Best SAST Tools: Top 7 Solutions Compared
Table of Contents
What are static application security testing (SAST) tools?
SAST tools automatically scan the source code of an application. The goal is to identify vulnerabilities before deployment. SAST tools perform white-box testing, which involves analyzing the code based on inside knowledge of the application.
SAST offers granularity in detecting vulnerabilities, providing an assessment down to the line of code. The are key benefits of SAST tools are:
- Examine the codebase of an application in one test
- Test an application before compiling or running the code
- Identify vulnerabilities early in the software development life cycle (SDLC), which is when vulnerabilities are easiest and cheapest to fix
Here are key limitations of SAST tools:
- Cannot test applications that are already running in staging environments or in production. SAST tools can only analyze at-rest code.
- Misses the broader security context, including security tools or integrated systems located externally to the codebase.
Enterprises often use SAST tools in combination with software composition analysis (SCA tools), dynamic application security testing (DAST) and interactive application security testing (IAST) to extend testing scope.
Top 7 static application security testing (SAST) tools
Here are some of the leading SAST solutions on the market today, their key features, delivery model and entry level pricing.
1. Mend.io
Mend SAST provides visibility to over 70 CWE types — including OWASP Top 10 and SANS 25 — in desktop, web and mobile applications developed on various platforms and frameworks. The unique thing about Mend SAST is how fast it is — typically 10 times faster than traditional SAST products, so your developers are never left waiting for results. Mend SAST integrates very easily with your existing DevOps environment and CI/CD pipeline, so developers don’t need to separately configure or trigger the scan.
Mend.io has pledged to bring its “remediation first” approach to Mend SAST by integrating the automated remediation capabilities of Mend Cure. Vulnerability alerts and remediation pull requests will be listed directly in developers’ normal workflow, providing a more efficient experience for developers than anything else on the market.
Language support:
- C#
- JAVA
- KOTLIN
- PHP
- PYTHON
- RUBY
- GO
- JAVASCRIPT / NODE.JS
- TYPESCRIPT
- GROOVY
- C/C++
- VB.NET
- VISUAL BASIC
- VBSCRIPT
- ASP CLASSIC
- IOS OBJECTIVE C
- SWIFT
- ANDROID JAVA
- COLDFUSION
- PLSQL
- COBOL
- ABAP
- SALESFORCE APEX
- ASP.NET
- JSP
- HTML/HTML5
- SQL
- XML
- XAMARIN
Delivery model: Cloud
Pricing: Annual subscription based on the number of developers.
Learn more about Mend SAST
2. SonarQube
SonarQube community edition provides bug and vulnerability detection, code smell tracking, technical debt reviews and remediations, and code quality history and metrics. You can integrate SonarQube with CI/CD and extend its functionality further using more than 60 community plugins.
SonarQube can detect injection flaws and provides real-time IDE notifications. It can also add quality gate and pull request information to the Application Lifecycle Management (ALM) interface.
Language support: Supports 22 languages including C, C#, C++, ABAP, HTML, CSS, Flex, Kotlin, Objective-C, PL/SQL, PHP, Ruby, Swift, Scala, T-SQL, TypeScript, VB.Net, and XML.
Delivery model: On-premises
Pricing: Community—free. Developers—from $150.
3. Veracode
Veracode analyzes application source code and provides automated security feedback via the CI/CD pipeline and IDE. It provides software composition analysis (SCA), security management, audit trail, and reporting.
Veracode offers a manual penetration testing system that allows professionals to analyze the results of security tests to minimize application risk, ensure regulatory compliance, and provide security posture reports. Veracode also enables employees to set security goals for Dev teams, configure risk mitigation workflows, and streamline policy management operations.
Veracode integrates with CI/CD tools including Apache Ant, Docker, Artifactory, Bugzilla, Bamboo, Gradle, Jira, Github, and more, and offers an API for further customization.
