlgoSec provides a security policy management platform that automates the orchestration of connectivity and security policies across hybrid cloud and on-premise environments. It provides deep visibility into complex network topologies, enabling automated risk analysis and firewall rule changes without manual intervention. The platform replaces manual CLI-based firewall management and integrates with ITSM tools to streamline security operations.

APX Labs

Dynamic web application scanning+5

APX Labs appears to operate in application security testing, but the available public results do not identify a distinct APX Labs DAST/SAST product page or a clear commercial profile. Based on the surrounding AppSec sources, the relevant scope would be runtime DAST-style scanning of web applications and APIs, with SAST only if APX Labs also analyzes source code or binaries. Because the company’s product details are not well documented in the provided results, buyer fit, feature depth, and market position cannot be confirmed with high confidence.

ArmorCode

Aggregate findings from security scanners+11

ArmorCode is redefining security governance in the AI era as the agentic control plane for Unified Exposure Management.

Backslash Security

Internet-reachable code vulnerability detectionReachable package vulnerability analysis+10

The Security Platform for The New Agentic AI Fabric.

Black Duck

Static application security testing+9

10 products

Black Duck (formerly Synopsys Software Integrity Group) provides a comprehensive application security platform focusing on Software Composition Analysis (SCA) and static/dynamic testing. It enables organizations to manage open-source risks, identify vulnerabilities in proprietary code, and ensure license compliance across the SDLC. The platform complements DevSecOps workflows by integrating security gates into CI/CD pipelines and providing deep visibility into software supply chain risks.

BlinkOps

Agentic SOC & Investigations

AI agents investigate incoming alerts+8

BlinkOps is an agentic security automation platform that utilizes AI-driven agents to handle end-to-end security operations tasks including alert triage, investigation, and incident containment. It replaces traditional, manual SOAR playbooks with LLM-powered agents that can interpret natural language instructions to execute complex workflows across disparate security tools. The platform provides a low-code/no-code interface for building scalable security automations that reduce Mean Time to Respond (MTTR).

Bright Security

Automated dynamic application security testing+9

Bright Security (formerly NeuraLegion) provides an AI-powered Dynamic Application Security Testing (DAST) and API security platform built for developer-centric workflows. It focuses on identifying business logic vulnerabilities and security flaws early in the SDLC with low false positive rates. The platform integrates seamlessly into CI/CD pipelines, allowing security teams to empower developers to fix vulnerabilities before production without slowing down release cycles.

Burgus Security

Inspects LLM API traffic in production to enforce security checkpoints on prompts, responses, and agent-to-model exchanges for agentic applications.

I could not verify that a distinct vendor named Burgus Security has a documented Application Security product from the provided results. The only application-security-related result tied to the name is a directory-style entry that appears to refer to general application security services rather than a clearly described vendor platform. Based on the evidence available, Burgus Security cannot be reliably profiled as an AppSec product vendor, so the safest characterization is that its AppSec positioning is unconfirmed. If the intent was a different vendor name, the profile should be rebuilt from source documentation for that vendor.

Burp Suite

Automated web application vulnerability scanning

Burp Suite is PortSwigger’s web application DAST platform, used to crawl running applications, map attack surface, and run active and passive vulnerability scans without source-code instrumentation. It is best known in application security teams for black-box testing of HTTP/HTTPS applications, with enterprise options for scheduled scanning and centralized management. Burp Suite Professional is aimed at manual testers and pentesters, while Burp Suite DAST serves teams that need repeatable scanning across many web apps and CI/CD workflows. The product is focused on discovering runtime flaws such as injection, authentication, access-control, and client-side issues.

Checkmarx

Dynamic application security testing for web apps and APIs

Checkmarx One is an application security software platform built to help enterprises secure every stage of the SDLC while reducing engineering costs and accelerating development. As a leader in agentic application security testing, Checkmarx scans trillions of lines of code each year, helping organizations cut vulnerability density by more than half. Its autonomous security agents detect, prioritize, and counter AI-driven threats across legacy, modern, and AI-generated code at enterprise scale.

