Static Application Security Testing (SAST) Tools

Aikido provides everything the average startup to mid-market company needs for security in a box - every code and cloud security scanner under the sun without much feature compromise, alongside a surprisingly robust runtime application solution for things like bot prevention. A no-nonsense replacement for a lot of more "specialized" solutions that tend to slow developers down.

Cycode offers a holistic all-in-one ASPM tool with their in house scanners alongside the ability to import third party findings. They offer about every scanner and feature you could need out of an AppSec tool.

Backslash offers a unique approach to reachability across SCA and SAST, as well as a suite of vibe-coding security features such as MCP risk assessments and cursor rules.

Kodem offers runtime first code security solutions - from runtime function execution SCA to runtime detection for prioritizing SAST findings. They're also one of the few to offer ADR solutions.

Endor Labs stands out in their granularity and reachability analysis for open source packages. They've also added back ported patches and automatic fix suggestions based on function changes between patch versions. They offer basic SAST capabilities via opengrep for companies that need it.

Ox provides an all-in-one application security solution that provides their own scanners combined with the ability to import third party findings. They also have a robust API for managing the data in the tool.

Orca offers the standard suite of CNAPP features with a focus on agentless scanning. They're a good all around CNAPP offering mostly focused on the posture side.

Checkmarx has adapted well to the DevSecOps model, offering a lighter weight scanner in the Checkmarx One platform, that integrates well into the larger stack. They don't have all the latest features of some newer companies, but they certainly get the job done for diverse enterprises. I would not suggest venturing off Checkmarx One though.

Arnica is a holistic application security solution that focuses primarily on providing a strong developer experience. They have robust policy and attribution engines to build detail oriented workflows getting the right finding to the right person at the right time.

Snyk was the first to really do DevSecOps - fast, actionable, developer focused CI/CD security scanning. They also were early to consolidate scanners into a single place - IaC, Code, SCA, and Container. There are many platforms with small improvements over them - better reachability, workflows, etc. - but they remain a strong player in the space for having scaled so meaningfully across enterprises.

Paraxial provides a unique combination of security tooling specializing in the Elixir language and Phoenix framework. They're a great choice for companies that use Elixir, and have unique runtime elements that them stand out from open source options.

Soos offers holistic ASPM scanners and ingestion, with a special focus on in depth SCA scanning and SBOM generation

Aqua Security built a lot of the open source projects that power modern cloud security, and can go feature for feature with most other CNAPP platforms. The downside of the CNAPP has been the UI/UX, and the focus has always been on container protection more than holistic cloud security features.

For what Snyk offers in usability across functions, SemGrep excels in customization. Their tool offers extensive customizations and rule sets, and their reachability analysis, a critical aspect of SCA, beat Snyk to market. Also, their open source tooling is powering many other tools on this list.

Mend was Snyk's main competitor early for quick open source scanning in pipeline, but did not expand as quickly as Snyk into other areas. Their open source Renovate tool is great for keeping your in-house dependencies up to date, but their UI and scanning engine were more difficult to deploy, maintain, and navigate. However, due to Renovate they have unique visibility into the expected challenge of a version upgrade. They've recently expanded most heavily into MLBOM capabilities.

Boost Security has a shared vision for all in one configuration scanning out to runtime. They have smart kubernetes & Istio integrations for runtime context, alongside the standard suite of SCA, SDLC, SAST, IaC, Secrets, and Containers based on a combination of open source and in house built tools. I appreciate the openness of their rule set in their documentation.

JIT built a holistic ASPM scanning solution, and has sense heavily invested in AI workflows. They consolidate scanners and create workflows and prioritization for developers. The JIT scanner is unique in that it's a wrapper for other scanners that you run in your own pipelines - an approach with pros and cons.

Aisle provides AI native code security scanning covering SCA and SAST.

Contrast wraps commonly exploited functions at runtime to detect and prevent application exploits, i.e. they scan the application once it's actually built and running for vulnerabilities, and preventing exploits. This makes Contrast a strong choice for enterprise application protection.

GitHub Advanced Security is okay. It checks a lot of scanning boxes - most importantly SCA with dependabot, secrets scanning, and SAST with CodeQL. The tools tends to be very noisy, requires management via GitHub which can be challenging, and tends to generate a lot of false positives leading to operational difficulty over time

Amplify security leverages multi-AI Agents to generate relevant and accurate fixes, alongside SAST scanning capabilities. This approach replicates the process of developers and security engineers working together to fix issues so both teams are happy. Amplify tries to make the code fixes look as if the developer themselves wrote the fix, emphasizing the contextual nature of the code.

Start Left brings SAST, SCA, Container, and IaC scanning in a single platform. They also have AI code remediation recommendations, and provide a docker image for running local scans.

FluidAttacks offers a combined SAST, SCA, and DAST alongside service offerings for pentesting and code review.

Apona provides a combination SCA, SAST, and DAST features. Something unique about their SCA is providing a function level fix if one is available to avoid the patch.

Codacy is a code quality and scanning toolbox similar to SonarQube for code scanning. They support many languages via open source scanning tools and have a developer focus.

SonarCloud has the benefit of winning your developer's hearts due to its initial product focus on bug squashing and the ability to ingest a wide variety of reports. While the SAST functionalities are newer, they robust enough to warrant the add-on to their code health scanning. Great choice for developer only teams with low risk products.

Acquired by Cycode, Bearer is a newer SAST product that is built from an open source lens. They have done excellent analysis of the SAST market and are dialed in on the correct issues, namely false positives, and time to scan.

SonaType was one of the first organizations doing SDLC tooling; however, until recently, they did not have a cloud platform. Their platform is still catching up to the intuitiveness of the SaaS competition, but their product checks all the boxes.

Kiuwan offers some uniquely good SAST detection results, at the price of an unintuitive UI/UX. Kiuwan's scanning offered some of the most robust true positives we've seen, but they really dragged in terms of their implementation processes, UI, and integration/maintenance of developer workflows.

Does Synopsys technically do everything you'd need from an ASPM? Yes. Would you ever want to use it? No. They've focused heavily into the semiconductor industry, and their ASPM is heavily patched together from various acquisitions.

Qwiet takes a unique approach to scanning that starts with a map of your application, and scans within that context. They have smart prioritization filters combined with the standard suite of SCA, container, SAST, Secrets, and IaC scanning. They don't offer "pipeline-less" scanning via webhooks if that's a requirement for you.

Veracode is a legacy SAST vendor that has done a good job expanding into other categories. They are a great choice for organizations using more legacy or waterfall type development methods, but still don't have an intuitive interface or workflows for modern dev teams.

Rainforest combines all in one code vulnerable scanning with brand protection capabilities. They instrument via an on premise VM allowing you to scan everything in your own environment.

OpenRefactory has an amazingly robust SAST scanner that has really focused on building the best detections possible. While they're still building their full SaaS platform and features, the SAST engine itself is one of the best out there.

Fortify had a great reputation before the MicroFocus acquisition, but has since become slower to innovate. Lacks a lot of functionality compared to other SaaS options, and heavily based in old school models.