Best Static Application Security Testing (SAST) Software

How Many Static Application Security Testing (SAST) Software Products Does G2 Track?

Total Products under this Category: 113

Category Stats (Aug 2026)

  • Average Rating: 4.54/5 (↑0.01 vs Jul 2026) The average rating of products in this category, based on all submitted ratings
  • Top Trending Product: Black Duck Coverity Static (+0.61%) - Among all products in this category, Black Duck Coverity Static recorded the largest rating increase compared to last month

Last updated: August 11, 2026

How Does G2 Rank Static Application Security Testing (SAST) Software Products?

Why You Can Trust G2's Software Rankings:

  • 30 Analysts and Data Experts
  • 5,400+ Authentic Reviews
  • 113+ Products
  • Unbiased Rankings

G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.

G2 Grid® for Static Application Security Testing (SAST) Software

G2 Grid® for Static Application Security Testing (SAST) Software plotting products by satisfaction and market presence

Highlighted products: Aikido Security, GitHub, GitGuardian, GitLab, SonarQube, Semgrep, Snyk, and Checkmarx.

Underlying data: [Grid® JSON](https://www.g2.com/categories/static-application-security-testing-sast/grids.json?focus%5B%5D=aikido-security&focus%5B%5D=github&focus%5B%5D=gitguardian&focus%5B%5D=gitlab&focus%5B%5D=sonarqube&focus%5B%5D=semgrep&focus%5B%5D=snyk&focus%5B%5D=checkmarx)

Sponsored

Google Cloud Storage

Cloud Storage is a managed service for storing unstructured data, like videos and documents. It is most commonly used for data lakes for analytics, storing AI data, or web hosting. With Cloud Storage you can store any amount of data, and retrieve it as often as you like. New customers can use $300 in free credits to try Cloud Storage. All customers get 5 GiB of US regional storage free per month, not charged against your credits. If you’re a consumer or business looking for file sharing, check out Workspace products like Google Drive (https://workspace.google.com/products/drive/). If you’re looking for photo storage, use Google Photos (www.google.com/photos)

Visit website

Aikido Security

Aikido Security is the developer-first security platform that unifies code, cloud, protection, and attack testing in one suite of best-in-class products. Built by developers for developers, Aikido helps teams of any size ship secure software faster, automate protection, and simulate real-world attacks with AI-driven precision. The platform’s proprietary AI cuts noise by 95%, delivers one-click fixes, and saves developers 10+ hours per week. Aikido Intel proactively uncovers vulnerabilities in open source packages before disclosure, helping secure more than 50,000 organizations worldwide, including Revolut, Niantic, Visma, Montblanc, and GoCardless.

Average Rating: 4.6/5.0

Total Reviews: 255

How Do G2 Users Rate Aikido Security?

  • Test Automation: 8.6/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 9.2/10 (Category avg: 9.1/10)
  • Quality of Support: 9.2/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 8.2/10 (Category avg: 8.3/10)

Who Is the Company Behind Aikido Security?

  • Seller: Aikido Security
  • Company Website:
  • Year Founded: 2022
  • HQ Location: Ghent, Belgium
  • Twitter: @AikidoSecurity
    11,770 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    241 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Founder, CTO
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 80% Small, 13% Medium

What Do G2 Reviewers Say About Aikido Security?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the ease of use of Aikido Security, benefiting from its clear, actionable insights and seamless integration.
  • Users praise Aikido Security for its fast and user-friendly identification of security issues in codebases, enhancing development practices.
  • Users appreciate the robust features of Aikido Security, valuing its usability and effectiveness in enhancing security workflows.
  • Users value the easy integrations with GitLab, allowing for quick start and effective tracking of security issues.
  • Users commend the easy setup of Aikido Security, simplifying integration and enhancing their security workflow significantly.
Cons
  • Users note the missing features in Aikido Security, wishing for more integration and advanced configuration options.
  • Users find the pricing excessive, particularly for startups, despite acknowledging the product's value.
  • Users find Aikido Security has limited features, particularly in advanced customization and reporting for complex environments.
  • Users find the entry-level pricing of Aikido Security too high for startups, limiting adoption and experimentation.
  • Users are frustrated by the lack of features, especially with local scanning and branch handling limitations.

What Are Recent G2 Reviews of Aikido Security?

GitHub

GitHub is where the world builds software. Millions of individuals, organizations and businesses around the world use GitHub to discover, share, and contribute software. Developers at startups to Fortune 50 companies use GitHub, every step of the way.

Average Rating: 4.7/5.0

Total Reviews: 2,334

How Do G2 Users Rate GitHub?

  • Test Automation: 8.5/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 8.9/10 (Category avg: 9.1/10)
  • Quality of Support: 8.7/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 8.3/10 (Category avg: 8.3/10)

Who Is the Company Behind GitHub?

  • Seller: GitHub
  • Year Founded: 2008
  • HQ Location: San Francisco, CA
  • Twitter: @github
    2,673,925 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    6,653 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Software Engineer, Senior Software Engineer
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 47% Small, 31% Medium

What Do G2 Reviewers Say About GitHub?

