Best SAST Tools: Top 7 Solutions Compared

What Are Static Application Security Testing (SAST) Tools?

Static application security testing (SAST) tools automatically scan the source code of an application. The goal is to identify vulnerabilities before deployment. SAST tools perform white-box testing, which involves analyzing the code based on inside knowledge of the application.

SAST offers granularity in detecting vulnerabilities, providing an assessment down to the line of code. The are key benefits of SAST tools are: 

• Examine the codebase of an application in one test
• Test an application before compiling or running the code
• Identify vulnerabilities early in the software development life cycle (SDLC), which is when vulnerabilities are easiest and cheapest to fix

Here are key limitations of SAST tools:

• Cannot test applications that are already running in staging environments or in production. SAST tools can only analyze at-rest code. 
• Misses the broader security context, including security tools or integrated systems located externally to the codebase. 

Enterprises often use SAST tools in combination with software composition analysis (SCA tools), dynamic application security testing (DAST) and interactive application security testing (IAST) to extend testing scope.

In this article:

Top 7 Static Application Security Testing (SAST) Tools

Here are some of the leading SAST solutions on the market today, their key features, delivery model and entry level pricing. 

1. Mend.io

Mend SAST provides visibility to over 70 CWE types — including OWASP Top 10 and SANS 25 — in desktop, web and mobile applications developed on various platforms and frameworks. The unique thing about Mend SAST is how fast it is — typically 10 times faster than traditional SAST products, so your developers are never left waiting for results. Mend SAST integrates very easily with your existing DevOps environment and CI/CD pipeline, so developers don’t need to separately configure or trigger the scan.

Mend.io has pledged to bring its “remediation first” approach to Mend SAST by integrating the automated remediation capabilities of Mend Cure. Vulnerability alerts and remediation pull requests will be listed directly in developers’ normal workflow, providing a more efficient experience for developers than anything else on the market.  

Language support: 

• C#
• JAVA
• KOTLIN
• PHP
• PYTHON
• RUBY
• GO
• JAVASCRIPT / NODE.JS
• TYPESCRIPT
• GROOVY
• C/C++
• VB.NET
• VISUAL BASIC
• VBSCRIPT
• ASP CLASSIC
• IOS OBJECTIVE C
• SWIFT
• ANDROID JAVA
• COLDFUSION
• PLSQL
• COBOL
• ABAP
• SALESFORCE APEX
• ASP.NET
• JSP
• HTML/HTML5
• SQL
• XML
• XAMARIN

Delivery model: Cloud

Pricing:  Annual subscription based on the number of developers.

Learn more about Mend SAST

2. SonarQube

SonarQube community edition provides bug and vulnerability detection, code smell tracking, technical debt reviews and remediations, and code quality history and metrics. You can integrate SonarQube with CI/CD and extend its functionality further using more than 60 community plugins.

SonarQube can detect injection flaws and provides real-time IDE notifications. It can also add quality gate and pull request information to the Application Lifecycle Management (ALM) interface.

Language support: Supports 22 languages including C, C#, C++, ABAP, HTML, CSS, Flex, Kotlin, Objective-C, PL/SQL, PHP, Ruby, Swift, Scala, T-SQL, TypeScript, VB.Net, and XML. 

Delivery model: On-premises

Pricing: Community—free. Developers—from $150. 

3. Veracode

Veracode analyzes application source code and provides automated security feedback via the CI/CD pipeline and IDE. It provides software composition analysis (SCA), security management, audit trail, and reporting. 

Veracode offers a manual penetration testing system that allows professionals to analyze the results of security tests to minimize application risk, ensure regulatory compliance, and provide security posture reports. Veracode also enables employees to set security goals for Dev teams, configure risk mitigation workflows, and streamline policy management operations.

Veracode integrates with CI/CD tools including Apache Ant, Docker, Artifactory, Bugzilla, Bamboo, Gradle, Jira, Github, and more, and offers an API for further customization. 

Language support: Supports 30 languages including Java (Java SE, Java EE), JDK and OpenJDK, C# and .NET, ASP.NET, C++, JavaScript and TypeScript, PHP, and Scala

Delivery model: Cloud

Pricing: Not publicly available

4. Fortify Static Code Analyser

Fortify provides build tools, IDE security notifications, bug tracking, and code repository scanning. On the IDE side it integrates with Eclipse and Visual Studio, with gamified training to encourage developers to adopt secure coding practices. Fortify provides an Audit Assistant that reduces manual audit time by removing false positives with machine learning-assisted auditing.

Fortify supports broad vulnerability coverage, including 810 SAST vulnerability categories, aligning with vulnerability listings including OWASP Top 10, CWE/SANS Top 25, and DISA STIG. It enables security automation via Swagger-supported RESTful APIs, integrates with GitHub, and provides plugins for Bamboo, Visual Studio Team Services, and Jenkins.

Language support: Supports 27 languages including ABAP/BSP, ActionScript, ASP.NET, C# (.NET), C/C++, COBOL, Go, Java (including Android), JavaScript/AJAX, JSP, Kotlin, Objective C/C++, and PHP.

Delivery model: Cloud, on-premises, and hybrid

Pricing: Not publicly available

5. Codacy

Codacy provides insights about the code that go beyond security, including the current code quality of the project and its health over time. It can identify the code’s style and level of complexity, and visually display hotspots indicating quality issues across the codebase. Codacy provides inline annotations in the IDE, 1-click commit suggestions, and reporting that provides visibility into how developers comply with coding standards.

Codacy tightly integrates with GitHub and sends notifications via pull request comments or Slack. 

