Best Static Application Security Testing (SAST) Software - Page 11

How Many Static Application Security Testing (SAST) Software Products Does G2 Track?

Total Products under this Category: 154

Category Stats (Nov 2026)

  • Average Rating: 4.54/5 The average rating of products in this category, based on all submitted ratings
  • Top Trending Product: Endor Labs (+0.46%) - Among all products in this category, Endor Labs recorded the largest rating increase compared to last month

Last updated: November 01, 2026

How Does G2 Rank Static Application Security Testing (SAST) Software Products?

Why You Can Trust G2's Software Rankings:

  • 30 Analysts and Data Experts
  • 5,800+ Authentic Reviews
  • 154+ Products
  • Unbiased Rankings

G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.

G2 Grid® for Static Application Security Testing (SAST) Software

G2 Grid® for Static Application Security Testing (SAST) Software plotting products by satisfaction and market presence

Highlighted products: Aikido Security, GitGuardian, GitHub, SonarQube, GitLab, HCL AppScan, Snyk, and Semgrep.

Underlying data: [Grid® JSON](https://www.g2.com/categories/static-application-security-testing-sast/grids.json?focus%5B%5D=aikido-security&focus%5B%5D=gitguardian&focus%5B%5D=github&focus%5B%5D=sonarqube&focus%5B%5D=gitlab&focus%5B%5D=hcl-appscan&focus%5B%5D=snyk&focus%5B%5D=semgrep)

Xygeni

Xygeni: AI-Native ASPM for the Software Supply Chain Xygeni is an AI-native ASPM (Application Security Posture Management) platform that unifies native and third-party security findings into one prioritized view. Its own detection engines cover SAST, SCA, DAST, Secrets, IaC, Container, CI/CD, and Build Security, and it also ingests results from tools like Snyk, Veracode, and Checkmarx so teams don't have to abandon what they've already invested in. Every finding, regardless of source, gets scored by exploitability, reachability, and business impact through Xygeni's Dynamic Funnels, which is what drives its reported 90% cut in alert noise. Two AI systems sit underneath the platform. CoreAI acts as a correlation and reporting layer for security leaders, turning scattered findings into a single risk narrative. DevAI works earlier, inside the developer's IDE and AI coding assistants, catching problems in both human-written and AI-generated code and proposing fixes before a pull request is even opened. On the supply chain side, Xygeni's MEW engine (Malware Early Warning) is built to catch malicious open-source packages the moment they hit a public registry, ahead of when a formal malware signature would normally exist. Shield takes that enforcement to the developer's own machine, blocking unauthorized package downloads at the OS level before they reach disk. Xygeni also runs a dedicated Code Quality engine across ten languages, ranking maintainability and complexity issues alongside security findings in the same console, so a team can see when the messiest file is also the riskiest one. The platform connects to GitHub, GitLab, Bitbucket, Jenkins, and Azure DevOps, and deploys as SaaS, on-premises, or fully air-gapped. Xygeni was named Hot Company in ASPM and in GenAI Application Security at the 2026 Global InfoSec Awards.

Average Rating: 4.6/5.0

Total Reviews: 4

How Do G2 Users Rate Xygeni?

  • Has the product been a good partner in doing business?: 10.0/10 (Category avg: 9.1/10)
  • Quality of Support: 10.0/10 (Category avg: 9.2/10)

Who Is the Company Behind Xygeni?

Who Uses This Product?

  • Company Size: 60% Small, 40% Medium

What Do G2 Reviewers Say About Xygeni?

AI-generated summary from verified user reviews

Pros
  • Users value the comprehensive security of Xygeni, providing peace of mind and efficient vulnerability management in development.
  • Users value the contextual risk prioritization of Xygeni, enabling effective focus on critical security issues.
  • Users value the comprehensive risk management of Xygeni, enhancing security while maintaining efficient development cycles.
  • Users value the robust security features of Xygeni, which significantly enhance their development process and compliance.
  • Users highlight the seamless CI/CD integration of Xygeni, enhancing security without hindering development pace.
Cons
  • Users face difficult setup challenges with Xygeni, especially requiring manual adjustments for certain configurations.
  • Users note the steep learning curve for beginners, though support and documentation are helpful for navigation.

What Are Recent G2 Reviews of Xygeni?

YAG-Suite

YAGAAN is a french startup established in 2017 and located in the Brittany Cyber Valley. In the SAST landscape, the YAG-Suite offers unique features to auditors and developers that only machine learning can bring on top of static analysis : - Smart detection of vulnerabilities - Automated qualification and hierarchization of the warnings raised by SAST, based on their likeliness to be true positives and their criticallity (individual CVSS score) - Advanced diagnostics of the detected vulnerabilities to help users understand their causes - Remediation support with recommended vulnerability fix - Code mining queries to help auditors and experts to accelerate further manual investigations The Scanner is available in saas access or on premise to be integrated in CI/CD Request your free saas trial at https://yagaan.com/en/

Who Is the Company Behind YAG-Suite?

  • Seller: YAGAAN
  • Year Founded: 2010
  • HQ Location: Paris, FR
  • LinkedIn® Page: linkedin.com
    41 employees on LinkedIn®

ZeroDay

An advanced interactive application security tool identifying vulnerabilities in both self-developed code and open-source dependencies. Seamlessly integrate into CI/CD and can be applied in both application development phase and application deployment phase.

Who Is the Company Behind ZeroDay?

  • Seller: ZeroDay
  • Year Founded: 2013
  • HQ Location: London, GB
  • LinkedIn® Page: www.linkedin.com
    4 employees on LinkedIn®

AI can help you find the answers. G2 helps you trust them.

Connect G2 to Claude or ChatGPT for answers grounded in G2's trusted reviews, comparisons, and pricing from real user insights.

How it works

ZeroNorth

Continuous security delivery fabric for modern enterprise infrastructure.

Who Is the Company Behind ZeroNorth?

Lauren Worth
LW
Researched and written by Lauren Worth
Updated October 3, 2024