Report:

Magic Quadrant for Application Security Testing

Top Vendor Products for Application Security Testing in 2023

• Checkmarx
• OpenText
• Snyk
• Synopsys
• Veracode

Application Security Testing Vendor Product Comparisons 2023

• Checkmarx - Leader
  

  Pros:

  • Repository integration: Checkmarx Fusion, its correlation and prioritization engine, can now correlate all of its findings at repository level and integrate them into the console, giving developers insights into their applications.
  • Developer integration: Checkmarx is focused on developer integration throughout the life cycle. Its recent launch of DevHub addresses developers' needs by providing them with complete information about open-source vulnerabilities, along with suggestions for remediation.
  • DAST tooling: Checkmarx has introduced a new DAST capability. This was previously a significant gap in its product, although it still provides DAST through Invicti as an OEM.

  Cons:

  • Complex pricing: Customers have cited Checkmarx's pricing as a challenge, which is a common concern across many AST vendors. However, Checkmarx has worked toward providing lower-cost products, such as the recently introduced "Developer Edition" of its platform, which is intended to meet both developers' needs and application security requirements.
  • Set-up and configuration: Customers have cited that, despite Checkmarx's flexibility, its implementation can be complicated due to its high level of configurability.
  • Weekend customer support: Customers have remarked on a lack of availability of customer support at weekends as a relatively common issue. However, weekend support is available in Premium support package.


• Contrast Security - Visionary
  

  Pros:

  • Runtime application self-protection: Gartner is increasingly seeing renewed interest in RASP (see the Context section of this research) as development organizations are becoming increasingly cloud-focused. Contrast's experience in the IAST/RASP space puts it in a good position to take advantage of this trend.
  • Interactive application security testing: Contrast Assess is one of the most broadly adopted IAST solutions, and continues to compete on nearly every IAST shortlist reviewed by Gartner. As IAST solutions gain popularity with cloud-native clients, Contrast's developer experience stands out and gets good reviews for ease of use and accuracy.
  • Developer support: Contrast offers a free version of CodeSec (developer enablement), along with GitHub Actions for Scan and SCA to streamline developer adoption.

  Cons:

  • Partners for some functions: Contrast Security does not provide DAST, ASOC or mobile testing. While it does have partner agreements to offer these capabilities, it should be noted that partner agreements can change unexpectedly, and the burden of adding these tools is firmly on the client.
  • SAST language support: Contrast Security's SAST supports relatively few languages compared with competitors. However, it has begun to partner with other companies (e.g., Kiuwan) to leverage its partners' extensive language support library, which should significantly expand its coverage. This doesn't apply to IAST language support, which is fairly broad.
  • Customer support: Contrast Security offers 24/7 global customer support options. However, language support is relatively limited compared to other vendors. It covers North America, the U.K., the EU and Japan, and supports the English, German, French and Japanese languages.


• GitHub - Challenger
  

  Pros:

  • Developer enablement: GitHub's ownership of source code management and CI/CD tools positions it well to tightly integrate security into development workflows (e.g., dependency review), which can improve the developer experience and shift left application security practices.
  • Open-source community: GitHub's popularity as the largest open-source code repository helps open-source developers to access GHAS capabilities and provide feedback. The feedback loop from the community helps GitHub to continually improve its AST capabilities.
  • npm package scanning: GitHub owns the public npm registry, which is the largest collection of open-source JavaScript packages. It has dedicated teams for threat hunting and malware detection to continuously scan npm packages. GitHub Advisory Database includes over 10,000 GitHub-reviewed CVEs and security advisories, over 2,800 of which are specific to npm. This intelligence feeds into Dependabot alerts, dependency reviews and a dependency graph.

  Cons:

  • Mobile support: GitHub does not offer proprietary MAST capabilities, and relies on partner integrations with NowSecure and open-source tool/framework Mobile Security Framework (MobSF). At the time of writing, CodeQL's support for Swift (iOS) is in private beta, while its support for Kotlin (Android) is in public beta on GHEC.
  • Outer development loop: GitHub's product innovation lags behind other leading providers in securing the outer development loop, where it relies on third-party integrations. Examples of affected areas include DAST, IAST, fuzz testing, IaC scanning, API security and container security.
  • Release cadence mismatch between SaaS and on-premises: GitHub customers may see feature disparity between GitHub Enterprise Cloud and GitHub Enterprise Server. Being on GHEC enables customers to receive fixes and features sooner.