Clearly AI

Automated threat modeling+7

Clearly AI is an AI-native security orchestration platform that automates the early stages of the Secure Software Development Lifecycle (SSDLC). It leverages LLMs to perform automated threat modeling and design reviews by pulling context from Jira, GitHub, and Slack, replacing manual, slow-moving security review processes. The platform acts as a virtual security engineer to triage risks and provide developer-centric remediation guidance at scale.

Clover Security

Design security review automationContinuous threat modeling+9

Product security agents that work with your team.

Cobalt.io

Manual web application penetration testing+11

Only Cobalt brings together the four critical elements of modern offensive security: elite human expertise, a context-aware platform, AI-powered orchestration, and the industry's largest dataset of real-world pentest results.

Codacy

Static application security testing+11

Founded in 2012 by developers Jaime Jorge and João Caxaria to help engineering teams raise the bar for code quality and security.

CodeWall

Static source code analysis+9

CodeWall is an autonomous application security testing vendor that focuses on black-box assessment of live applications and APIs rather than source-code analysis. Based on available public material, its core fit is organizations that want continuous validation of web apps, REST/GraphQL APIs, and internal tooling in CI/CD-driven release cycles. The company appears to be a 2026-founded startup and positions itself as an offensive security platform with verified exploit evidence rather than a traditional point-in-time scanner. Public sources do not show a separate SAST product, so its profile is strongest on DAST-style runtime testing.

Contrast Security

Agent-based runtime vulnerability detection+9

Contrast Security provides an IAST platform that embeds agents into running applications, instrumenting code with sensors for real-time vulnerability detection and attack telemetry. Unlike external DAST scans or static SAST analysis, it analyzes data flows, application logic, and runtime behavior across development, CI/CD pipelines, and production. This reduces false positives by validating vulnerabilities in context, supports DevSecOps integration, and offers continuous monitoring for web apps, APIs, and microservices. Best for organizations prioritizing accurate, low-noise AppSec in agile environments over traditional black-box or white-box tools.

Corgea

Detects and fixes insecure codeBusiness logic flaw detectionSource and sink tracing+9

Application security that actually fixes the work, not just reports it.

Corridor

Static code vulnerability scanning+5

Corridor is a security vendor centered on application security scanning during code generation and testing, positioning its ACSM layer to catch vulnerabilities before they reach later SDLC stages. In the DAST/SAST category, it is best understood as a developer-facing control for identifying flaws in source code or generated code, rather than a broad platform for runtime security or infrastructure protection. Based on Corridor’s own description, it focuses on early detection for teams building software with AI-assisted or automated code generation workflows.

Cycode

Software Supply Chain & SBOM

End-to-end software supply chain visibilityPolicy enforcement across pipelines and toolingProprietary and third-party scanner ingestion+9

AI Writes The Code. We Secure And Govern It.

Cytix

Change-based security testing+9

Cytix is a security testing platform positioned around application-risk analysis and targeted testing for changes in the SDLC. In the Application Security (DAST/SAST) category, it focuses less on generic full-scope scanning and more on identifying risky changes, explaining likely security impact, and generating focused test plans for web and API vulnerabilities. Cytix says it finds business logic flaws, authentication bypasses, authorization issues, OWASP Top 10 issues, and API security problems that conventional scanners miss. It is best suited for teams that want change-driven AppSec testing rather than broad, always-on enterprise scanning.

Dam Secure

Dynamic application security testingStatic application security testingAutomated attack simulation+6

Code Security for AI-enabled Teams.

Datadog

API Security

Runtime application protection in the application code

Datadog is the leading observability and security platform for the AI era, providing businesses with unified visibility across the technology stack to manage complexity at scale.

Data Theorem

API Security

Continuous API discoveryAPI health analysis+9

Data Theorem is a leading provider in modern application security. Its core mission is to analyze and secure any modern application anytime, anywhere.

DefendLab

AI-native SAST and DAST scanning+10

DefendLab is an application security platform focused on SAST and DAST-style testing for engineering-heavy product security teams. According to its vendor profile, it combines source-code analysis with runtime exploit validation to reduce false positives and surface issues such as broken access control, IDOR, authentication bypass, and OWASP Top 10 weaknesses. It is positioned for teams that need CI/CD-integrated testing with more context than conventional scanners provide. Adjacent remediation features are mentioned only briefly here because the core buyer scope is AppSec testing rather than broader security operations.

depthfirst

Business-logic vulnerability detection+8

depthfirst is an applied AI lab pioneering the future to secure software, and we're just getting started.

