About Kiuwan
Kiuwan sells static application security testing (SAST) and software composition analysis (SCA). Kiuwan was founded in 2003 in Spain. Idera, Inc. acquired Kiuwan in 2018. Kiuwan is now part of Sembi. Kiuwan works with all common programming languages and dev environments. Kiuwan describes its tool set as designed for dev teams across the SDLC.[1][4][7]
Kiuwan Code Security is a SAST tool that finds and prioritizes vulnerabilities across a codebase. Kiuwan describes SAST as analysis of source code to detect security vulnerabilities before an application is executed. Kiuwan Code Security scans can run locally or in CI/CD, and findings are reviewed in a dashboard with remediation tips and compliance mappings. Kiuwan Code Security analyzes code in the IDE with real-time feedback on every save. Kiuwan Code Security supports local pre-commit analysis and automated scans in a CI/CD pipeline. Kiuwan Code Security can detect injection attacks, cross-site scripting, cross-site request forgery, broken authentication, insecure cryptography, access control flaws, and security misconfigurations.[1][5]
Kiuwan Code Security covers 30+ languages, including Java, Python, JavaScript, C#, Go, and Swift. Kiuwan Code Security offers IDE plugins for Visual Studio, VS Code, Eclipse, and JetBrains. Kiuwan has native plugins for Jenkins and Azure DevOps that add scans to the build process. GitLab CI integrates with Kiuwan via the local analyzer. Kiuwan offers integration with popular IDEs, version control systems, issue trackers, and CI/CD pipelines.[5][6]
Kiuwan Code Security can analyze code in the cloud or use the Kiuwan Local Analyzer when code must stay on-premise. The Kiuwan local analyzer (KLA) runs entirely on the user infrastructure for air-tight environments or data residency requirements. Kiuwan offers source code analysis and vulnerability tracking solutions either on-premise or in the cloud. Kiuwan can be run as hybrid-cloud based solutions or with a local analyzer for integration with development environments.[5][6][7]
Kiuwan describes its SCA as addressing third-party components, to remediate vulnerabilities and ensure license compliance. Kiuwan Insights supports SBOM generation by providing the components and information needed. Kiuwan Insights can generate and export a complete Software Bill of Materials (SBOM) in the CycloneDX standard format. Kiuwan Insights gives visibility into the open-source and third-party components used in applications. Kiuwan Governance groups the results of code analyses into separate portfolios. Kiuwan Governance serves stakeholders, security teams, and software vendors managing risk across a software ecosystem. Kiuwan identifies risky software applications with decision quadrants. Kiuwan tracks dev team and vendor activity across projects and change requests. Kiuwan forecasts the evolution of an application portfolio with predictive analytics. Kiuwan provides measurement of software quality, prioritization of key issues, and remediation plans from findings.[1][5][6][7]
Kiuwan sells plans ranging from focused SAST coverage to full SAST, SCA, Code Quality, Governance, and enterprise support. Kiuwan pricing scales by number of users and applications, and lines of code pricing is available. Kiuwan provides reports used to review vulnerabilities and identify app and code quality issues requiring remediation. Kiuwan aligns with industry regulations such as OWASP, CISA, NTIA, SBOM, GDPR, HIPAA, and PCI DSS. Kiuwan describes its SAST as compliant with financial security standards like NYDFS, GLBA, and PCI. Kiuwan describes its SAST as compliant with banking security standards such as ISO/IEC, NIST, and PCI.[1][4][5][6][7][8][9][10]
Kiuwan on the record