ASPM Security Tools

Acquired by Google. Wiz is the leader in having an all-in-one cloud security platform by expanding into CTEM, ASPM, and Runtime capabilities all within a single dashboard. Their posture and vulnerability capabilities remain the strongest, but their Code and Defend offerings are competitive in their own right.

Cycode offers a holistic all-in-one ASPM tool with their in house scanners alongside the ability to import third party findings. They offer about every scanner and feature you could need out of an AppSec tool.

Apiiro has built an all-in-one application security management solution that is especially strong at managing application security results at enterprise scale. They focus on building robust relationships between code assets to manage application security programs at scale.

Ox provides an all-in-one application security solution that provides their own scanners combined with the ability to import third party findings. They also have a robust API for managing the data in the tool.

Invicti provides a unified suite application security testing tools. Their history is in robust dynamic testing capabilities, which have modernized to support AI red teaming and API testing. Most recently, they've acquired Kondukto to deliver all in one application security testing capabilities, alongside broader ASPM tools.

Legit Security offers a holistic ASPM platform that focuses more on pipeline discovery, security, and third party data ingestion than native scanning solutions.

Acquired by Wiz. Dazz aggregates your security vulnerabilities into a single dashboard which allows easy assignment and risk based prioritization. Their approach to this problem does a lot of automated lookup work and has some advanced ability to find where container images are coming from. Dazz differentiates by being focused on remediation, rather than just prioritization.

Soos offers holistic ASPM scanners and ingestion, with a special focus on in depth SCA scanning and SBOM generation

Phoenix security is more on the vulnerability management side of ASPM, but they offer their own SCA and DAST options alongside existing scanners. Due to the emphasis on management & orchestration, they offer a wide variety of contextualizations and in depth vulnerability data. An especially great fit for enterprises.

Cortex Cloud is a security operations platform that integrates cloud and application security capabilities into their larger security operations offerings. This provides a single hub for managing first and third party findings across vulnerabilities and runtime events.

Armorcode is a holistic vulnerability management solution for application security teams. While there's less "magic" happening than in the other providers, I'm also the most confident it would actually work - even down to providing python scripts you can run in pipeline to send vulns to their platform.

Tromzo pulls in rich metadata from your various tools, and uses that metadata to create groupings and prioritizations of your vulnerabilities. They uniquely offer a yaml file for adding custom tools and pulling together data.

Dependency Track is an open source option for creating vulnerability dashboards and notification workflows.

Acquired by Invicti. Kondukto's strength is integrating with just about every tool you could want, including open source ones, to prioritize and remediate in a single platform. They provide a great Jira workflow for working through findings.

Acquired by CrowdStrike. Bionic offers a unique approach to application visibility by building a graph of your services, their dependencies, and the classification of their downstream data. Their application map works best in Java/Spring environments.