Language support: Supports 30 languages including Java (Java SE, Java EE), JDK and OpenJDK, C# and .NET, ASP.NET, C++, JavaScript and TypeScript, PHP, and Scala
Delivery model: Cloud
Pricing: Not publicly available
4. Fortify Static Code Analyser
Fortify provides build tools, IDE security notifications, bug tracking, and code repository scanning. On the IDE side it integrates with Eclipse and Visual Studio, with gamified training to encourage developers to adopt secure coding practices. Fortify provides an Audit Assistant that reduces manual audit time by removing false positives with machine learning-assisted auditing.
Fortify supports broad vulnerability coverage, including 810 SAST vulnerability categories, aligning with vulnerability listings including OWASP Top 10, CWE/SANS Top 25, and DISA STIG. It enables security automation via Swagger-supported RESTful APIs, integrates with GitHub, and provides plugins for Bamboo, Visual Studio Team Services, and Jenkins.
Language support: Supports 27 languages including ABAP/BSP, ActionScript, ASP.NET, C# (.NET), C/C++, COBOL, Go, Java (including Android), JavaScript/AJAX, JSP, Kotlin, Objective C/C++, and PHP.
Delivery model: Cloud, on-premises, and hybrid
Pricing: Not publicly available
5. Codacy
Codacy provides insights about the code that go beyond security, including the current code quality of the project and its health over time. It can identify the code’s style and level of complexity, and visually display hotspots indicating quality issues across the codebase. Codacy provides inline annotations in the IDE, 1-click commit suggestions, and reporting that provides visibility into how developers comply with coding standards.
Codacy tightly integrates with GitHub and sends notifications via pull request comments or Slack.
Language support: Supports over 40 languages and frameworks including Kubernetes, Go, Objective-C, Python, Sass, Terraform, Transact-SQL, Swift, and Powershell.
Delivery model: Cloud and on-premises
Pricing: Open-source—free. Pro—$15 per user/mo.
6. AppScan
AppScan performs vulnerability checks and generates a report that includes remediation suggestions. It provides a range of scanning technologies including SAST, DAST, IAST and Open Source dependency scanning. AppScan provides a “slider” feature that lets you apply the right mix of SAST and DAST to trade off speed vs. coverage.
AppScan enables automation via APIs, or the codeless AppScan Automation Framework that lets you customize integrations to meet specific needs. It provides build-in integrations for popular CI/CD tools.
Delivery model: On-premises and cloud.
Pricing: Not publicly available.
7. Checkmarx CxSAST
Checkmarx CxSAST is a static code analyzer that looks for source code errors and detects security and compliance issues, with no need to build or compile the code. CxSAST constructs a logical graph of the elements and flows of the code and queries this code graph using a list of hundreds of preconfigured queries to identify security vulnerabilities and business logic problems. You can use the CxSAST Auditor tool to configure custom queries for security and functional testing.
CxSAST generates scan results in the IDE (Visual Studio, Eclipse, and IntelliJ), either in an interactive dashboard or as static reports. In each subsequent scan, additional workflow metadata is added to provide context on remediation efforts. The tool’s Open Source Analysis (CxOSA) module enables vulnerability alerts, licensing and compliance management, policy enforcement, and reporting for open-source components.
CxSAST integrates with CI/CD tools including Apache Ant and Maven, Git repositories, JIRA, GitHub, vulnerability management systems like ThreadFix, Bamboo and Jenkins, SonarQube, and source code management tools like TFS.
Language support: Supports over 18 languages including Java, C#, VB.NET, ASP, C/C++, PHP, Ruby, JavaScript, HTML5, PL/SQL, Groovy, and Scala.
