AppSecNews

SAST

Static Application Security Testing

Analyze source code or bytecode for vulnerable patterns without running the application.

31 tools profiled

How it differs Reads the code you wrote without running it. SCA checks the third party packages you depend on; IAST watches the running app while your tests exercise it.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

4 tools match

Active Static Analysis Clear all

  • Klocwork

    Perforce Software

    SAST

    Whole program static analysis for C, C++, C# and Java with compliance reporting against MISRA, CERT and AUTOSAR coding standards.

    Commercial
    Established

  • Parasoft

    Parasoft

    SAST

    Family of static analysis and automated testing products for C, C++, Java and .NET, oriented toward safety and security coding standard compliance.

    Commercial
    Established

  • Psalm

    Psalm project (originated at Vimeo)

    SAST

    Static analyzer for PHP combining type inference with an opt in taint mode that traces untrusted input to dangerous sinks.

    Open source
    Established

  • PT Application Inspector

    Positive Technologies

    SAST

    Static analyzer that combines several analysis techniques and attempts to generate a working exploit for each finding to separate real issues from noise.

    Commercial
    Established

  • Klocwork

    Perforce Software

    Whole program static analysis for C, C++, C# and Java with compliance reporting against MISRA, CERT and AUTOSAR coding standards.

    Commercial Established
    SAST

  • Parasoft

    Parasoft

    Family of static analysis and automated testing products for C, C++, Java and .NET, oriented toward safety and security coding standard compliance.

    Commercial Established
    SAST

  • Psalm

    Psalm project (originated at Vimeo)

    Static analyzer for PHP combining type inference with an opt in taint mode that traces untrusted input to dangerous sinks.

    Open source Established
    SAST

  • PT Application Inspector

    Positive Technologies

    Static analyzer that combines several analysis techniques and attempts to generate a working exploit for each finding to separate real issues from noise.

    Commercial Established
    SAST
Tick up to 4 tools above.