Detectify

EASM

Continuously monitor external attack surface+10

Detectify is the application security platform that gives modern security teams ultimate control over their actual attack surface, delivering proprietary vulnerability data designed for both humans and agents.

DevArmor

Automated threat modelingSecurity design review enforcement+7

Our mission is build secure software, without slowing down

eShard

Static, dynamic, and stress testing+9

A complete platform for security investigations of digital objects that brings tools, knowledge and teams together. Empower your experts with software and hardware security assessments.

Fencer

Continuous DAST scanningBlack-box runtime probingExact finding location+8

Fencer is the platform we wish we had.

Fluid Attacks

Static application security testing from source code

Since 2001, Fluid Attacks has been committed to growing as a team and developing its own technology to contribute to global cybersecurity.

Fortify by OpenText

Static source code vulnerability detection+11

OpenText is a leading Cloud and AI company that provides organizations around the world with a comprehensive suite of Business AI, Business Clouds, and Business Technology.

Gecko Security

Context-aware application security testing+10

Gecko Security is an application security testing vendor focused on finding exploitable code-level vulnerabilities that traditional rules-based SAST often misses. Its public materials emphasize semantic analysis of source code plus architecture diagrams, API contracts, design documents, and runtime behavior to detect business logic flaws, authorization issues, and multi-step attack paths earlier in development. It is best suited for engineering and AppSec teams that need deeper verification than pattern-matching scanners and want exploit validation with actionable fixes. The company also positions itself as an AI security engineer rather than a broad security platform.

GitHub CodeQL

Semantic code analysis queries+10

GitHub CodeQL is a semantic code analysis engine that performs static application security testing (SAST) by building a queryable database of code facts and running predetermined vulnerability detection queries. Available as part of GitHub Advanced Security, CodeQL integrates into CI/CD workflows to scan pull requests and source code for security flaws before deployment. It correlates with dynamic testing tools like StackHawk and supports autofix suggestions via GitHub Copilot. CodeQL is the most prevalent SAST tool in open-source software pipelines.

GitLab

Automated SAST in CI/CD pipelines+10

We're the company behind GitLab, the intelligent orchestration platform where teams and their AI agents ship secure software faster.

HCL AppScan

Crawl and attack live web apps+11

HCL AppScan is an application security testing platform focused on DAST and SAST, delivered through products such as AppScan Standard, AppScan Source, AppScan Enterprise, and AppScan on Cloud. In this category, it is used to test source code and running applications for vulnerabilities across web apps, APIs, mobile apps, and enterprise software development pipelines. It is best suited for security teams, AppSec program managers, developers, and penetration testers that need both static analysis in the build process and dynamic testing of deployed applications. Adjacent IAST and SCA capabilities exist in the platform but are secondary here.

HCLTech (AppScan)

Dynamic testing of running web applications+11

HCL AppScan is an enterprise application security testing platform acquired from IBM in 2019. It provides integrated DAST, SAST, IAST, SCA, and API security testing across cloud and on-premises deployments. The platform serves large enterprises and regulated industries requiring federal compliance (FIPS 140-3 certified) and comprehensive governance. Best suited for organizations needing centralized application security orchestration with multi-scanner correlation and compliance reporting for PCI DSS, HIPAA, and GDPR.

Heeler

Context-aware SAST scanning+10

Heeler is an application security vendor focused on SAST-centric code analysis and remediation workflows, with product messaging that also spans adjacent AppSec functions such as secrets and open-source risk. In its SAST offering, Heeler emphasizes context-aware findings, runtime-aware prioritization, and validated fixes for developer teams that need to reduce alert noise and connect code issues to production behavior. It appears best suited for CISOs, AppSec, Product Security, and DevSecOps groups in cloud-native environments that want security findings tied to actual application context rather than static code-only results. The company also offers related AppSec posture and remediation capabilities beyond pure SAST/DAST.