• GitLab - Challenger
  

  Pros:

  • Single DevSecOps platform across the SDLC: GitLab takes a single application approach to integrate security into multiple phases of the DevOps life cycle. This enables shared visibility and reduces the cognitive load, making it easier for teams to adopt AST practices.
  • Software supply chain security: GitLab has full visibility and traceability into the software delivery pipeline, from code commit to applications running in production. Recognizing the advantage this provides in securing the software supply chain, GitLab has introduced support for SBOM generation (CycloneDX), build artifact attestation and verified code commits with SSH keys to better align with the SLSA framework.
  • Integrated DAST and fuzzing: GitLab's browser-based DAST is a fundamental shift from the previous OWASP ZAP-based DAST capabilities. The technique uses a browser, rather than a proxy, to scan web applications for vulnerabilities, which is more reliable for modern web applications. GitLab is the only DevOps platform with a natively inbuilt fuzz testing capability.

  Cons:

  • IDE integrations: GitLab's SAST and SCA capabilities currently lack IDE integrations to help surface vulnerabilities or provide developers with exact code suggestions in first- and third-party code within the IDE outside the CI pipeline.
  • Advanced SCA use cases: GitLab does not currently support binary scanning of dependencies, dependency visualization or verification of the provenance of upstream dependencies.
  • AST capabilities split across platform editions: Although GitLab's Free, Premium and Ultimate editions share aspects of security capabilities, most enterprises will need to invest in the Ultimate edition to meet their security and compliance requirements. For example, some aspects of container scanning are available across all tiers, while scanning containers deployed in clusters is limited to Ultimate. Likewise, SAST analyzers are included in the GitLab Free edition, but you would need the Ultimate edition to customize the SAST rulesets.


• HCLSoftware - Challenger
  

  Pros:

  • Unified user experience: HCL AppScan provides comprehensive coverage of various application security testing techniques in one consolidated platform, with unified user experiences (UX) and visibility of multiple stages of the SDLC.
  • Machine learning: HCL AppScan uses mature machine learning (ML) and natural language processing techniques to enhance accuracy and reduce false positives in its findings. The Intelligent Findings Analytics (IFA) and Intelligent Code Analytics (ICA) features improve the security analysis process by grouping findings and investigating new and unknown APIs.
  • Role-based views: HCL AppScan provides tailored views and experiences to different roles. Scan profiling is flexible to implement, and enables the user to apply different AST technologies at different points along the software development pipeline. Workflows can be customized to match an organization's specific security policies and priorities.

  Cons:

  • On-premises tooling: All products are available as on-premises, SaaS, IaaS and managed services, except for SCA, which is only available as SaaS and managed services. The on-premises SAST does not have the same breadth of out-of-the-box plug-ins and integrations.
  • Longer scan times: Some customers have encountered long scanning times, especially for large web applications. While AppScan has an impressive variety of controls that allow the user to tune the speed of execution, which seems to be somewhat confusing and will take time for users to understand the options and trade-offs. This can lead to the perception of longer scan times.
  • Pricing and support: The pricing of HCLSoftware's AST platform is cited by some customers as a concern, especially for organizations with limited budgets or smaller development teams. Customer support services in some regions may not be as comprehensive as expected.


• Mend.io - Visionary
  

  Pros:

  • SCA and supply chain security: The company's SCA product is a comprehensive solution for the assessment of both open-source and container images and works with package managers to block and detect malicious code. Mend.io Supply Chain Defender works with package managers to detect malicious code. Mend.io SCA both imports and exports SBOMs in either CycloneDX or SPDX formats. Imported SBOMs can be analyzed for security issues or violations of organizational policies.
  • Automated remediation: Mend.io offers a variety of approaches to assist with automated remediation. Renovate, available as an open-source project, automatically generates pull requests with upgrade information when a new version of a dependency becomes available. Tools support a Merge Confidence feature for open-source upgrades, providing guidance on the probability that the upgrade will introduce a breaking change. Mend.io SAST automatically generates a proposed fix for Java programs that developers can apply as a pull request.
  • Risk-based reporting: The product enables users to incorporate business impacts and risk indicators to be used as factors in the prioritization and triage of vulnerabilities. Examples include the nature of the application's attack surface, the presence of sensitive data, etc. For open-source issues, the tool reports data including (but not limited to) vulnerability severity, reachability and the presence of known exploits.