AI-generated summary from verified user reviews

Pros
  • Users value exceptional collaboration and version control features, making GitHub essential for code tracking and development.
  • Users value the ease of use that GitHub offers, enhancing collaboration and version control effortlessly.
  • Users value the seamless team collaboration on GitHub, enhancing project transparency and workflow automation effectively.
  • Users value the seamless collaboration GitHub offers, enabling efficient teamwork and project transparency for developers.
  • Users value the seamless version control in GitHub, enhancing collaboration and simplifying code management throughout projects.
Cons
  • Users find the learning curve and complexity of advanced features like GitHub Actions challenging for newcomers.
  • Users find the learning curve steep, facing challenges with complexity and configuration in GitHub Actions.
  • Users find the learning difficulty of GitHub challenging, especially for beginners unfamiliar with Git workflows.
  • Users find the complexity for beginners challenging, especially with CI/CD workflows and permission management in GitHub.
  • Users find the steep learning curve of GitHub challenging, especially when configuring workflows and managing permissions.

What Are Recent G2 Reviews of GitHub?

What Are G2 Users Discussing About GitHub?

GitGuardian

GitGuardian is an end-to-end Secrets and Non-Human Identity (NHI) Security platform designed to help organizations eliminate secrets sprawl, govern machine identities, and meet compliance requirements under PCI-DSS v4.0, DORA, NYDFS Part 500, and NIS 2. As attackers increasingly target NHIs like service accounts, service principals, AI agents, and applications, protecting the credentials they rely on has become critical. GitGuardian's platform is built on three pillars: Secrets Security, NHI Governance, and Developer Endpoint Protection. **Secrets Security** eliminates leaks across every environment. Internal Secrets Monitoring detects hardcoded credentials in source code, CI/CD pipelines, container images, and collaboration tools like Slack, Jira, and Confluence with 500+ purpose-built detectors and a false positive rate under 10%. Public Secrets Monitoring scans 1B+ public GitHub commits daily, alerting teams the moment a secret is exposed externally. Honeytokens deploy decoy credentials that trigger immediate alerts on unauthorized access attempts. **NHI Governance** provides a centralized inventory of machine identities, including those outside vaults, with ownership attribution, risk scoring, and compliance evidence to support access reviews and rotation policy configuration. **Developer Endpoint Protection** extends coverage to the credential layer that repo and CI scanning can't reach: developer laptops. GitGuardian scans project directories, .env files, cloud credential stores, AI agent configs, and shell history across the entire fleet, delivering a prioritized inventory of exposed secrets by machine and severity. Trusted by Snowflake, ING, BASF, Datadog, Webflow, Bouygues Telecom, and more, and the #1 most-installed security app on the GitHub Marketplace.

Average Rating: 4.8/5.0

Total Reviews: 277

How Do G2 Users Rate GitGuardian?

  • Test Automation: 8.3/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 9.0/10 (Category avg: 9.1/10)
  • Quality of Support: 9.1/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 9.0/10 (Category avg: 8.3/10)

Who Is the Company Behind GitGuardian?

  • Seller: GitGuardian
  • Company Website:
  • Year Founded: 2017
  • HQ Location: Paris, Île-de-France
  • Twitter: @GitGuardian
    6,055 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    182 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Software Engineer, Software Developer
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 84% Small, 12% Medium

What Do G2 Reviewers Say About GitGuardian?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the alert notifications of GitGuardian, enabling instant updates on key leaks after code pushes.
  • Users praise the automated security features of GitGuardian, ensuring seamless and proactive detection of secrets.
  • Users love the automated vulnerability detection of GitGuardian, appreciating its swift and proactive monitoring of secrets.
  • Users value the accurate and fast detection of GitGuardian, ensuring real-time alerts and precise incident management.
  • Users commend GitGuardian for its immediate detection speed, offering quick alerts and actionable fixes during development.
Cons
  • Users find that false positives can be cumbersome, requiring significant tuning and impacting user experience.
  • Users find the inefficient notifications overwhelming, as alerts accumulate and false positives increase workflow complexity.
  • Users find the limited customization options in GitGuardian a barrier for tailoring alerts and policies effectively.
  • Users find the interface confusing, struggling with cluttered navigation and excessive alert filtering across multiple incidents.
  • Users report excessive notifications from GitGuardian, leading to clutter and increased review time for incident management.

What Are Recent G2 Reviews of GitGuardian?

What Are G2 Users Discussing About GitGuardian?

GitLab

GitLab is the most comprehensive AI-Powered DevSecOps platform that enables software innovation by empowering development, security, and operations teams to build better software, faster. With GitLab, teams can create, deliver, and manage code quickly and continuously instead of managing disparate tools and scripts. GitLab helps your teams across the complete DevSecOps lifecycle, from developing, securing, and deploying software. What makes us truly different? - Flexibility: Consume as a service or manage your own deployment - Cloud-Agnostic: Deploy anywhere with no vendor lock-in - No rip and replace: Scale to a platform approach at your own pace

Average Rating: 4.5/5.0

Total Reviews: 885

How Do G2 Users Rate GitLab?

  • Test Automation: 9.2/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 8.8/10 (Category avg: 9.1/10)
  • Quality of Support: 8.5/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 8.9/10 (Category avg: 8.3/10)

Who Is the Company Behind GitLab?

  • Seller: GitLab Inc.
  • Company Website:
  • Year Founded: 2014
  • HQ Location: San Francisco, California
  • Twitter: @gitlab
    171,534 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    3,473 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Software Engineer, Senior Software Engineer
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 37% Medium, 37% Small

What Do G2 Reviewers Say About GitLab?

