Buildship product

Growrevenue and data

Operaterun the company

Protectsecurity and compliance

Deals Marketplace Pricing Hub Cubbie Points

Buyer's guide

Best Static Application Security Testing software

Compare Static Application Security Testing products. Open any profile for real pricing, compliance, and buyer-fit detail, or jump into the static application security testing directory to filter by industry, company size, and certifications.

15 toolsUpdated 2026

1
Aikido Security brings together code, cloud, dependency, and runtime security workflows in a more approachable platform for modern engineering teams.
Code Security Scanning
View profile
2
Cycode: Complete ASPM platform providing visibility and security across the entire software development lifecycle from code to cloud.
Application Security Posture Management
View profile
3
KICS: Open source IaC security scanner from Checkmarx finding security vulnerabilities and compliance issues in Terraform, Ansible, and more.
Infrastructure as Code
View profile
4
Acunetix: Invicti-owned web vulnerability scanner providing automated DAST to detect and report on SQL injection, XSS, and thousands of other web vulnerabilities.
Vulnerability Management Platforms
View profile
5
Qualys provides cloud-based vulnerability management and web application scanning that helps organizations identify and prioritize security risks across their attack surface.
Vulnerability Management
View profile
6
Bishop Fox provides continuous attack surface management and offensive security testing through its Cosmos platform and expert consultants.
Attack Surface Management
View profile
7
Mend.io is a software composition analysis and application security platform that helps development teams identify and remediate vulnerabilities in open-source dependencies.
Software Composition Analysis
View profile
8
AuditBase: Audiological database and practice management system for hearing clinics with Noah-compatible audiometry data management.
Vulnerability Management
View profile
9
Semgrep is a fast, open-source static analysis tool for finding bugs and security vulnerabilities in code, with support for 30+ languages and integration into CI/CD pipelines for automated s…
Cybersecurity
View profile
10
Cloudflare is a global cloud platform that provides CDN, DDoS protection, DNS, SSL/TLS encryption, and a developer platform. It secures and accelerates websites and applications with a netwo…
Content Delivery Networks
View profile
11
Docker is a platform for developing, shipping, and running applications in containers. It provides tools for building container images, managing registries, and orchestrating containerized w…
Container Orchestration
View profile
12
Checkov: Open source static analysis tool for IaC from Bridgecrew scanning Terraform, CloudFormation, and Kubernetes for misconfigurations.
Infrastructure as Code
View profile
13
Pradeo: Mobile security platform providing mobile threat defense, mobile application security, and mobile device compliance for enterprises.
Mobile Threat Defense
View profile
14
Bearer is an open-source static analysis tool that scans code for security risks and data privacy violations in application code.
Code Security Scanning
View profile
15
Qwiet AI: AI-powered code analysis platform providing deep reachability analysis to identify real exploitable vulnerabilities in application code.
Static Application Security Testing
View profile
16
Parasoft: Software testing platform offering API, UI, and DevOps tools for quality engineering.
API Testing Platforms
View profile
17
Certora: Smart contract formal verification platform that proves correctness of DeFi protocols and critical blockchain code.
Code Security Scanning
View profile
18
Ox Security: Active ASPM platform providing end-to-end visibility and security across the software supply chain from code to cloud.
Application Security Posture Management
View profile
19
PMD: Open source static analysis tool finding common programming flaws in Java, JavaScript, Apex, and other languages.
Source Code Analysis
View profile
20
GuardRails AppSec: Application security platform scanning for vulnerabilities in code.
Static Application Security Testing
View profile
21
Nullify: Engineering-led security platform using AI to find and fix issues across code, cloud, and containers.
AI Security Platforms
View profile
22
Brakeman: Open source static analysis security vulnerability scanner specifically for Ruby on Rails applications.
Static Application Security Testing
View profile
23
WhiteSource: Now called Mend, providing open source security and license compliance management.
Software Composition Analysis
View profile
24
Data Theorem: API, web, mobile, and cloud application security testing platform with automated runtime protection.
API Security
View profile
25
Clayton Dev: Static analysis and code quality platform for Salesforce Apex code with security and performance checks.
Static Application Security Testing
View profile
26
Coverity: Enterprise static analysis tool by Synopsys that identifies critical defects and security vulnerabilities in code.
Static Application Security Testing
View profile
27
Zeropath: AI security platform for finding and fixing code vulnerabilities
Static Application Security Testing
View profile
28
DeepCode: AI code review tool acquired by Snyk providing automated bug detection and fixes.
AI Code Review
View profile
29
NowSecure: Mobile application security platform with continuous automated testing and SDK integration.
DevSecOps Platforms
View profile
30
CodeThreat: Fast SAST and SCA with AI-assisted remediation
Code Security Scanning
View profile
31
StackRot: Application security platform providing code risk prioritization across SAST and SCA findings.
Static Application Security Testing
View profile
32
TrustInSoft: Formal verification for embedded C/C++ security
Static Application Security Testing
View profile
33
Kiuwan: Idera-owned code security and analytics platform with SAST, SCA, and quality across 30+ languages.
Static Application Security Testing
View profile
34
SpotBugs: Static analysis tool for finding bugs in Java programs using bytecode analysis to detect potential error patterns.
Code Quality
View profile
35
Kryptowire: Quokka's mobile app security platform formerly Kryptowire analyzing iOS and Android apps for vulnerabilities.
Dynamic Application Security Testing
View profile
36
Tessellate: Autonomous security platform for DevSecOps teams with remediation
DevSecOps Platforms
View profile

Frequently asked

What is the best static application security testing software?

The guide above features static application security testing tools with complete, vendor-maintained profiles. Open any profile for real pricing, compliance, and buyer-fit detail before you shortlist.

How does Cubbie choose these static application security testing tools?

Listings come from the live Cubbie catalog. Cubbie does not accept payment for ranking position.

Ranked from Cubbie's live catalog, https://www.cubbie.com/best/static-application-security-testing