The barrier to entering the SAST solutions market has never been lower. New vendors can leverage LLMs and free open-source SAST scanners (which are improving in accuracy and depth) to develop an AI-powered SAST minimum viable product that was not possible two years ago. Additionally, the SAST landscape is crowded with existing players such as DevOps platforms, cloud-native application protection platform solutions, ASPM solutions, and AI-powered startups.

To learn more about how SAST functionalities map to the top use cases, the seven additional/extended use cases, and the 22 vendors in this category, check out The Static Application Security Testing Landscape, Q2 2023. Please schedule an inquiry with me if you’d like to understand more about SAST best practices and the SAST vendor landscape.

Several customers noted that internal and external auditors want to see not just proof of SAST scans but also scan coverage and results. Additionally, SAST solution buyers have customers of their own that are trying to meet compliance requirements. Being able to show their end customers that they were using a well-respected SAST solution as part of a secure software development lifecycle helped to win deals. Robust and flexible reporting and analytics.

SAST solutions must continually evolve to stay in line with new application development languages and technologies. SAST tools currently support or have plans to support Rust (a memory safe replacement of C/C++), Dart (for cross-platform support), and Solidity (for smart contracts). Programming frameworks for AI development, such as LangChain, PyTorch, Spring AI, or TensorFlow, are slowly emerging on SAST roadmaps.

Recently, vendors from other markets have started seeing SAST as an adjacent market. Cloud native application protection platform (CNAPP) vendors have been “shifting left” and bring production context to the table. Application security posture management (ASPM) vendors aggregate data across different test methods and can provide SAST functionality.

Vendors often package the SCA software product with other application security offerings, like application security testing vendors that offer SCA and SAST together. The complexity of the scan means that SAST tends to be more expensive and drive the overall cost. Development platforms that offer security tools have multiple tiers for the development products with security bundled in or as an add-on.

ASTPs emphasize proactive measures, bringing together different types of security testing using SAST, DAST, SCA, IaC scanning, and container scanning technologies, to identify and remediate vulnerabilities during development through vendors such as Checkmarx and Snyk.

SAST, DAST, SCA, secrets detection, and scanning of IaC, containers, build systems, and CI/CD pipelines collectively identify and detect security flaws in application code, runtime behavior, and dependencies as well as exposed secrets and misconfigurations across the software supply chain and delivery infrastructure. This forms the baseline layer of security coverage.

Mend.io Mend.io is an application security provider for SCA, SAST, container image and Kubernetes cluster scanning, IaC, and AI component scanning. Strategy. Mend.io’s new pricing strategy is a strength: It offers one price for all products and services, including SCA, dependency updates, SAST, container security, and AI security, and it reflects the vision that customers need a holistic view of the application stack.

Other tools like web application firewall (WAF), static application security testing (SAST), and cloud-native application protection platform (CNAPP) also offer aspects of API discovery (see Figure 2). Remember to include B2B and internal APIs in your discovery and inventory efforts, too. “We should understand the fields within APIs and work with our business stakeholders to bring down the attack surface.”