AI-generated summary from verified user reviews

Pros
  • Users enjoy the ease of use of GitLab, thanks to its unified interface and streamlined CI/CD integrations.
  • Users value the all-in-one platform of GitLab, which streamlines development processes and enhances team collaboration.
  • Users praise GitLab for its powerful CI/CD integration, which simplifies automation and enhances pipeline efficiency.
  • Users value GitLab's s seamless integrations allowing streamlined workflows without the need for multiple tools.
  • Users value GitLab's seamless CI/CD integration, which simplifies automation and enhances overall development efficiency.
Cons
  • Users find the complexity of GitLab's group structure and management challenging, particularly for newcomers and infrastructure.
  • Users face a difficult learning curve with GitLab, especially for those unfamiliar with its unique structure and features.
  • Users find the confusing interface of GitLab overwhelming, especially new users navigating its complex functionalities and settings.
  • Users find the complex user interface of GitLab requires significant effort to master and is not always intuitive.
  • Users find the steep learning curve of GitLab challenging, especially when adapting to its comprehensive features and UI.

What Are Recent G2 Reviews of GitLab?

What Are G2 Users Discussing About GitLab?

SonarQube

Sonar, the industry standard for code verification and automated code review, helps reduce outages, improve security, and lower risks associated with AI and agentic coding. As an independent verification platform, Sonar enables organizations to securely develop at the speed of AI. Sonar is the foundation for high-performance software engineering, analyzing over 750 billion lines of code daily to ensure applications are secure, reliable, and maintainable. Rooted in the open source community, Sonar is trusted by 7M+ developers globally, including teams at ServiceNow, Booking.com, Deutsche Bank, AstraZeneca, and Ford Motor Company.

Average Rating: 4.4/5.0

Total Reviews: 153

How Do G2 Users Rate SonarQube?

  • Test Automation: 6.4/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 8.3/10 (Category avg: 9.1/10)
  • Quality of Support: 8.2/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 6.8/10 (Category avg: 8.3/10)

Who Is the Company Behind SonarQube?

  • Seller: SonarSource Sàrl
  • Company Website:
  • Year Founded: 2008
  • HQ Location: Geneva, Switzerland
  • Twitter: @SonarSource
    10,913 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    973 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Software Engineer, DevOps Engineer
  • Top Industries: Information Technology and Services, Computer Software
  • Company Size: 41% Large, 40% Medium

What Do G2 Reviewers Say About SonarQube?

AI-generated summary from verified user reviews

Pros
  • Users value how SonarQube efficiently flags code quality and security issues, ensuring a clean and maintainable codebase.
  • Users value the issue filtering and prioritization features of SonarQube, enhancing focus on high-priority tasks.
  • Users value the issue identification and prioritization features of SonarQube, improving focus on critical tasks.
  • Users find SonarQube's ease of use invaluable for maintaining code quality and integrating seamlessly into development workflows.
  • Users appreciate the easy integrations with existing CI/CD tools, enhancing their development workflow seamlessly.
Cons
  • Users face challenges with software bugs as SonarQube can consume excessive RAM and occasionally reports false positives.
  • Users find SonarQube's configuration complex, especially for beginners, leading to difficulties and overwhelming warnings to manage.
  • Users encounter false positives that complicate evaluations, though mitigation options exist through detailed analysis and rule customization.
  • Users find that SonarQube's complexity in configuration and excessive warnings can hinder effective usage and efficiency.
  • Users find the complex setup of SonarQube challenging, especially for beginners unfamiliar with the configuration process.

What Are Recent G2 Reviews of SonarQube?

What Are G2 Users Discussing About SonarQube?

Semgrep

Semgrep is a modern static analysis (SAST), software composition analysis (SCA), and secrets detection platform designed for both developers and security teams. It combines fast, deterministic analysis with context-aware AI that triages findings like a senior security engineer. The AI Assistant helps reduce false positives, prioritize meaningful results, and offers clear remediation guidance. Its “Memories” feature learns from past decisions to further reduce triage noise over time. Semgrep also supports deep analysis of transitive dependencies, not just direct ones, helping teams surface and address hidden risks in their supply chain. It integrates well into modern development workflows and is easy to customize across environments.

Average Rating: 4.6/5.0

Total Reviews: 56

How Do G2 Users Rate Semgrep?

  • Test Automation: 9.2/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 9.6/10 (Category avg: 9.1/10)
  • Quality of Support: 8.8/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 7.5/10 (Category avg: 8.3/10)

Who Is the Company Behind Semgrep?

  • Seller: Semgrep
  • Company Website:
  • Year Founded: 2017
  • HQ Location: San Francisco, US
  • Twitter: @semgrep
    4,433 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    262 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer Software
  • Company Size: 45% Large, 43% Medium

What Do G2 Reviewers Say About Semgrep?

AI-generated summary from verified user reviews

Pros
  • Users value the ease of use of Semgrep, praising its intuitive syntax and smooth CI/CD integration.
  • Users appreciate the intuitive pattern-matching syntax of Semgrep, enabling effective custom rules for various programming languages.
  • Users appreciate Semgrep's effective vulnerability detection, enabling quick identification of security issues with low false positives.
  • Users value the scanning efficiency of Semgrep, benefiting from rapid scans and seamless CI/CD integration.
  • Users appreciate the robust security features of Semgrep, enabling effective identification and remediation of vulnerabilities effortlessly.
Cons
  • Users find Semgrep not user-friendly, citing a steep learning curve and challenges in initial setup and customization.
  • Users note the limited features of Semgrep, making categorization and comprehensive analysis more challenging.
  • Users find the difficult learning curve for custom rules in Semgrep challenging, impacting new user experiences and efficiency.
  • Users face a lack of guidance in mastering rule creation and initial setup, impacting effective tool utilization.
  • Users find the learning curve steep for rule writing, especially for those new to static analysis tools.

