In our 28-criterion evaluation of static application security testing (SAST) providers, we identified the 12 most significant ones — CAST, Checkmarx, GitHub, GitLab, HCL Software, Micro Focus, Parasoft, Perforce Software, SonarSource, Synopsys, Veracode, and WhiteHat Security — and researched, analyzed, and scored them. This report shows how each provider measures up and helps security and risk professionals select the right one for their needs.