Explore the SonarSource portfolio, including SonarQube Cloud and SonarQube Server. Get company facts, key SAST features and side-by-side alternatives.
Application Security
SAST Tools: Static Application Security Testing Software
Catch vulnerabilities in source code before it ships. Compare SAST tools for language support, IDE and pull request scanning, accuracy and developer-friendly fixes.
16 vendors36 products
See the Top 16 rankingSAST vendors 16
Companies that offer SAST.
Featured vendors
Black Duck builds software supply chain security and application security testing. Compare Black Duck CodeSight with the best Application Security alternatives.
These vendors are highlighted by Cyber Rank. This does not affect our rankings, reviews or the order of the list below.
Aikido Security
San Francisco, California, USA
Apiiro
New York, New York, USA
Black Duck
Burlington, Massachusetts, USA
Check Point
Tel Aviv, Israel
Checkmarx
Tel Aviv, Israel
Contrast Security
Baltimore, Maryland, USA
GitHub
San Francisco, California, USA
GitLab
San Francisco, California, USA
HCLSoftware
Noida, India
HackerOne
San Francisco, California, USA
Mend
Boston, Massachusetts, USA
OpenText
Waterloo, Ontario, Canada
Semgrep
San Francisco, California, USA
Snyk
Boston, Massachusetts, USA
SonarSource
Geneva, Switzerland
Veracode
Burlington, Massachusetts, USA
SAST products 36
Open a product to see its features, pricing and reviews, or compare it with others.
Aikido Security
Aikido Security is an all-in-one developer-first application security platform for developer application security. See features and Application Security alternatives.
Application SecurityView details
Apiiro Guardian Agent
byApiiro
Shortlisting Application Security tools? Apiiro Guardian Agent by Apiiro brings commit blocking, with cloud deployment. See strengths and alternatives.
Application SecurityView details
Apiiro SAST
byApiiro
What does Apiiro SAST do? It covers context-aware static analysis and AST false-positive reduction. See typical use cases, cloud deployment and how it compares to rivals.
Application SecurityView details
AppScan 360
AppScan 360 offers unified AppSec platform and SAST, DAST, IAST, and SCA correlation. Use it for compliance auditing. See Application Security Testing alternatives.
Application SecurityView details
AppScan Source
Get the facts on AppScan Source: IDE integration. Built for build automation gating. Compare it with other Application Security Testing options before you decide.
Application SecurityView details
AppScan on Cloud
AppScan on Cloud: cloud-delivered ASTaaS and multi-engine scanning. Built for CI/CD pipeline automation. Compare Application Security Testing alternatives.
Application SecurityView details
Black Duck CodeSight
Black Duck CodeSight delivers secret detection for real-time in-editor security scanning. Explore its SCA capabilities, deployment choices and top competitors.
Application SecurityView details
Black Duck SAST
Black Duck SAST is a static application security testing used for code auditing. Highlights include OWASP Top 10 analysis. Compare it with other SAST tools.
Application SecurityView details
Checkmarx One
Free trial available. Checkmarx One by Checkmarx offers SAST, SCA, DAST, API security, IaC. Compare features, use cases and leading Application Security alternatives.
Application SecurityView details
Checkmarx SAST
Evaluating Checkmarx SAST? See how this SAST tool handles source code scanning and best-fix recommendation, where it fits best and which alternatives to compare.
Application SecurityView details
Contrast Application Security Platform
Contrast Application Security Platform delivers automated SCA for API security. Explore its Application Security capabilities, deployment choices and top competitors.
Application SecurityView details
Contrast Scan
Contrast Scan by Contrast Security: compliance reporting. Ideal for pull request gating. Deployment: cloud or hybrid. See how it compares with top SAST alternatives.
Application SecurityView details
Coverity
Coverity is an enterprise static code analysis. It helps with deep static code analysis through MISRA compliance. Explore features and compare SAST alternatives.
Application SecurityView details
Fortify on Demand
byOpenText
Fortify on Demand: Application Security Testing as a Service and SAST and DAST scans. Built for CI/CD security gating. Compare Application Security Testing alternatives.
Application SecurityView details
GitHub Advanced Security
byGitHub
GitHub Advanced Security: custom query creation and automated pull requests. Built for static application security testing. Compare Application Security alternatives.
Application SecurityView details
GitHub Code Scanning
byGitHub
Evaluating GitHub Code Scanning? See how this SAST tool handles native CodeQL analysis and SARIF report ingestion, where it fits best and which alternatives to compare.
Application SecurityView details
GitHub Secret Protection
byGitHub
What does GitHub Secret Protection do? It covers bypass auditing. See typical use cases, cloud or on-premises deployment and how it compares to rivals.
Application SecurityView details
GitLab Application Security Testing
byGitLab
GitLab Application Security Testing by GitLab: SAST. Ideal for Code Security. Deployment: cloud. See how it compares with top Application Security Testing alternatives.
Application SecurityView details
GitLab Secret Detection
byGitLab
GitLab Secret Detection: automated secret scanning, gitleaks engine and 100+ secret pattern rules. Built for Software Supply Chain. Compare Secret Scanning alternatives.
Application SecurityView details
H1 Code
Evaluating H1 Code? See how this Application Security tool handles manual code audit and triage verification, where it fits best and which alternatives to compare.
Application SecurityView details
HCL AppScan CodeSweep
Looking for SAST software? HCL AppScan CodeSweep by HCLSoftware provides local code privacy for shift-left developer security. Compare features and alternatives.
Application SecurityView details
Mend SAST
byMend
Mend SAST offers fast developer-focused static code analysis, proprietary vulnerability scanning and IDE integration. Use it for Code Security. See SAST alternatives.
Application SecurityView details
Mend.io Platform
byMend
Mend.io Platform covers unified application & supply chain security and SAST, SCA, secrets, container for DevSecOps. Compare top Application Security tools.
Application SecurityView details
OpenText Fortify Static Code Analyzer
byOpenText
What does OpenText Fortify Static Code Analyzer do? It covers ML triage. See typical use cases, on-premises or cloud deployment and how it compares to rivals.
Application SecurityView details
Showing page 1 of 2 (36 products)
← PreviousNext →