What Are Recent G2 Reviews of Semgrep?

Snyk

Snyk (pronounced sneak) is a developer security platform for securing custom code, open source dependencies, containers, and cloud infrastructure all from a single platform. Snyk’s developer security solutions enable modern applications to be built securely, empowering developers to own and build security for the whole application, from code & open source to containers & cloud infrastructure. Secure while you code in your IDE: find issues quickly using the scanner, fix issues easily with remediation advice, verify the updated code. Integrate your source code repositories to secure applications: integrate a repository to find issues, prioritize with context, fix & merge. Secure your containers as you build, throughout the SDLC: start fixing containers as soon as your write a Dockerfile, continuously monitor container images throughout their lifecycle, and prioritize with context. Secure build and deployment pipelines: Integrate natively with your CI/CD tool, configure your rules, find & fix issues in your application, and monitor your applications. Secure your apps quickly with Snyk’s vulnerability scanning and automated fixes - Try for Free!

Average Rating: 4.5/5.0

Total Reviews: 135

How Do G2 Users Rate Snyk?

  • Test Automation: 7.8/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 8.7/10 (Category avg: 9.1/10)
  • Quality of Support: 8.6/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 6.2/10 (Category avg: 8.3/10)

Who Is the Company Behind Snyk?

  • Seller: Snyk
  • HQ Location: Boston, Massachusetts
  • Twitter: @snyksec
    21,057 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    1,370 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Software Engineer
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 44% Medium, 35% Small

What Do G2 Reviewers Say About Snyk?

AI-generated summary from verified user reviews

Pros
  • Users value Snyk's rapid vulnerability detection, enabling efficient identification and remediation in development environments.
  • Users appreciate Snyk's rapid vulnerability identification, enhancing security through quick updates and effective integration.
  • Users value the easy integrations of Snyk, enhancing workflow efficiency in CI/CD pipelines and GitHub.
  • Users appreciate the easy setup of Snyk, enabling seamless integration with GitHub and efficient codebase scanning.
  • Users commend Snyk for its intuitive GUI and customizable organization structure, enhancing vulnerability management and reporting efficiency.
Cons
  • Users experience false positives from Snyk, leading to confusion and slowing down the scanning process.
  • Users feel the poor interface design of Snyk hinders usability, especially with the separate DAST interface.
  • Users face pricing issues with Snyk, as the cost can be high for accessing all features.
  • Users often face scanning issues such as false positives and slow scans, affecting overall efficiency and workflow.
  • Users report false positives and slow scans in Snyk, affecting efficiency and integration with other tools.

What Are Recent G2 Reviews of Snyk?

What Are G2 Users Discussing About Snyk?

Checkmarx

Checkmarx is a type of application security solution designed to help organizations safeguard their software development processes while enhancing efficiency and reducing costs. The Checkmarx One platform stands out in the realm of enterprise-grade security, offering comprehensive protection that addresses the complexities of modern software development, including legacy systems and AI-generated code. By scanning trillions of lines of code annually, Checkmarx enables companies to significantly lower their vulnerability density, ensuring a robust defense against potential threats. The platform is particularly beneficial for software development teams, security professionals, and organizations that prioritize secure coding practices. With the increasing reliance on AI technologies and the rapid pace of software development, Checkmarx One provides essential tools to mitigate risks associated with both traditional and emerging programming languages. Its innovative architecture, powered by autonomous security agents and AI-native intelligence, allows organizations to integrate security seamlessly into their development workflows, thereby accelerating development velocity without compromising on safety. Key features of Checkmarx One include Triage Assist, which employs an autonomous AI agent to prioritize vulnerabilities based on real-world exploitability and contextual risk. This feature empowers teams to concentrate their efforts on the most critical issues rather than getting bogged down by static severity scores. Additionally, Remediation Assist generates review-ready fixes for validated vulnerabilities prior to code merges, streamlining the secure delivery process and minimizing the manual overhead typically associated with remediation tasks. Developer Assist is another notable feature, acting as a standalone security agent that identifies risks during the coding process. By providing safe, explainable, and verified fixes directly within the integrated development environment (IDE), it supports developers in maintaining a stable and rapid development pace. Furthermore, the platform includes AI Supply Chain Security, which offers centralized governance and visibility for AI components embedded in applications, ensuring that hidden AI assets are discovered and managed effectively. Lastly, Checkmarx One incorporates advanced analysis engines such as AI SAST and DAST for AI, which enhance security measures across various environments. The AI SAST feature expands detection capabilities to cover emerging and unsupported programming languages, while the DAST for AI strengthens runtime protection in continuous integration and deployment (CI/CD) settings. Together, these features position Checkmarx One as a comprehensive solution for organizations looking to fortify their software development lifecycle against evolving threats.

Average Rating: 4.2/5.0

Total Reviews: 44

How Do G2 Users Rate Checkmarx?

  • Test Automation: 8.7/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 8.6/10 (Category avg: 9.1/10)
  • Quality of Support: 8.3/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 5.6/10 (Category avg: 8.3/10)

Who Is the Company Behind Checkmarx?

  • Seller: Checkmarx
  • Company Website:
  • Year Founded: 2006
  • HQ Location: Paramus, NJ
  • Twitter: @Checkmarx
    7,284 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    1,019 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer Software
  • Company Size: 56% Large, 23% Medium

What Do G2 Reviewers Say About Checkmarx?

