Product Listings
Veracode is a software focused on application security, offering tools for static analysis, dynamic analysis, software composition analysis, and manual penetration testing. The software scans code and binaries to identify vulnerabilities, helping organizations improve security throughout the software development lifecycle. It integrates with development environments and DevOps pipelines, enabling continuous security checks and remediation guidance for developers. Veracode addresses business challenges related to secure coding, regulatory compliance, and risk management by providing actionable insights, reporting, and governance features. The software supports a range of programming languages and frameworks, allowing teams to reduce security risks while maintaining development speed and agility.
Checkmarx SAST is a software designed to analyze application source code in order to identify security vulnerabilities during the software development process. The software supports multiple programming languages and frameworks, enabling development and security teams to detect issues early in the application life cycle. Checkmarx SAST provides features such as automated code scanning, integration with development environments and CI/CD pipelines, customizable reporting, and support for compliance requirements. The software addresses business problems related to software security by helping organizations manage and reduce risks associated with insecure code, promoting safer software releases, and assisting with regulatory adherence.
Appknox is a software designed to assist organizations in identifying and addressing security vulnerabilities within mobile applications. It enables automated and manual testing to evaluate application source code, binaries, and behavior for potential risks and compliance issues. The software supports security assessment processes such as static, dynamic, and API testing to uncover misconfigurations, insecure coding practices, and potential data exposure. Appknox integrates with development workflows to streamline vulnerability detection and remediation, helping businesses protect sensitive information and comply with regulatory requirements. It is used to enhance mobile application security by providing actionable insights for IT and security teams.
AppScan is a software developed to help organizations identify and manage security vulnerabilities in applications. It performs dynamic, static, interactive, and open-source security testing to analyze code and detect issues throughout the software development lifecycle. The software provides automated scanning capabilities for web, mobile, and API applications, offering remediation guidance and reporting functionalities to support compliance with regulatory standards. AppScan integrates with development and DevOps workflows to enable early detection of vulnerabilities and facilitate secure code deployment. The software addresses the business problem of reducing the risk of security breaches by enhancing application security and supporting continuous vulnerability management.
Implement Fluid Attacks' comprehensive, AI-powered solution into your SDLC and develop secure software without delays. As an all-in-one solution, Fluid Attacks accurately finds and helps you remediate vulnerabilities throughout the SDLC and ensures secure software development. The solution integrates its AI, automated tool, and team of pentesters to perform SAST, SCA, DAST, SCR, PtaaS and RE to help you improve your security posture. This way, Fluid Attacks delivers accurate knowledge of the security status of your application. This means security goes alongside innovation without hindering your speed. Fluid Attacks provides you with expert knowledge about vulnerabilities and support options that enable you to remediate the security issues in your application.
GitLab is a comprehensive AI-powered DevSecOps platform that seamlessly unites security and development teams while helping customers standardize pipelines around security and compliance policies. It provides the visibility and controls necessary to create more secure software and ensure end-to-end software supply chain security. GitLab enables customers to (1) find and fix vulnerabilities in application code and cloud-native environments, (2) have one tool for both developers and security professionals to improve collaboration, (3) create and ingest software bill of materials (SBOMs) and ensure adherence to license compliance, (4) seamlessly integrate security scanners into the CI/CD pipeline out of the box, with no additional licenses to manage, (5) implement a broad range of policies and common controls for compliance, (6) simplify adoption of security and governance capabilities across the SDLC.
Contrast Runtime Security Platform is a software that provides security monitoring and protection for applications during runtime. The software utilizes techniques such as instrumentation to identify vulnerabilities, detect threats, and prevent exploits while applications are operating. It offers features including real-time vulnerability assessment, attack detection, and automated remediation guidance. The software is designed to address business problems related to application security by enabling organizations to continuously monitor, detect, and protect their code against security risks, allowing for proactive risk management in development and production environments. Contrast Runtime Security Platform integrates with existing development and deployment workflows to support secure DevOps processes and enhance compliance with security policies.
Continuous Dynamic is a software developed by Black Duck that offers continuous analysis and identification of open source security vulnerabilities in software applications. The software performs real-time detection and monitoring of open source components and dependencies throughout the software development lifecycle. It provides visibility into potential risks associated with the use of open source libraries and automates the process of vulnerability management by integrating with development and CI/CD workflows. Continuous Dynamic aims to address the business problem of identifying and mitigating security threats in software supply chains, while helping organizations comply with security standards and reduce the potential for unpatched vulnerabilities in releases.
Coverity® is a fast, accurate, and highly scalable static analysis (SAST) solution that helps development and security teams address security and quality defects in source code early in the software development life cycle (SDLC), track and manage risks across the application portfolio, and ensure compliance with security and coding standards, including: OWASP Top 10, CWE Top 25, PCI DSS, MISRA®, CERT C/C++, CERT Java, DISA STIG, ISO 26262, ISO/IEC TS 17961, and AUTOSAR®. Coverity provides a broad set of security and quality checkers for over 20 languages and 70 frameworks, as well as commonly used infrastructure-as-code (IaC) platforms and file formats. Coverity supports both cloud and on-premises deployment. It supports automated scanning with a wide range of continuous integration (CI) and source code management (SCM) platforms. In addition, static analysis can be performed at the developer desktop when Coverity is used on conjunction with the Code Sight IDE plug-in.
