CMDashCybersecurity Maturity Dashboard

← All landscape areas

Application Security · Core

SAST / DAST / IAST

Finds vulnerabilities in application code.

9 options listedTypical cost: $15k-$150k/yrIDENTIFY (ID) / PROTECT (PR)

Overview

Static (SAST), dynamic (DAST), and interactive (IAST) testing surface security flaws across source, running apps, and runtime. They shift security left into developer workflows and CI/CD. Pricing is per developer/seat or per application. Noise reduction and IDE/pipeline integration are key differentiators.

Core if you build software: catch app flaws before release.

Advantages

Snyk dev-friendly and IDE-native
Veracode strong on accuracy and compliance
shifts security left
Semgrep/OWASP ZAP free.

Trade-offs

False-positive noise (especially SAST)
per-developer seat costs scale
scan time in CI
needs developer buy-in to remediate.

Vendors & tools in this area

VeracodeCommercial

Cloud SAST/DAST; compliance focus, low false positives.

CheckmarxCommercial

Enterprise SAST/AppSec platform.

SnykCommercial

Developer-first SAST/SCA/IaC; IDE + CI native.

Black Duck (Synopsys)Commercial

SCA + SBOM + license risk (ex-Synopsys).

HCL AppScanCommercial

Enterprise DAST/SAST.

SemgrepOpen source

Fast open SAST / static analysis.

OWASP ZAPOpen source

Open DAST web scanner.

BanditOpen source

Python SAST.

Contrast SecurityCommercial

IAST/RASP market leader — the area's only true interactive testing tool; instruments running code instead of scanning source.

Start free trial Browse the full atlas

SAST / DAST / IAST — Cybersecurity Landscape Atlas — CMDash