AI-generated summary from verified user reviews

Pros
  • Users find Checkmarx easy to implement, seamlessly integrating into existing repositories with a user-friendly interface.
  • Users appreciate the intuitive user interface of Checkmarx, making security reviews simple and user-friendly.
  • Users value the accuracy of results from Checkmarx, as it simplifies security reviews with detailed vulnerability insights.
  • Users value the automation testing capabilities of Checkmarx, finding it easy to integrate and use effectively.
  • Users praise the exceptional customer support at Checkmarx, ensuring prompt assistance for any unresolved issues.
Cons
  • Users face a high number of false positives in Checkmarx when working with Kotlin projects, affecting accuracy and reliability.
  • Users report lacking feature support for Kotlin, leading to numerous false positives not seen in Java or JavaScript.
  • Users experience missing features in Checkmarx, specifically regarding poor support for Kotlin that leads to false positives.
  • Users find the poor navigation in Checkmarx frustrating, as the dashboard layout and display need enhancement.

What Are Recent G2 Reviews of Checkmarx?

What Are G2 Users Discussing About Checkmarx?

OX Security

OX rewires your security program for the Mythos Age: the era where AI writes the code, chains the exploits, and moves faster than human-built defenses can track. OX is an AI Native Application Protection Platform (AINAPP) unifying security from Prompt to Runtime. It moves your control surface upstream to the prompt, preventing and governing risk at the source instead of chasing it downstream in runtime. OX Mind and OX AI Context Lake connect AI-user governance, code security, cloud and runtime enforcement, and agentic pentesting into one system that shares context across the entire Agentic Development Lifecycle (ADLC), replacing fragmented point tools with a single platform. The platform runs on four connected pillars: OX VibeSec: Prevents unsafe AI decisions at the point of creation and governs every AI user in the organization, not just developers using coding assistants. Full visibility into which agents, MCPs, skills, and packages run, with what permissions, against what data. OX Code: Separates exploitable risk from theoretical noise using evidence from your actual deployment, threat model, and threat intelligence. OX Cloud: Prevents misconfigurations and enforces runtime boundaries that code and agents cannot cross, watching what actually runs in production. OX Agentic Pentester: Continuously simulates adversarial agent behavior to prove exploit paths back to their exact source, feeding what it finds back into OX VibeSec to sharpen governance. OX connects to your existing stack and traces every finding back to its origin (the prompt, the AI user, or the endpoint that created it), then fixes issues at the source rather than flagging them after the fact. For new deployments, OX consolidates governance, code security, cloud enforcement, and pentesting into one platform. For existing stacks, OX layers governance on top and makes current tools smarter through continuous learning, so the same issue never gets created twice. Visit https://ox.security for more information.

Average Rating: 4.8/5.0

Total Reviews: 51

How Do G2 Users Rate OX Security?

  • Test Automation: 7.3/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 9.7/10 (Category avg: 9.1/10)
  • Quality of Support: 9.6/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 7.7/10 (Category avg: 8.3/10)

Who Is the Company Behind OX Security?

Who Uses This Product?

  • Who Uses This: Security Engineer
  • Top Industries: Financial Services, Information Technology and Services
  • Company Size: 63% Medium, 25% Large

What Do G2 Reviewers Say About OX Security?

AI-generated summary from verified user reviews

Pros
  • Users value the intuitive dashboard and seamless integration of OX Security, enhancing their security management and workflow efficiency.
  • Users value the seamless collaboration enabled by OX Security, enhancing their focus on critical development tasks.
  • Users commend the responsive customer support of OX Security, enhancing their overall operational efficiency and satisfaction.
  • Users value the seamless integrations with existing tools, enhancing workflows and boosting overall development efficiency.
  • Users appreciate the speed of OX Security, enabling faster remediation of vulnerabilities and cloud misconfigurations.
Cons
  • Users find the complexity of OX Security daunting, facing a steep learning curve and inadequate documentation.
  • Users find the interface overwhelming, with a steep learning curve and insufficient documentation to guide new users.
  • Users find the complex setup challenging, especially due to inadequate documentation and overwhelming UI for new users.
  • Users find the executive dashboard limiting, impacting effective reporting on product security enhancements to management.
  • Users find OX Security's difficult learning curve challenging, particularly due to its complex interface and lacking documentation.

What Are Recent G2 Reviews of OX Security?

DryRun Security

Security leaders face a paradox: ship faster and enable agentic development while staying secure and keeping developers productive. DryRun Security resolves this by securing every pull request and repo with a high-precision, automated security engineer review right where developers and their agents build. DryRun Security is the industry’s most accurate agentic code security intelligence platform. Powered by its proprietary Contextual Security Analysis (CSA) engine, DryRun Security delivers the AI moment for security teams in an AI-native developer world. Traditional static application security testing (SAST) floods teams with alerts, misses higher-order risk, and burns time in triage. DryRun Security goes beyond SAST with contextual analysis that prioritizes what is exploitable and impactful in your codebase, then helps engineers remediate fast. Instead of “find everything and hope someone sorts it out,” DryRun Security delivers code security intelligence that is ready to act on. DryRun Security puts a security engineer directly into developer workflows. In pull requests, the Code Review Agent reviews changes in context, explains risk in plain language, and guides fixes where developers already work. In repos, the DeepScan Agent produces focused, human-grade findings for the issues that actually matter, without weeks of manual review before major milestones. The Custom Policy Agent enforces guardrails with Natural Language Code Policies, so you can standardize security and compliance requirements across teams without brittle rule sets. Codebase Insights allows leaders to ask questions of their entire codebase like "Are we exposed to this new vulnerability" and have confidence in minutes. DryRun Security also integrates with AI coding workflows, so remediation happens with the precision of a security engineer working at machine speed. Teams connect DryRun Security insights and guidance into Claude, Cursor, OpenAI Codex, and Windsurf, helping developers and their agents fix issues with contextual, security-engineered direction tied to the PR and codebase. What DryRun Security delivers (beyond SAST) • Automated secure code review in every pull request with high-signal findings and low noise • Contextual Security Analysis that catches common vulnerabilities and deeper multi-dependency and logic risks • Automated remediation guidance that helps engineers fix faster, with explanations and next steps • Secrets analysis identifies genuine hardcoded secrets and suppresses the usual false alarms • Policy enforcement in PRs using Natural Language Code Policies for consistent guardrails across repos • Codebase intelligence and reporting for AppSec visibility, prioritization, and audit-ready evidence DryRun Security supports most code environments, languages, and frameworks, including: • GitHub, GitLab • C#, Golang, Elixir, JavaScript, TypeScript, Python, Ruby, Java, Kotlin, PHP, Swift, HTML • Infrastructure as Code (Terraform, YAML) • And more

