Static Application Security Testing (SAST) Tools

Aikido provides everything the average startup to mid-market company needs for security in a box - every code and cloud security scanner under the sun without much feature compromise, alongside a surprisingly robust runtime application solution for things like bot prevention. A no-nonsense replacement for a lot of more "specialized" solutions that tend to slow developers down.

Cycode offers a holistic all-in-one ASPM tool with their in house scanners alongside the ability to import third party findings. They offer about every scanner and feature you could need out of an AppSec tool.

Depthfirst offers AI native application security functionality from threat modeling to scanning tools.

Backslash offers a unique approach to reachability across SCA and SAST, as well as a suite of vibe-coding security features such as MCP risk assessments and cursor rules.

Kodem offers runtime first code security solutions - from runtime function execution SCA to runtime detection for prioritizing SAST findings. They're also one of the few to offer ADR solutions.

Corgea provides a robust bundling of AI first scanning tools - from AI SAST to SCA and Secrets scanning. Corgea's especially strong at discovering vulnerabilities via AI scanning, and AI based prioritization for false positive analysis.

An AI-native application security platform that unifies various scanning and enforcement tools, identifies real vulnerabilities, reduces false positives, and generates contextual fixes integrated into developer workflows.

Endor Labs stands out in their granularity and reachability analysis for open source packages. They've also added back ported patches and automatic fix suggestions based on function changes between patch versions. They offer basic SAST capabilities via opengrep for companies that need it.

Ox provides an all-in-one application security solution that provides their own scanners combined with the ability to import third party findings. They also have a robust API for managing the data in the tool.

Corridor provides a holistic approach to securing AI generated code by helping secure developer endpoints, bringing organizational security context to coding agents, and doing in pipeline security code review.

Clover provides a platform for doing continuous AI threat modeling and design review. By connecting to organizational data sources, they can help map your application architecture and accelerate your threat modelling process. They then continuously enforce these decisions through AI code review of pull requests and AI code generation.

Orca offers the standard suite of CNAPP features with a focus on agentless scanning. They're a good all around CNAPP offering mostly focused on the posture side.

Checkmarx has adapted well to the DevSecOps model, offering a lighter weight scanner in the Checkmarx One platform, that integrates well into the larger stack. They don't have all the latest features of some newer companies, but they certainly get the job done for diverse enterprises. I would not suggest venturing off Checkmarx One though.

Legit Security offers a holistic ASPM platform that focuses more on pipeline discovery, security, and third party data ingestion than native scanning solutions.

Arnica is a holistic application security solution that focuses primarily on providing a strong developer experience. They have robust policy and attribution engines to build detail oriented workflows getting the right finding to the right person at the right time.

Snyk was the first to really do DevSecOps - fast, actionable, developer focused CI/CD security scanning. They also were early to consolidate scanners into a single place - IaC, Code, SCA, and Container. There are many platforms with small improvements over them - better reachability, workflows, etc. - but they remain a strong player in the space for having scaled so meaningfully across enterprises.

Paraxial provides a unique combination of security tooling specializing in the Elixir language and Phoenix framework. They're a great choice for companies that use Elixir, and have unique runtime elements that them stand out from open source options.

Soos offers holistic ASPM scanners and ingestion, with a special focus on in depth SCA scanning and SBOM generation

Phoenix security is more on the vulnerability management side of ASPM, but they offer their own SCA and DAST options alongside existing scanners. Due to the emphasis on management & orchestration, they offer a wide variety of contextualizations and in depth vulnerability data. An especially great fit for enterprises.

Maze uses agentic AI to find the exploitability of vulnerabilities in cloud environments, increasing the risk score for true positives, while giving demonstrable proof when false positives cannot be exploited.

Aqua Security built a lot of the open source projects that power modern cloud security, and can go feature for feature with most other CNAPP platforms. The downside of the CNAPP has been the UI/UX, and the focus has always been on container protection more than holistic cloud security features.

Cortex Cloud is a security operations platform that integrates cloud and application security capabilities into their larger security operations offerings. This provides a single hub for managing first and third party findings across vulnerabilities and runtime events.

For what Snyk offers in usability across functions, SemGrep excels in customization. Their tool offers extensive customizations and rule sets, and their reachability analysis, a critical aspect of SCA, beat Snyk to market. Also, their open source tooling is powering many other tools on this list.

Mend was Snyk's main competitor early for quick open source scanning in pipeline, but did not expand as quickly as Snyk into other areas. Their open source Renovate tool is great for keeping your in-house dependencies up to date, but their UI and scanning engine were more difficult to deploy, maintain, and navigate. However, due to Renovate they have unique visibility into the expected challenge of a version upgrade. They've recently expanded most heavily into MLBOM capabilities.

Boost Security has a shared vision for all in one configuration scanning out to runtime. They have smart kubernetes & Istio integrations for runtime context, alongside the standard suite of SCA, SDLC, SAST, IaC, Secrets, and Containers based on a combination of open source and in house built tools. I appreciate the openness of their rule set in their documentation.