Impart

Runtime web application scanningBlack-box attack simulationAPI security testing+8

At AI Speed, Runtime Is the Only Source of Truth

Invicti

Proof-based DAST scanning+10

Invicti Security combines DAST leaders Netsparker and Acunetix into a DAST-first ASPM platform for enterprise web application and API security. It uses proof-based validation via AcuSensor technology to confirm vulnerabilities like SQL injection and XSS with near-zero false positives. The platform correlates SAST, IAST, DAST, and SCA findings, providing runtime exploitability validation, code-level mapping to exact file/line, predictive risk scoring, and unified dashboards across testing tools. Best for DevSecOps teams needing accurate, automated scanning integrated with CI/CD workflows and compliance reporting for PCI DSS and SOC 2.

Kiuwan

Static source code vulnerability detection+9

Kiuwan provides a suite of application security tools centered on Static Application Security Testing (SAST) via Kiuwan Code Security, which scans source code for vulnerabilities like SQL injection, XSS, CSRF, broken authentication, insecure cryptography, and access control flaws. It maps findings to OWASP Top 10, CWE, CERT, PCI DSS, and SANS standards. Additional SCA tracks third-party dependencies, while governance tools monitor code quality and development progress. Integrates into IDEs and CI/CD pipelines for shift-left detection across 30+ languages. Best for DevSecOps teams embedding security in SDLC to remediate issues pre-production.

Konvu

Konvu Agents prove what's exploitable and ship the fix, at attacker speed.

Mend.io

AI-generated code scanning in repository and IDE+9

Mend.io is the security platform built for every risk, across application security and AI security, securing the code layer, the AI layer, and the attack surface between them. Continuous protection across the full AI application lifecycle.

Miggo Security

Runtime application behavior monitoring+11

Miggo delivers an Application Detection and Response (ADR) platform that monitors application behavior at runtime to neutralize threats. By analyzing how different application components interact, it identifies architectural flows that deviate from normal behavior, detecting vulnerabilities like broken authorization or business logic abuse. It fills the gap between static code analysis (SAST) and traditional network-layer WAFs.

MindFort AI

Autonomous exploitation and remediation+7

Founded by security engineers and AI researchers. We're building the agent infrastructure for autonomous security teams.

Mobb

Transforms vulnerabilities detected by Fortify into concrete secure code fixes, reducing manual rewrite work after static analysis findings.

Mobb is a code remediation product positioned around static application security testing workflows rather than a standalone scanner. It takes vulnerabilities detected by SAST tools such as OpenText Fortify and generates secure code fixes that can be pushed back into the codebase, helping teams reduce manual triage and remediation time. The product is best suited for development and AppSec teams already using SAST in CI/CD who want automated fix suggestions and pull-request-based workflows. Its documented role is complementary to SAST rather than replacing DAST or other testing layers.

NINJIO Cybersecurity Awareness Training

Security Awareness & Phishing Simulation

Narrative cybersecurity awareness episodes+11

NINJIO provides a human risk management platform that utilizes personalized security coaching and story-based awareness training to reduce the likelihood of social engineering attacks. The platform generates an Emotional Susceptibility Profile for users to identify specific psychological triggers and tailor content accordingly. It replaces generic, compliance-only training with behavioral science-driven modules to change organizational security culture.

Nokod Security

AI Runtime & Agent Security

Agent discovery and ownership mapping+4

Nokod Security is a security vendor focused on runtime protection for AI agents and citizen-built automations, especially in no-code and low-code environments. Its Adaptive Agent Security product provides live visibility, behavioral baselining, and policy enforcement across the Agent Development Lifecycle, with emphasis on stopping risky tool use and unauthorized data access as agents run. It is best suited for enterprises using Microsoft Copilot Studio, Power Platform, ServiceNow, UiPath, and similar agentic platforms that need inline controls rather than only post-deployment review.

Nullify

Software Supply Chain & SBOM

Nullify is an application security platform centered on SAST and DAST workflows, with continuous code scanning and live endpoint testing aimed at finding exploitable issues before merge or release. Its code analysis covers 16 languages plus Terraform, CloudFormation, and Kubernetes manifests, while its dynamic testing API and CLI target running web apps and APIs. It is positioned for small security teams and developer-first organizations that want vulnerability discovery and remediation in one workflow rather than separate scanners and manual triage.