Language support: Supports over 40 languages and frameworks including Kubernetes, Go, Objective-C, Python, Sass, Terraform, Transact-SQL, Swift, and Powershell. 

Delivery model: Cloud and on-premises

Pricing: Open-source—free. Pro—$15 per user/mo. 

6. AppScan

AppScan performs vulnerability checks and generates a report that includes remediation suggestions. It provides a range of scanning technologies including SAST, DAST, IAST and Open Source dependency scanning. AppScan provides a “slider” feature that lets you apply the right mix of SAST and DAST to trade off speed vs. coverage. 

AppScan enables automation via APIs, or the codeless AppScan Automation Framework that lets you customize integrations to meet specific needs. It provides build-in integrations for popular CI/CD tools. 

Delivery model: On-premises and cloud.

Pricing: Not publicly available.

7. Checkmarx CxSAST

Checkmarx CxSAST is a static code analyzer that looks for source code errors and detects security and compliance issues, with no need to build or compile the code. CxSAST constructs a logical graph of the elements and flows of the code and queries this code graph using a list of hundreds of preconfigured queries to identify security vulnerabilities and business logic problems. You can use the CxSAST Auditor tool to configure custom queries for security and functional testing.

CxSAST generates scan results in the IDE (Visual Studio, Eclipse, and IntelliJ), either in an interactive dashboard or as static reports. In each subsequent scan, additional workflow metadata is added to provide context on remediation efforts. The tool’s Open Source Analysis (CxOSA) module enables vulnerability alerts, licensing and compliance management, policy enforcement, and reporting for open-source components. 

CxSAST integrates with CI/CD tools including Apache Ant and Maven, Git repositories, JIRA, GitHub, vulnerability management systems like ThreadFix, Bamboo and Jenkins, SonarQube, and source code management tools like TFS.

Language support: Supports over 18 languages including Java, C#, VB.NET, ASP, C/C++, PHP, Ruby, JavaScript, HTML5, PL/SQL, Groovy, and Scala.

Delivery model: Cloud, on-premises, and hybrid

Pricing: Not publicly available

Leading SAST Solutions Compared

What Makes a Great SAST Tool?

Supports Shift Left

The sooner that a coding flaw is discovered, the faster and easier it is for developers to fix the flaw. With this in mind, it is a best practice to shift security testing, which traditionally was done during the later stages of the software developer lifecycle (the “right” side of the process), to earlier stages of the SDLC (the “left” side of the process).  A great SAST tool is able to integrate with existing developer workflow and toolchains to support this shift-left philosophy.

Scans Entire Repositories

Organizations need to scan all existing code in their repositories. After an initial scan, it’s important to constantly monitor these repositories to identify any issues that might slip through. 

Integrates With The CI/CD Pipeline

Your CI/CD pipeline could break a build if it experiences security issues. SAST tools that integrate with this pipeline have the capability to immediately warn developers when they’re committing code with security issues, including details of the vulnerability and how to remediate it. They can then take the appropriate action.

Integrating the security tool in the CI/CD pipeline also helps minimize the possibility of an insider adding backdoors within your source code.

Scans Fast

Scanning speed is critical in fast-paced DevOps environments. Keep in mind that as soon as a SAST tool is in the critical path of your pipeline, slow scans will hurt developer productivity and may encourage developers to commit less frequently. Or, as frequently happens, developers will find ways to bypass the security tests.

SAST tools can speed up scanning by:

• Caching scanning results
• Running multiple tests in parallel using multiple threads
• Return results promptly

Minimizes False Positives

All security-minded teams struggle with false positives. Assessing a false positive wastes time and can also cause alert fatigue. Moreover, it can also distract security personnel, taking their attention away from genuine security issues. 

One way to detect false positives is to use a sample application where security issues are known. Scan the application using multiple tools, and choose the SAST tool that achieves the least false positives. This process will help you assess how well the tool works with rules and policies. Create a knowledge base of common false positives and share them with your developer teams.  

Promotes Developer Productivity

SAST tools should have a smooth learning curve for developers. Developers should see suggestions about code fixes and library updates alongside security risks. The tool should make it easy for developers to find additional information resources and connect with relevant security communities. 

Conclusion

In this article we introduced static application security testing and reviewed several leading tools that can help you identify and resolve security issues early in the development lifecycle. Finally, we provided a few key criteria you can use to evaluate the SAST tool of choice:

• Shift left—how well the tool integrates with developers’ existing workflow and supports security testing at the early stages of code development. 
• Scans entire repositories—the tool’s ability to scan all your code and identify issues in legacy code or existing open source components.
• CI/CD integrations—the tool’s support for the technologies in your CI/CD pipeline.
• Scan speed—when SAST becomes part of your build process, scanning speed becomes critical to developer productivity.
• False positives—techniques the tool uses to minimize false positives and assist in issue prioritization.
• Developer productivity—a great SAST tool is one that developers love to work with and can use in their day-to-day activities to minimize security risks.

In summary, SAST is a great addition to your security stack and a key component of DevSecOps strategies. Of course, SAST is not enough to ensure application security, and should be combined with supporting tools such as software composition analysis (SCA), dynamic application security testing (DAST), vulnerability scanning, and container security. 

This article is based on information which is publicly available as of the date of publication and is not intended to represent an independent third-party comparison.

Meet The Author

Adam Murray

Adam Murray is a content writer at Mend. He began his career in corporate communications and PR, in London and New York, before moving to Tel Aviv. He’s spent the last ten years working with tech companies like Amdocs, Gilat Satellite Systems, Allot Communications, and Sisense. He holds a Ph.D. in English Literature. When he’s not spending time with his wife and son, he’s preoccupied with his beloved football team, Tottenham Hotspur.