Average Rating: 4.9/5.0

Total Reviews: 20

How Do G2 Users Rate DryRun Security?

  • Test Automation: 10.0/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 10.0/10 (Category avg: 9.1/10)
  • Quality of Support: 10.0/10 (Category avg: 9.2/10)

Who Is the Company Behind DryRun Security?

Who Uses This Product?

  • Top Industries: Computer & Network Security
  • Company Size: 40% Small, 30% Medium

What Do G2 Reviewers Say About DryRun Security?

AI-generated summary from verified user reviews

Pros
  • Users value the context-aware security feedback from DryRun Security, enhancing vulnerability mitigation during development in GitHub.
  • Users appreciate the quick and context-aware vulnerability detection of DryRun Security, enhancing security during the development process.
  • Users value the seamless integration and advanced detections of DryRun Security, enhancing code security and development efficiency.
  • Users value the accuracy of feedback from DryRun Security, effectively minimizing false positives and identifying complex vulnerabilities.
  • Users appreciate the easy setup of DryRun Security, enabling seamless integration and quick vulnerability detection.
Cons
  • Users find the slow performance of DryRun Security's management portal frustrating, impacting their overall experience.
  • Users experience slow speed issues with the management portal, impacting overall usability and efficiency.
  • Users note the sluggish UI of DryRun Security, which hampers the overall developer experience during use.
  • Users feel there are limited customization options for analyzers, though improvements may be forthcoming.
  • Users feel that there are workflow issues that hinder the developer experience and adoption of DryRun Security.

What Are Recent G2 Reviews of DryRun Security?

OpenText Static Application Security Testing

OpenText™ Static Application Security Testing (SAST) is a comprehensive solution designed to identify and remediate security vulnerabilities within an application's source code during the early stages of development. By analyzing code from the "inside out," SAST provides immediate feedback to developers, enabling them to address security issues promptly and effectively. Key Features and Functionality: - Extensive Language Support: Supports over 33 programming languages and more than 1,400 vulnerability categories, ensuring broad applicability across various development environments. - Integration with Development Tools: Seamlessly integrates with popular Integrated Development Environments (IDEs) such as Eclipse, Visual Studio, and JetBrains, as well as Continuous Integration/Continuous Deployment (CI/CD) tools like Jenkins and Bamboo, facilitating a smooth incorporation into existing workflows. - Scalable Deployment Options: Offers flexible deployment models, including on-premises, cloud-based, and Software as a Service (SaaS) solutions, allowing organizations to choose the setup that best fits their needs. - Advanced Analysis Capabilities: Utilizes multiple algorithms and an expansive knowledge base of secure coding rules to perform thorough code analysis, pinpointing the root causes of vulnerabilities and providing detailed remediation guidance. Primary Value and Problem Solved: OpenText SAST empowers organizations to proactively manage application security by detecting and addressing vulnerabilities early in the Software Development Life Cycle (SDLC). This proactive approach reduces the risk of security breaches, minimizes the cost and effort associated with late-stage remediation, and enhances the overall security posture of applications. By integrating security testing into the development process, OpenText SAST helps developers create more secure code, leading to robust and reliable software products.

Average Rating: 4.5/5.0

Total Reviews: 21

How Do G2 Users Rate OpenText Static Application Security Testing?

  • Test Automation: 8.7/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 8.5/10 (Category avg: 9.1/10)
  • Quality of Support: 8.7/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 7.0/10 (Category avg: 8.3/10)

Who Is the Company Behind OpenText Static Application Security Testing?

  • Seller: OpenText
  • Year Founded: 1991
  • HQ Location: Waterloo, ON
  • Twitter: @OpenText
    21,565 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    23,048 employees on LinkedIn®
  • Ownership: NASDAQ:OTEX

Who Uses This Product?

  • Top Industries: Financial Services, Banking
  • Company Size: 50% Large, 29% Small

What Do G2 Reviewers Say About OpenText Static Application Security Testing?

AI-generated summary from verified user reviews

Pros
  • Users value the easy integrations of OpenText Static Application Security Testing with various third-party tools for enhanced functionality.
  • Users value the extensive integration capabilities of OpenText Static Application Security Testing with various third-party tools.
  • Users value the integration support of OpenText Static Application Security Testing, enhancing compatibility with various tools and technologies.
Cons
  • Users find the false positives in OpenText Static Application Security Testing somewhat problematic, despite options to ignore them.