Delivery model: Cloud, on-premises, and hybrid
Pricing: Not publicly available
Leading SAST solutions compared
| Product name | Main Features | Pricing Model |
| Mend SAST | Static code analysis, integrates with build systems, issue tracking systems, version control systems, and CI/CD pipelines. Speed of results is 10x faster than traditional SAST while maintaining high accuracy. | Annual subscription based on number of developers. |
| SonarQube | Static code analysis, detecting vulnerabilities and code quality issues, tracking code smells and technical debt, integrates with CI/CD, 50+ community plugins. | Free Community Version |
| Veracode Static Analysis | Static analysis in developer IDE, notifying developers about code quality, promotes secure coding. | Not publicly available |
| Fortify Static Code Analyser | Integrates with IDE and CI/CD tools, provides security assistant that helps identify and prioritize vulnerabilities, offers scanning infrastructure for build server, supports on-premise, cloud, and hybrid deployment. | Not publicly available |
| Codacy | Performs static analysis on commit and pull requests from repos like GitHub, BitBucket, and Gitlab and adds comments automatically. Tracks security, code style, errors, and performance issues. Integrates with collaboration tools. | Monthly subscription |
| AppScan | Integrates with build environments, IDEs and DevOps tooling, performs SAST, DAST and IAST for broad testing coverage. | Not publicly available |
| Checkmarx CxSAST | Performs static code analysis and software composition analysis on custom code and open source components. Enables custom policies to support your IT workflows. | Not publicly available |
What makes a great SAST tool?
Supports shift left
The sooner that a coding flaw is discovered, the faster and easier it is for developers to fix the flaw. With this in mind, it is a best practice to shift security testing, which traditionally was done during the later stages of the software developer lifecycle (the “right” side of the process), to earlier stages of the SDLC (the “left” side of the process). A great SAST tool is able to integrate with existing developer workflow and toolchains to support this shift-left philosophy.
Scans entire repositories
Organizations need to scan all existing code in their repositories. After an initial scan, it’s important to constantly monitor these repositories to identify any issues that might slip through.
Integrates with the CI/CD pipeline
Your CI/CD pipeline could break a build if it experiences security issues. SAST tools that integrate with this pipeline have the capability to immediately warn developers when they’re committing code with security issues, including details of the vulnerability and how to remediate it. They can then take the appropriate action.
Integrating the security tool in the CI/CD pipeline also helps minimize the possibility of an insider adding backdoors within your source code.
Scans fast
Scanning speed is critical in fast-paced DevOps environments. Keep in mind that as soon as a SAST tool is in the critical path of your pipeline, slow scans will hurt developer productivity and may encourage developers to commit less frequently. Or, as frequently happens, developers will find ways to bypass the security tests.
SAST tools can speed up scanning by:
- Caching scanning results
- Running multiple tests in parallel using multiple threads
- Return results promptly
Minimizes false positives
All security-minded teams struggle with false positives. Assessing a false positive wastes time and can also cause alert fatigue. Moreover, it can also distract security personnel, taking their attention away from genuine security issues.
One way to detect false positives is to use a sample application where security issues are known. Scan the application using multiple tools, and choose the SAST tool that achieves the least false positives. This process will help you assess how well the tool works with rules and policies. Create a knowledge base of common false positives and share them with your developer teams.
Promotes developer productivity
SAST tools should have a smooth learning curve for developers. Developers should see suggestions about code fixes and library updates alongside security risks. The tool should make it easy for developers to find additional information resources and connect with relevant security communities.
Conclusion
In this article we introduced static application security testing and reviewed several leading tools that can help you identify and resolve security issues early in the development lifecycle. Finally, we provided a few key criteria you can use to evaluate the SAST tool of choice:
- Shift left—how well the tool integrates with developers’ existing workflow and supports security testing at the early stages of code development.
- Scans entire repositories—the tool’s ability to scan all your code and identify issues in legacy code or existing open source components.
- CI/CD integrations—the tool’s support for the technologies in your CI/CD pipeline.
- Scan speed—when SAST becomes part of your build process, scanning speed becomes critical to developer productivity.
- False positives—techniques the tool uses to minimize false positives and assist in issue prioritization.
- Developer productivity—a great SAST tool is one that developers love to work with and can use in their day-to-day activities to minimize security risks.
In summary, SAST is a great addition to your security stack and a key component of DevSecOps strategies. Of course, SAST is not enough to ensure application security, and should be combined with supporting tools such as software composition analysis (SCA), dynamic application security testing (DAST), vulnerability scanning, and container security.
*This article is based on information which is publicly available as of the date of publication and is not intended to represent an independent third-party comparison.