  Cons:

  • Product scope: Mend.io does not offer either a DAST or IAST capability. This will limit the product's appeal among organizations using a significant number of applications that benefit from such tests. Mend.io also offers no dedicated API security or mobile application testing capability, although the SAST engine can analyze common mobile programming languages, such as Swift and Kotlin.
  • Maturity: Mend.io has broadened its application security product portfolio and only recently introduced its SAST solution in 2022.
  • Limited IaC functionality: Scanning for misconfigurations that may adversely impact security is supported for multiple IaC formats. However, the tool lacks support for secrets detection and is unable to detect configuration drift in production environments.


• Onapsis - Niche Player
  

  Pros:

  • Support for business-critical frameworks: Onapsis is one of very few vendors that supports the full range of languages used in SAP systems, including Git-style repositories, ABAP/HANA repositories and SAP BTP Neo/CloudFoundry environments.
  • Risk analytics: Going beyond the severity of a vulnerability, Onapsis frames its findings in terms of risk to the business, providing an approachable explanation of the business risk, examples and, where possible, automated quick fixes.
  • Microsoft Azure support: Enterprises that leverage Azure Pipelines to streamline the deployment process for SAP Ecosystem can now add Onapsis Control scans to their existing development process, adding security to the DevOps life cycle.

  Cons:

  • 18/5 support: Onapsis does not offer 24/7 worldwide support. However, it does offer 18/5 support (2 a.m. to 8 p.m. U.S. Eastern, Mondays through Fridays). Onapsis claims a 90 min response time for critical S1 issues, but this could be a concern for larger multinational organizations operating across multiple time zones.
  • Nontraditional IAST: Compared to other vendors, Onapsis' IAST offering looks different, but its conceptually similar offering is designed for and operates within the context of the specific frameworks it supports. Its tests are built into the runtime, and checks are executed during code execution using a specialized JavaScript runtime.
  • Few AST partnerships: Onapsis does not have many partnerships with traditional AST vendors (or cross-vendor correlations of results and suggestions). However, in clouds like Azure, these services can be available from other vendors on an ad hoc basis.


• OpenText - Leader
  

  Pros:

  • SCA and SSCS investments: Fortify has made significant strides in the SCA and supply chain security segments via its acquisition of Debricked and the expansion and extension of a long-standing OEM relationship with Sonatype. A notable example is the introduction of Open Source Select, which provides easily digestible guidance on the risks associated with open-source software prior to its selection and use.
  • Machine learning: OpenText has employed ML technologies to offer new capabilities and improve existing ones. The Open Source Select offering is powered in part by ML. Fortify has also leveraged OpenText's analytics capabilities to significantly improve false positive detection among test findings, addressing a long-standing complaint about the product.
  • Flexible deployment: The scope of the company's product portfolio ranks among the broadest in the industry, and is supported by multiple deployment options. These include traditional on-premises packages, SaaS offerings and options for private cloud and managed services installations.

  Cons:

  • Acquisition: OpenText's acquisition of Micro Focus introduces a number of routine concerns regarding the stability of product roadmaps, support and other operations. Clients are encouraged to take precautions to minimize the impact of any disruptions.
  • User experience: Fortify's product portfolio has expanded significantly over several years. While beneficial, additions have not always followed a consistent UX theme. Product managers have expanded integrations to help provide developers with an interface consistent with their existing tools. The company is in the process of launching an updated Audit Assistant, and expanded reporting, promising an improved experience for security- and management-focused users.
  • Pricing: Its longevity in the market, combined with a broad array of deployment options, have led to OpenText having one of the more complex pricing models in the market. While this does offer increased flexibility, it can complicate negotiations as buyers seek the optimal licensing approach for their specific needs.