What Are Recent G2 Reviews of OpenText Static Application Security Testing?

What Are G2 Users Discussing About OpenText Static Application Security Testing?

Kiuwan Code Security & Insights

Fast, Flexible Code Security! Kiuwan is a robust, end-to-end application security platform that integrates seamlessly into your development process. Our toolset includes Static Application Security Testing (SAST), Software Composition Analysis (SCA), Software Governance and Code Quality, empowering your team to quickly identify and remediate vulnerabilities. By integrating seamlessly into your CI/CD pipeline, Kiuwan enables early detection and remediation of security issues. Kiuwan supports strict compliance with industry standards including OWASP, CWE, MISRA, NIST, PCI DSS, and CERT, among others. Top features: ✅ Extensive language support: Over 30 programming languages. ✅ Detailed action plans: Prioritize remediation with tailored action plans. ✅ Code Security: Seamless Static Application Security Testing (SAST) integration. ✅ Insights: On-demand or continuous scanning Software Composition Analysis (SCA) to help reduce third-party threats. ✅ One-click Software Bill of Materials (SBOM) generation. Kiuwan is now part of Sembi - a global portfolio of market-leading software brands focused on software quality, security, and developer productivity. Code Smarter. Secure Faster. Ship Sooner

Average Rating: 4.5/5.0

Total Reviews: 29

How Do G2 Users Rate Kiuwan Code Security & Insights?

  • Test Automation: 9.4/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 8.9/10 (Category avg: 9.1/10)
  • Quality of Support: 8.9/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 8.3/10 (Category avg: 8.3/10)

Who Is the Company Behind Kiuwan Code Security & Insights?

  • Seller: Sembi
  • Year Founded: 2023
  • HQ Location: Austin, US
  • LinkedIn® Page: www.linkedin.com
    94 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Information Technology and Services, Banking
  • Company Size: 41% Large, 35% Medium

What Do G2 Reviewers Say About Kiuwan Code Security & Insights?

AI-generated summary from verified user reviews

Pros
  • Users commend the accuracy of Kiuwan's code scans, ensuring reliable results and satisfaction with reporting capabilities.
  • Users value the accuracy of findings from Kiuwan Code Security & Insights, enhancing their confidence in code security.
  • Users appreciate the efficient customer support of Kiuwan, enhancing their overall experience and satisfaction with the product.
  • Users value the user-friendly interface of Kiuwan, enhancing their experience with efficient code scans and reporting.
  • Users appreciate the user-friendly interface of Kiuwan Code Security & Insights, making dashboard navigation easy and efficient.

What Are Recent G2 Reviews of Kiuwan Code Security & Insights?

Jit

Jit is redefining application security by introducing the first Agentic AppSec Platform, seamlessly blending human expertise with AI-driven automation. Designed for modern development teams, Jit empowers organizations to proactively manage security risks across the entire software development lifecycle.​ AI-Powered Agents Jit's AI Agents, such as SERA (Security Evaluation and Remediation Agent) and COTA (Communication, Ops, and Ticketing Agent), collaborate with your teams to automate vulnerability triage, risk assessment, and remediation processes, significantly reducing manual workloads. ​ Comprehensive Security Scanning Achieve full-stack security coverage with integrated scanners for SAST, DAST, SCA, IaC, CSPM, and more. Jit's platform ensures continuous monitoring and immediate feedback on code changes, facilitating rapid identification and resolution of security issues. ​ Developer-Centric Experience With integrations into popular IDEs and CI/CD pipelines, Jit provides developers with contextual security insights directly within their workflows, promoting a shift-left approach without disrupting productivity. ​ Agentic AI for AppSec Teams Risk-Based Prioritization Utilizing the Model Context Protocol (MCP), Jit evaluates vulnerabilities in the context of runtime environments, business impact, and compliance requirements, enabling teams to focus on the most critical risks. ​ Seamless Integrations Jit integrates with a wide array of tools, including GitHub, GitLab, AWS, Azure, GCP, Jira, Slack, and more, ensuring that security processes are embedded within your existing technology stack. ​

Average Rating: 4.5/5.0

Total Reviews: 43

How Do G2 Users Rate Jit?

  • Test Automation: 8.7/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 9.6/10 (Category avg: 9.1/10)
  • Quality of Support: 9.3/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 8.2/10 (Category avg: 8.3/10)

Who Is the Company Behind Jit?

  • Seller: jit
  • Year Founded: 2021
  • HQ Location: Boston, MA
  • Twitter: @jit_io
    522 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    150 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Computer Software, Financial Services
  • Company Size: 44% Medium, 42% Small

What Do G2 Reviewers Say About Jit?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the seamless integration of security into development workflows, highlighting efficiency and centralized management.
  • Users find Jit to be very easy to use, streamlining integration of security into development workflows effectively.
  • Users love the easy integrations of Jit, streamlining security within their development workflows effortlessly.
  • Users appreciate the efficiency of Jit, which reduces waste and streamlines processes, enhancing overall productivity.
  • Users value the automation of security controls in Jit, streamlining workflows and enhancing efficiency in development processes.
Cons
  • Users face integration issues with Jit, particularly in enterprise environments and with certain CI tools requiring extra setup.
  • Users find the limited features of Jit restrict complex setups and hinder comprehensive analytics and reporting.
  • Users feel the limited integration with enterprise environments restricts Jit's full potential and usability.
  • Users find the documentation lacking, particularly for advanced configurations, impacting their overall experience with Jit.
  • Users find the complexity of Jit challenging, particularly with advanced integrations and configuration for newcomers.