Invicti is a software designed to identify and manage security vulnerabilities in web applications. It performs automated scanning to detect potential security risks such as SQL injection, cross-site scripting, and other vulnerabilities. The software offers features including automatic scanning of web assets, vulnerability verification, and integration with issue tracking and development workflows. Invicti assists organizations in maintaining secure code by enabling continuous security assessments and streamlining remediation processes. The software addresses the business need for proactive identification and resolution of web security issues, helping organizations reduce the risk of security breaches and supporting compliance with industry standards and policies.
OpenText Static Application Security Testing (Fortify) is a software designed to analyze source code, bytecode, or binaries for security vulnerabilities without executing the application. The software provides automated scanning capabilities, integrates with development environments, and supports multiple programming languages. It identifies potential weaknesses in code and offers remediation guidance to address issues before deployment. The software enables organizations to improve application security by detecting vulnerabilities early in the software development lifecycle, supporting compliance requirements, and helping reduce the risk of security breaches. It is suitable for use by development and security teams aiming to enhance the overall security posture of applications.
GitHub Enterprise is a DevOps platform to build, scale and deliver secure software that includes GitHub Issues and Projects for integrated project planning and management capabilities.
Snyk Code is a developer-first SAST solution that keeps pace with modern development, analyzing source code directly with speed and accuracy across the software development lifecycle (SDLC).
Snyk’s DeepCode AI engine performs in-depth scans involving single-file, interfile, and data flow analysis in real time, ensuring accurate scans that remove false positive results and earn developer trust. In addition to providing visibility and governance during development, Snyk Code reduces vulnerability backlogs and time-to-fix by providing developers with actionable fixes in-line with code in their IDE, CLI, and pull request workflows.
SonarQube is an automated code review platform that checks your code for quality and security issues, available via cloud or on your own server. SonarQube is an independent review and verification layer to ensure all code—whether written by developers or generated by AI or AI agents—is secure, reliable, and maintainable. SonarQube automatically scans every code change, giving developers clear instructions and suggested fixes to resolve problems before they are merged into the main project.
The experience starts in your editor with SonarQube for IDE, which works with both traditional and AI-native code editors, to highlight problems and suggest fixes. SonarQube also connects directly to your AI coding tools through an MCP server, giving AI assistants the data they need to understand your code's quality and security rules. Originally built by the open-source community, it is now used by over 7 million developers globally.
OpenText Application Security Aviator, also known as Fortify, is a software designed to identify, analyze, and remediate vulnerabilities in application code throughout the software development lifecycle. The software provides static, dynamic, and interactive application security testing capabilities to help detect security flaws before deployment. It supports multiple programming languages and integrates with development tools and workflows, enabling continuous assessment of code for potential risks. The software assists organizations in addressing compliance requirements and reducing exposure to threats by delivering actionable insights into application security posture, supporting both on-premises and cloud environments.
Checkmarx One is the unified, cloud-native application security platform for enterprises that need to secure code, applications, and AI-driven development at scale. It brings SAST, SCA, IaC, API, DAST, container, and supply chain security together with ASPM and the Checkmarx One Assist family of agentic AI agents, delivering correlated risk insights and developer-centric remediation from the IDE to production. With a single platform and data model, customers reduce tool sprawl, improve risk visibility, and help developers ship secure software faster.
Black Duck® software composition analysis (SCA) helps teams manage the security, quality, and license compliance risks that come from the use of open source and third-party code in applications and containers. Black Duck uses multiple open source discovery techniques to generate a complete and accurate software bill of materials (SBOM), including: declared/transitive dependency analysis, filesystem scanning, binary file analysis, and embedded code snippet detection. Black Duck gives teams a complete picture of open source risks with information from the Black Duck KnowledgeBase™ of over 5 million open source projects. In addition, independently researched Black Duck Security Advisories (BDSAs) provide teams with detailed vulnerability risk and remediation guidance weeks ahead of the NVD. Teams can manage risks across the SDLC using integrated policy management capabilities as well as monitoring and alerting for newly reported vulnerabilities impacting production applications.
ImmuniWeb AI is a software that provides application security testing and risk assessment solutions for web, mobile, and API applications. The software enables organizations to identify vulnerabilities, misconfigurations, and compliance issues through automated and AI-powered scanning, combined with manual security testing. ImmuniWeb AI offers features such as continuous monitoring, vulnerability detection, and security posture management, helping businesses address security risks across digital assets. The software supports integration with development workflows and other security tools, aiming to improve overall security management and reduce exposure to threats. ImmuniWeb AI assists organizations in meeting regulatory and industry standards for security and privacy.
The Mend AI Native AppSec Platform is designed to address risks in software created by both human developers and AI systems. The platform unifies static application security testing (SAST), software composition analysis (SCA), container scanning, AI component security and automated AI red teaming, giving teams visibility into risks across the application attack surface. The platform secures AI-generated code, embedded AI components (models, agents, MCPs, RAG pipelines), and conversational AI, while also covering traditional application risks.
Mend.io integrates with development workflows to provide real-time alerts, policy enforcement, and ongoing monitoring across the software development lifecycle. Centralized dashboards and reporting deliver visibility into vulnerabilities, risk trends, and remediation progress. AI-assisted remediation and prioritization workflows enable teams to address issues efficiently and reduce overall risk.
Snyk Open Source provides a developer-first SCA solution, to find, prioritize, and fix security vulnerabilities and license issues in open source packages, throughout the software development lifecycle. Application context helps prioritize reachable, deployed, or publicly exposed open source issues that pose the greatest risk to your organization, while guardrails verify that your projects adhere to your security and license policies. SBOM exporting for open source and container projects allows you to meet increasing software transparency regulations, and SBOM testing can scan external tools for vulnerabilities.