SAST

Static Application Security Testing

Analyze source code or bytecode for vulnerable patterns without running the application.

31 tools profiled

How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

9 tools match

Active Visual Studio Clear all

  • OpenText Fortify

    OpenText

    SAST

    A long-established enterprise static analyzer with very broad language support, rule-driven taint analysis and detailed compliance reporting.

    Commercial
    Established

  • Checkmarx

    Checkmarx

    SAST

    An enterprise SAST engine with broad language coverage that builds a queryable code graph and traces tainted data from source to sink.

    Commercial
    Established

  • Parasoft

    Parasoft

    SAST

    Family of static analysis and automated testing products for C, C++, Java and .NET, oriented toward safety and security coding standard compliance.

    Commercial
    Established

  • HCL AppScan

    HCLSoftware

    SAST

    The static analysis component of HCL's application security suite, using taint analysis plus machine learning triage to reduce finding volume.

    Commercial
    Established

  • Kiuwan Code Security

    Kiuwan (Idera)

    SAST

    A static analysis platform pairing security rules with code quality and technical debt metrics, covering both modern and legacy enterprise languages.

    Commercial
    Established

  • OpenText Fortify

    OpenText

    A long-established enterprise static analyzer with very broad language support, rule-driven taint analysis and detailed compliance reporting.

    Commercial Established
    SAST

  • Checkmarx

    Checkmarx

    An enterprise SAST engine with broad language coverage that builds a queryable code graph and traces tainted data from source to sink.

    Commercial Established
    SAST

  • Parasoft

    Parasoft

    Family of static analysis and automated testing products for C, C++, Java and .NET, oriented toward safety and security coding standard compliance.

    Commercial Established
    SAST

  • HCL AppScan

    HCLSoftware

    The static analysis component of HCL's application security suite, using taint analysis plus machine learning triage to reduce finding volume.

    Commercial Established
    SAST

  • Kiuwan Code Security

    Kiuwan (Idera)

    A static analysis platform pairing security rules with code quality and technical debt metrics, covering both modern and legacy enterprise languages.

    Commercial Established
    SAST

  • SonarLint

    Sonar

    SAST

    IDE extension that analyzes code as you type and, in connected mode, applies the same rules and suppressions as your server side Sonar analysis.

    Open source and commercial
    Established

  • Coverity

    Black Duck

    SAST

    A build-integrated static analyzer known for deep interprocedural analysis of C and C++, covering memory safety, concurrency and injection defects.

    Commercial
    Established

  • Klocwork

    Perforce Software

    SAST

    Whole program static analysis for C, C++, C# and Java with compliance reporting against MISRA, CERT and AUTOSAR coding standards.

    Commercial
    Established

  • Veracode

    Veracode

    SAST

    Hosted application security platform whose static engine analyzes compiled binaries and bytecode rather than source, under a central policy model.

    Commercial
    Established

  • SonarLint

    Sonar

    IDE extension that analyzes code as you type and, in connected mode, applies the same rules and suppressions as your server side Sonar analysis.

    Open source and commercial Established
    SAST

  • Coverity

    Black Duck

    A build-integrated static analyzer known for deep interprocedural analysis of C and C++, covering memory safety, concurrency and injection defects.

    Commercial Established
    SAST

  • Klocwork

    Perforce Software

    Whole program static analysis for C, C++, C# and Java with compliance reporting against MISRA, CERT and AUTOSAR coding standards.

    Commercial Established
    SAST

  • Veracode

    Veracode

    Hosted application security platform whose static engine analyzes compiled binaries and bytecode rather than source, under a central policy model.

    Commercial Established
    SAST
Tick up to 4 tools above.