Application Security Testing

SAST, DAST, dependency and secret scanning in the pipeline.

14 specialist tools4 free or open source9 self-hostable

What this category is really about

Application security testing covers four distinct scans that get lumped together. SAST reads source for injection and unsafe patterns. SCA checks your dependencies against vulnerability databases. DAST attacks the running application from outside. Secret scanning finds credentials committed to the repo.

For most teams the order of value is the reverse of the order of glamour. Secret scanning and dependency scanning catch the highest proportion of real, exploitable problems for the least effort. SAST produces the most findings and the most noise. DAST finds the fewest issues but the ones it finds are demonstrably reachable.

What to evaluate

Reachability analysis

A vulnerable transitive dependency your code never calls is not an emergency. Tools that distinguish this cut alert volume dramatically.

Fix guidance

A suggested patch or version bump beats a CVE identifier and a severity score.

Developer workflow

Findings in the PR, not in a separate security portal a developer has no login for.

Licence compliance

Often bundled with SCA and often the reason legal signs the purchase order.

Common mistakes

Turning on every scanner at once and generating a backlog that guarantees nothing gets fixed.
Treating CVSS score as priority without asking whether the code path is reachable.
Running DAST against production and taking down a service.

14 tools built for this

Sorted by how widely adopted they are, not by preference. Tick the compare boxes to put two or more side by side.

Filter these

Burp Suite

The professional web security tester's tool of choice, plus an enterprise scanner.

from $475

Dependabot

Free dependency updates and vulnerability alerts, built into GitHub.

Free

OWASP ZAP

The free, open-source DAST scanner that attacks your running application.

Open sourceSelf-host

Renovate

Highly configurable automated dependency updates, free and self-hostable.

Open sourceSelf-host

Snyk

Developer-first security across dependencies, code, containers and infrastructure.

from $25

Trivy

One open-source scanner for containers, filesystems, repos, IaC and Kubernetes.

Open sourceSelf-host

Checkmarx One

Enterprise application security platform: SAST, SCA, DAST, IaC and API security.

Talk to salesSelf-host

CodeQL

Query your codebase like a database to find vulnerability patterns across the whole repo.

from $30Open sourceSelf-host

GitGuardian

Secrets detection across your repositories, history and developer machines.

Free tierSelf-host

Mend.io

Software composition analysis with automated remediation and licence compliance.

Talk to sales

Semgrep

Pattern-based static analysis where rules look like the code they match.

from $40Open sourceSelf-host

TruffleHog

Open-source secret scanning that verifies whether the credential is still live.

Free tierOpen sourceSelf-host

Veracode

Application security as a service, with policy enforcement and compliance attestation.

Talk to sales

Invicti

DAST with proof-based scanning that confirms a vulnerability is real before reporting it.

Talk to salesSelf-host

Tools that also cover this

These are built primarily for something else but handle this category as part of a broader platform — often a way to consolidate two subscriptions into one.