What Are Recent G2 Reviews of Jit?

Invicti (formerly Netsparker)

Invicti (formerly known as Netsparker) is an enterprise application and API security testing platform that helps organizations secure thousands of web applications and APIs at scale while dramatically reducing the risk of attack. Combining advanced DAST and IAST capabilities in a single platform, Invicti enables security teams to continuously identify, prioritize, and remediate vulnerabilities across complex modern environments with confidence and automation. With Invicti, security teams can: - Automate application security testing workflows and save hundreds of hours every month - Discover and secure all web applications and APIs, including forgotten, unmanaged, and shadow assets - Deliver actionable, developer-friendly feedback that helps teams remediate vulnerabilities faster and build more secure code over time - Reduce false positives with proof-based scanning technology that validates exploitable vulnerabilities - Scale application security programs across large enterprises without slowing development teams - Integrate security seamlessly into existing DevSecOps and CI/CD workflows Built for organizations with the most demanding security requirements, Invicti empowers teams to confidently secure their entire attack surface with accuracy, scalability, and automation.

Average Rating: 4.5/5.0

Total Reviews: 69

How Do G2 Users Rate Invicti (formerly Netsparker)?

  • Test Automation: 10.0/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 9.6/10 (Category avg: 9.1/10)
  • Quality of Support: 8.9/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 10.0/10 (Category avg: 8.3/10)

Who Is the Company Behind Invicti (formerly Netsparker)?

  • Seller: Invicti Security
  • Company Website:
  • Year Founded: 2018
  • HQ Location: Austin, Texas
  • Twitter: @InvictiSecurity
    2,557 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    335 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 46% Large, 29% Medium

What Do G2 Reviewers Say About Invicti (formerly Netsparker)?

AI-generated summary from verified user reviews

Pros
  • Users highlight the ease of use of Invicti, appreciating its user-friendly setup and quick installation process.
  • Users value the efficient scanning technology of Invicti, enhancing workflow with hassle-free monthly website tests.
  • Users commend Invicti's accurate vulnerability detection and excellent integration with DevOps tools, enhancing their security testing efficiency.
  • Users value the high-quality reporting of Invicti, making it ideal for certifications and simplifying compliance processes.
  • Users value the effective vulnerability detection of Invicti, appreciating its ease of use and accurate reporting.
Cons
  • Users find the customer support lacking, with slow responses and inadequate solutions for technical issues.
  • Users experience slow performance during scans, setup, and upgrades, impacting the overall efficiency of Invicti.
  • Users find that slow scanning can hinder efficiency, especially when setup is tricky and API scanning is limited.
  • Users face API issues with Invicti, making it unsuitable for scanning purposes despite good support.
  • Users find the complex setup challenging initially, impacting their experience before they can effectively utilize the product.

What Are Recent G2 Reviews of Invicti (formerly Netsparker)?

What Are G2 Users Discussing About Invicti (formerly Netsparker)?

Veracode Application Security Platform

Veracode helps companies that innovate through software deliver secure code on time. Unlike on-premise solutions that are hard to scale and focused on finding rather than fixing, Veracode comprises a unique combination of SaaS technology and on-demand expertise that enables DevSecOps through integration with your pipeline,empower developers to fix security defects, and scales your program through best practices to achieve your desired outcomes. Veracode covers your all your AppSec needs in one solution through a combination of five analysis types available for 24 programming languages, 77 frameworks, and application types as varied as microservices, mainframe and mobile apps.

Average Rating: 3.8/5.0

Total Reviews: 25

How Do G2 Users Rate Veracode Application Security Platform?

  • Test Automation: 9.2/10 (Category avg: 8.8/10)
  • Has the product been a good partner in doing business?: 7.9/10 (Category avg: 9.1/10)
  • Quality of Support: 8.0/10 (Category avg: 9.2/10)
  • Source-Code Scanning: 8.3/10 (Category avg: 8.3/10)

Who Is the Company Behind Veracode Application Security Platform?

  • Seller: VERACODE
  • Year Founded: 2006
  • HQ Location: Burlington, MA
  • Twitter: @Veracode
    21,950 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    500 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Information Technology and Services
  • Company Size: 69% Large, 31% Medium

What Do G2 Reviewers Say About Veracode Application Security Platform?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the comprehensive security analysis offered by Veracode, effectively addressing vulnerabilities and streamlining development.
  • Users value Veracode for its effective vulnerability detection, ensuring high-security standards and seamless integration into development processes.
  • Users appreciate the automated scanning feature of Veracode, which effectively identifies vulnerabilities and enhances security standards.
  • Users value the effective detection capabilities of Veracode, enabling thorough security checks and vulnerability identification.
  • Users value the ease of use of Veracode, benefiting from seamless integration and comprehensive security analysis.
Cons
  • Users find the platform to be expensive, with rising costs and unjustifiable investment in customer success packages.
  • Users face a lack of information regarding features and services, leading to confusion and unmet expectations.
  • Users express concerns about licensing issues, citing high costs, complex models, and unmet feature expectations.
  • Users report poor customer support, experiencing pressure from sales and challenges with feature delivery and documentation.
  • Users express concerns over pricing issues, citing increased costs, complex licensing, and pressure from sales executives.

What Are Recent G2 Reviews of Veracode Application Security Platform?

What Are G2 Users Discussing About Veracode Application Security Platform?

Lauren Worth
LW
Researched and written by Lauren Worth
Updated October 3, 2024