Static application security testing
Analysis of source code, bytecode and infrastructure-as-code for security flaws without running the application.
24 vendors · alphabetical
- AISLEAISLE sells a platform that finds, fixes, and verifies vulnerabilities in source code.Ownership not established · primary category
- ArnicaArnica sells software that consolidates risks across SCA, AI SAST, IaC, secrets, licenses and low-reputation packages within a development environment.Ownership not established
- Black DuckBlack Duck sells application security testing products and services, including agentic AI AppSec, SAST, DAST, IAST and SCA.Owned by Clearlake Capital Group and Francisco Partners since 2024
- CheckmarxCheckmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE.Owned by Hellman & Friedman since 2020 · primary category
- CycodeCycode is the agentic development security platform that unifies visibility, prioritization, and remediation across the software development lifecycle.Ownership not established
- Data TheoremData Theorem sells application security products that secure code, mobile apps, APIs and cloud.Ownership not established
- Endor LabsEndor Labs sells AURI, a security intelligence layer for AI coding agents.Privately held
- Fleuret AIFleuret AI sells pentesting that combines artificial intelligence and offensive expertise.Privately held
- GitHub Advanced SecurityGitHub Advanced Security is sold as Code Security and Secret Protection together, to find and fix vulnerabilities and leaked secrets.Ownership not established · primary category
- GitLabGitLab states that software teams and their agents plan, build, secure, and ship on one control plane.Public (Nasdaq Global Market: GTLB) · primary category
- InvictiInvicti sells an application security platform that combines DAST, SAST, SCA, IaC, Secrets, and Container testing in one platform.Ownership not established
- JFrogJFrog describes the inputs and outputs of a software release as including binaries, packages, AI/ML models, agent skills, MCP servers, and plugins.Public (Nasdaq: FROG)
- KiuwanKiuwan sells static application security testing (SAST) and software composition analysis (SCA).Owned by Idera, Inc. since 2018 · primary category
- Mend.ioMend.io sells enterprise AI security and application security software, and secures the full chain from open source dependencies and AI models to container images.Ownership not established
- OpenTextOpenText helps organizations securely manage and connect data across the enterprise, turning data into AI-ready information.Ownership not established · primary category
- OX SecurityOX Security states a mission to create a world where software secures itself.Ownership not established
- Phoenix SecurityPhoenix Security is an Actionable ASPM platform that correlates vulnerabilities from code to cloud, turning fragmented findings into a single, prioritized remediation flow.Ownership not established
- Prime SecurityPrime Security sells an AI security review platform designed for software development lifecycles.Ownership not established
- PromptfooPromptfoo builds open-source tools for secure, reliable AI applications.Owned by OpenAI
- SemgrepSemgrep sells an application security platform that unifies SAST, SCA, secrets scanning, and malware protection.Privately held · primary category
- SnykSnyk sells the AI Security Platform, which secures the code AI writes, the agents it runs, and the applications it builds.Ownership not established
- SplxAISplxAI, which uses the name SPLX, sells scalable red teaming, real-time threat protection, and automated AI compliance and governance for AI systems.Owned by Zscaler since 2025
- Trail of BitsTrail of Bits sells security reviews and engineering services across application security, cryptography, blockchain, AI/ML, low-level systems, and software supply chain.Ownership not established
- VeracodeVeracode sells an Application Risk Management Platform that identifies risks across the software development lifecycle, automates flaw fixes, and simplifies governance and compliance.Owned by Thoma Bravo since 2019 · primary category