AI code security SAST+10

OX Security

Software supply chain attack reference framework

OX Security is an enterprise software supply chain security platform that focuses on securing code, dependencies, build pipelines, and container artifacts across the SDLC. It emphasizes end-to-end traceability from code to runtime, continuous verification of pipeline integrity, and consolidation of findings into a single dashboard for triage and response. OX appears strongest for teams that want software supply chain controls and visibility without sending source code to third-party services, and it also offers adjacent application security and ASPM capabilities.

Parameter

Penetration testing services+8

Software is changing faster than ever. We're building security that evolves with it: continuous, autonomous, and always on.

Phoenix Security

Code-to-cloud reachability analysis+11

Phoenix Security is an agentic ASPM platform. It helps security and engineering teams fix the vulnerabilities that actually matter. Most teams have more scanner findings than they can ever fix. Phoenix checks if the vulnerable code is reachable, from code to cloud. It removes duplicates and finds which team owns each issue. That cuts the noise by up to 98%. Then AI agents write the fix as a pull request. A person reviews it and decides. The agents help, they don't take over. Phoenix was named a Major Player in the IDC MarketScape for ASPM 2025.

Pi Security

Static application security testing+10

We believe security should compound over time, instead of resetting after every incident. Security posture shouldn't degrade when an engineer leaves, or a codebase scales. Every lesson your org has ever learned should stay learned.And with Pi, it finally can.

Pradeo

Mobile Threat Defense

Mobile threat detection and response+10

Pradeo is a mobile security vendor focused on mobile threat defense for smartphones, tablets, and mobile applications. Its core product, Pradeo Security, is positioned around detecting device, network, and application-level threats, enforcing mobile policy compliance, and integrating with enterprise mobility controls such as MDM and Microsoft Intune. It is best suited for organizations that need risk-based access decisions and remediation for managed mobile fleets, especially where phishing, malicious apps, and network attacks are concerns. The company is described in external sources as a leader or emerging leader in mobile security.

PrimeSec Inc.

Static application security testing+3

Agentic development has made shipping secure products harder than ever. We built Prime to be the trusted advisor that knows your architecture.

Pulse Secure Pulse Policy Secure

NAC

Context-aware access controlAutomated BYOD onboarding+10

Secure Access Made Easy, Comprehensive, and Flexible

Qodo

Static application security testing+5

Qodo empowers engineering teams to standardize code quality and code review to move fast with AI

Qualys

Vulnerability Management

Continuous vulnerability scanning+10

Qualys provides Vulnerability Management, Detection and Response (VMDR), a cloud-based platform that automatically discovers assets across on-premises, cloud, and mobile environments, including unmanaged devices. It scans for vulnerabilities using over 20,000 checks from its Vulnerability KnowledgeBase, correlates findings with threat intelligence and machine learning to prioritize risks on critical assets, and detects indicators of compromise. VMDR supports hybrid IT scanning from a single console, generates role-based reports for compliance, and integrates with ticketing systems for automated remediation workflows. Best for enterprises needing continuous visibility and prioritization in complex, distributed networks.

Rapid7

Vulnerability Management

11 products

Rapid7 is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers.

Asset discovery and vulnerability scanning+11

Raven

Runtime exploit prevention+5

Raven.io provides a runtime application security platform that runs inside cloud-deployed applications to detect and block malicious code execution as it happens, independent of whether a CVE exists. The platform includes application detection and response for forensic visibility down to libraries, functions and call paths, a runtime software composition analysis capability that uses reachability data to de-prioritize vulnerabilities, and a module for discovering and controlling AI agents operating inside application environments. It is aimed at enterprises running internet-facing applications on Kubernetes, containers and compute instances across AWS, GCP and Azure, supporting languages including Java, Python, JavaScript, Go, Ruby, PHP, C++ and .NET. Customers include organizations in regulated industries such as insurance and financial services.