DryRun provides a flexible platform for AI code analysis, covering custom and out of the box use cases for in depth code analysis.

Datadog offers a complete suite a security offerings that are a great fit for developer focused teams not looking for the most mature details in each area. They offer most scanning types, runtime detections, and a full SIEM, and you're probably already sending them your logs. It's a great runtime choice to meet developers where they work, but the UX is built primarily for developers.

JIT built a holistic ASPM scanning solution, and has sense heavily invested in AI workflows. They consolidate scanners and create workflows and prioritization for developers. The JIT scanner is unique in that it's a wrapper for other scanners that you run in your own pipelines - an approach with pros and cons.

Aisle provides AI native code security scanning covering SCA and SAST.

Contrast wraps commonly exploited functions at runtime to detect and prevent application exploits, i.e. they scan the application once it's actually built and running for vulnerabilities, and preventing exploits. This makes Contrast a strong choice for enterprise application protection.

Mobb integrates with SAST tools like Snyk, Checkmarx, Fortify, and Codeql to scan your code and then provides fixes for merging into your code base. Their generated fixes seem good, but it's something that other providers are also working to build natively such as Snyk's DeepCode. Mobb uses GenAI to help create fixes for SAST findings.

GitHub Advanced Security is okay. It checks a lot of scanning boxes - most importantly SCA with dependabot, secrets scanning, and SAST with CodeQL. The tools tends to be very noisy, requires management via GitHub which can be challenging, and tends to generate a lot of false positives leading to operational difficulty over time

Amplify security leverages multi-AI Agents to generate relevant and accurate fixes, alongside SAST scanning capabilities. This approach replicates the process of developers and security engineers working together to fix issues so both teams are happy. Amplify tries to make the code fixes look as if the developer themselves wrote the fix, emphasizing the contextual nature of the code.

Pi is an agentic product security platform that builds an institutional security memory to autonomously triage, remediate, and prevent recurring vulnerability classes across the SDLC.

Acquired by Gitlab, Oxeye was a complete ASPM scanner that emphasized runtime context and API discovery

Start Left brings SAST, SCA, Container, and IaC scanning in a single platform. They also have AI code remediation recommendations, and provide a docker image for running local scans.

Staris built a platform for open box pentesting powered by GenAI. They look at your code and your application, build a PoC exploit of findings as a code test, and give you the fixed code. The workflow is wrapped as a pentest - which offers a glimpse into what the future of pentesting will undoubtedly look like. Staris uses GenAI to help find exploits from SAST to runtime.

FluidAttacks offers a combined SAST, SCA, and DAST alongside service offerings for pentesting and code review.

Apona provides a combination SCA, SAST, and DAST features. Something unique about their SCA is providing a function level fix if one is available to avoid the patch.

Codacy is a code quality and scanning toolbox similar to SonarQube for code scanning. They support many languages via open source scanning tools and have a developer focus.

SonarCloud has the benefit of winning your developer's hearts due to its initial product focus on bug squashing and the ability to ingest a wide variety of reports. While the SAST functionalities are newer, they robust enough to warrant the add-on to their code health scanning. Great choice for developer only teams with low risk products.

Acquired by Cycode, Bearer is a newer SAST product that is built from an open source lens. They have done excellent analysis of the SAST market and are dialed in on the correct issues, namely false positives, and time to scan.

SonaType was one of the first organizations doing SDLC tooling; however, until recently, they did not have a cloud platform. Their platform is still catching up to the intuitiveness of the SaaS competition, but their product checks all the boxes.

Kiuwan offers some uniquely good SAST detection results, at the price of an unintuitive UI/UX. Kiuwan's scanning offered some of the most robust true positives we've seen, but they really dragged in terms of their implementation processes, UI, and integration/maintenance of developer workflows.

Pixee creates pull request ready fixes for SAST findings for enterprises. They've especially focused on developer workflows and using a mix of LLMs with static rules to create fixes.

Does Synopsys technically do everything you'd need from an ASPM? Yes. Would you ever want to use it? No. They've focused heavily into the semiconductor industry, and their ASPM is heavily patched together from various acquisitions.

Dam Secure combines AI SAST capabilities with natural language guardrails for AI generated code.

Qwiet takes a unique approach to scanning that starts with a map of your application, and scans within that context. They have smart prioritization filters combined with the standard suite of SCA, container, SAST, Secrets, and IaC scanning. They don't offer "pipeline-less" scanning via webhooks if that's a requirement for you.

Veracode is a legacy SAST vendor that has done a good job expanding into other categories. They are a great choice for organizations using more legacy or waterfall type development methods, but still don't have an intuitive interface or workflows for modern dev teams.

Rainforest combines all in one code vulnerable scanning with brand protection capabilities. They instrument via an on premise VM allowing you to scan everything in your own environment.

OpenRefactory has an amazingly robust SAST scanner that has really focused on building the best detections possible. While they're still building their full SaaS platform and features, the SAST engine itself is one of the best out there.

Fortify had a great reputation before the MicroFocus acquisition, but has since become slower to innovate. Lacks a lot of functionality compared to other SaaS options, and heavily based in old school models.