Find vulnerabilities before attackers do

Snyk

Software Composition Analysis

Snyk provides developer-first software composition analysis that finds and fixes vulnerabilities in open-source dependencies directly within developer workflows.

Semgrep

Cybersecurity

Semgrep is a fast, open-source static analysis tool for finding bugs and security vulnerabilities in code, with support for 30+ languages and integration into CI/CD pipelines for automated s...

Wiz

Cloud Security

Wiz provides agentless cloud security including container vulnerability scanning, runtime protection, and Kubernetes security as part of its comprehensive CNAPP platform.

Socket

Software Composition Analysis

Socket detects malicious open-source dependencies and supply chain risks.

GitLab

CI/CD

GitLab is the DevSecOps platform that combines source control, CI/CD, security scanning, and project planning in a single application.

tfsec

Code Security Scanning

Open source security scanner from Aqua for Terraform code finding potential misconfigurations before infrastructure is provisioned.

Mend.io

Software Composition Analysis

Mend.io is a software composition analysis and application security platform that helps development teams identify and remediate vulnerabilities in open-source dependencies.

Sonatype

Software Composition Analysis

Sonatype provides software supply chain management and SCA tools including Nexus Repository and Sonatype Lifecycle for managing open-source security and compliance.

Checkmarx

DevSecOps Platforms

Checkmarx provides a comprehensive application security platform including software composition analysis, SAST, DAST, and API security for enterprise DevSecOps programs.

Aqua Trivy

Vulnerability Scanning

Open-source vulnerability scanner from Aqua Security that finds CVEs in container images, IaC, and Git repositories.

Aikido Security

Code Security Scanning

Aikido Security brings together code, cloud, dependency, and runtime security workflows in a more approachable platform for modern engineering teams.

Nuclei

Vulnerability Scanning

Open-source vulnerability scanner using YAML-based templates to find security issues across modern tech stacks.

Black Duck

Software Composition Analysis

Black Duck provides software composition analysis that helps organizations manage security, quality, and license compliance risks from open-source and third-party code.

SonarCloud

Code Security Scanning

Cloud-based code analysis service detecting bugs, vulnerabilities, and code smells in projects hosted on GitHub and other platforms.

Code Sight

Mobile Application Security

Synopsys' IDE plugin for developers delivering security and quality feedback during development.

SonarQube

Quality Inspection Software

SonarQube is an open-source platform for continuous code quality inspection with static analysis for bugs, vulnerabilities, and code smells.

Sysdig

Cloud Security

Sysdig provides container and cloud security with runtime insights.

Trivy

Container Security

Trivy by Aqua Security is an open-source comprehensive vulnerability scanner for containers, filesystems, Git repositories, and Kubernetes configurations.

Chainguard

Supply Chain Security

Chainguard provides hardened container images and a software supply chain security platform for building and shipping safer modern applications.

Zeropath

Code Security Scanning

AI security platform for finding and fixing code vulnerabilities

Corgea

Application Security Posture Management

AI-native AppSec triage and auto-fix platform

Anchore

Container Security

Anchore provides container security and software supply chain compliance tools that help organizations enforce security policies for container images throughout the development pipeline.

Phylum

Supply Chain Security

Phylum provides automated software supply chain risk analysis that detects malicious open-source packages, author risk, and dependency vulnerabilities.

SafeDep

Supply Chain Management

Software supply chain security platform for detecting malicious packages and vulnerabilities.

FOSSA

Vulnerability Scanning

FOSSA is a software composition analysis platform that automates open-source license compliance, vulnerability scanning, and SBOM generation for enterprise development teams.

Ox Security

Application Security Posture Management

Active ASPM platform providing end-to-end visibility and security across the software supply chain from code to cloud.

KICS

Infrastructure as Code

Open source IaC security scanner from Checkmarx finding security vulnerabilities and compliance issues in Terraform, Ansible, and more.

Legit Security

Application Security Posture Management

Application security posture management platform securing the software supply chain from code to deployment with pipeline visibility and protection.

DeepSource

Code Quality and Linting

DeepSource is an AI-powered static analysis platform that automatically detects and fixes code quality issues, security vulnerabilities, and anti-patterns across multiple languages.

StackHawk

Dynamic Application Security Testing

Developer-centric DAST tool that runs application security testing in CI/CD pipelines to find and fix AppSec bugs before they hit production.