Security Journey

Security Awareness & Phishing Simulation

Role-based developer learning paths+11

At Security Journey, we believe that software security starts with the developer. Our mission is to engage and educate developers and their organizations in secure coding through a learner-first approach, delivering the highest-quality, most relevant training that empowers them to address real-world challenges and strengthen digital security.

Seezo

Scan design documents for vulnerabilitiesGenerate contextual security requirementsMap design reviews to standards+6

Automating Security Design Reviews with AI

Semgrep

Static application security testing+11

Semgrep is a developer-focused SAST platform that combines static analysis with multimodal AI reasoning to detect vulnerabilities in source code. The platform unifies SAST, SCA, and secrets scanning, emphasizing reduction of false positives through code context and prior decision patterns. Semgrep integrates with CI/CD pipelines for continuous scanning and correlates findings with dynamic testing via StackHawk's DAST to validate exploitability. Best suited for development teams prioritizing early vulnerability detection with minimal alert noise.

Snyk

Static application security testing for source code

Snyk is an application security platform providing SAST (static code analysis), DAST (runtime testing), and SCA (software composition analysis) capabilities integrated into CI/CD pipelines. The vendor targets development teams seeking to embed security early in the SDLC, from first commit through production deployment. Snyk's AI-native approach uses machine learning to reduce false positives while detecting complex vulnerabilities across proprietary code, open-source dependencies, containers, and infrastructure.

Sonar

Source code vulnerability scanning+8

Sonar helps developers deliver high quality and secure software by analyzing code they write, AI-generated code, and code leveraged from third parties (like open source libraries). Sonar's integrated approach to improving code quality and code security catches these issues before they make it into production, helping developers reduce technical debt and code complexity over time.

Synopsys

Static application security testing for source code

11 products

Synopsys is the leader in engineering solutions from silicon to systems, enabling customers to rapidly innovate AI-powered products.

Tenable

Vulnerability Management

Vulnerability Priority Rating with threat intelligenceContinuous asset discovery and vulnerability assessment

We are dedicated to isolating and eradicating the exposures that hold organizations back.

Veracode

Binary static application security testing+11

Veracode is a cloud-native application security platform providing SAST, DAST, SCA, and runtime analysis capabilities. The vendor targets enterprise DevSecOps teams seeking to shift-left vulnerability detection into CI/CD pipelines. Veracode is positioned as the only native SaaS application security solution with industry-leading 1% false positive rates. Best suited for organizations requiring comprehensive code coverage across custom and third-party components with centralized policy management and developer-focused remediation workflows.

Veriom

SAST scans source codebytecode+13

Every tool finds what. Veriom finds why. Your security tools found thousands of vulnerabilities last month. Not one of them told you why they exist. Veriom does. We build a model of your specific delivery chain, code, cloud, architecture, trust boundaries, and trace every risk back to the control failure or architectural weakness that created it. One root cause. Multiple vulnerabilities closed. Your team fixes the source, not the symptoms.

Wapiti

Black-box web application scanning+11

Wapiti is an open-source black-box web application vulnerability scanner used in penetration testing to probe live sites for common flaws without source-code access. It targets deployed HTTP applications and is best suited for testers who need lightweight, repeatable web attack surface validation rather than full red-team adversary emulation. Its market position is that of a classic web pentest utility, not a broad red-team platform. It is especially useful for security researchers, consultants, and administrators auditing public-facing web apps.

Waratek

In the era of AI-generated code and rapid deployment, traditional security is falling behind. Static tools are drowning teams in false positives, while AI assistants are introducing "vibe" code that looks perfect but executes with hidden flaws. Waratek bridges the gap from Dev to Production by moving security where it belongs: inside the runtime.

Wiz

CSPM

Agentless multi-cloud inventory discovery+11

Wiz is a cloud security posture management (CSPM) platform that detects and remediates misconfigurations across multi-cloud environments (AWS, Azure, GCP) and infrastructure-as-code templates. The platform uses agentless API-based scanning to inventory cloud assets and correlate risks across network exposures, secrets, vulnerabilities, and identities via a graph-based engine. Wiz is positioned as a modern CSPM alternative to legacy point tools, ranked among top CSPM solutions for enterprises managing complex cloud deployments.

ZeroPath