• Snyk - Leader
  

  Pros:

  • Cloud-native support: Snyk has strong cloud-native application security capabilities, including the ability to provide a comprehensive application context, scan cloud infrastructure and container images across different cloud environments and guide developers to fix issues.
  • Developer support: Snyk's products are designed to integrate with development workflows, enabling developers to easily adopt the platform and design in better security practices. The platform orchestrates the execution of multiple products on automated schedules and push-based events.
  • SCA vulnerability database: Snyk has a comprehensive database of vulnerabilities, which is regularly updated to provide the most accurate and up-to-date information on security threats. It also offers automated scanning and remediation of security vulnerabilities for applications, IaC and containers.

  Cons:

  • Go-to-market partnerships: Snyk's AST offering does not include inbuilt DAST (which Snyk provides in partnership with Rapid7 and StackHawk), IAST or fuzzing. It is important for clients to be aware of Snyk's partnership status to avoid any potential disruptions in service.
  • Limited reporting customization: Some users have noted that the platform's customization options are limited. Despite the new UI and reporting functions, reporting is still cited as a weak point by some customers, especially when customers have many projects or specific needs for customized metrics.
  • Alert frequency: Clients have reported that Snyk's platform may generate a large number of alerts, which can be overwhelming for some users, particularly in large or complex environments. This would require users to spend additional time and resources reviewing and addressing the alerts.


• Sonatype - Niche Player
  

  Pros:

  • Strong SCA history: Sonatype has a long history of working with OSS security and SCA. It has an experienced team of researchers that has identified and remanded vulnerable OSS code for more than a decade.
  • Default blocking: Sonatype Firewall Release Integrity uses ML systems to identify suspicious and malicious components and block them by default. This can be a handy feature, especially for organizations new to (or just developing) a secure SDLC.
  • Legal aid: Sonatype's Advanced Legal Pack is designed to reduce complications between development and legal departments. It can automatically comply with open-source licensing obligations (e.g., attributions, attestations), provides extensive legal data to legal reviewers, and its workflows create a bridge between legal and development.

  Cons:

  • New product: Sonatype is new to the SAST space and, while its offering seems competitive, Lift has not had the level of real-world exposure to customers typical of vendors in this Magic Quadrant.
  • Limited tools: Sonatype does not support DAST or IAST, nor does it have partnerships or joint go-to-market agreements with other vendors to provide these functionalities.
  • Price: In a market already saturated with SAST and SCA tools, it may be difficult for a new company to be competitive among established platform players.


• Synopsys - Leader
  

  Pros:

  • Polaris upgrade: Synopsys has introduced a new version of Polaris, which can now provide SAST and SCA capabilities as an integrated SaaS solution, complementing their on-premises product and IDE plug-in to cover broad deployment needs.
  • Partner integration: In order to tighten its integration into DevOps toolchains, Synopsys has expanded its support for developer tools like GitHub, GitLab and Artifactory. Security scans can now be triggered by pull requests or GitHub Action workflows, with results published back to the developer directly in GitHub.
  • ASOC: Synopsys' 2021 purchase of CodeDx, an ASOC tool, has been integrated into the product suite. CodeDx handles much of the data analysis and orchestration between the tools in the platform.

  Cons:

  • Pricing: Synopsys' pricing is considered extremely complicated by customers, especially small and midsize companies, and has come up as an issue in pricing reviews.
  • Complex UI: The UI is still cited as a weak point in Gartner Peer Insights. The most common feedback is that it is complex to use, and sometimes confusing for some kinds of scanning. However, some organizations have been using it more effectively in "headless" mode.
  • SaaS delivery: SaaS and hybrid delivery (a mix of SaaS and on-premises) are still lacking for Coverity, SBOM generation and ASPM. All other tools are available as SaaS and/or managed services.


• Veracode - Leader
  

  Pros:

  • EU/U.K. support: Veracode now offers dedicated support for the European region, which currently provides static analysis and SCA capabilities. This could be of use to European organizations concerned about data residing in locations outside European jurisdictions.
  • Peer benchmarking: Building on an anonymized dataset that also feeds its annual State of Security report, Veracode added new capabilities in 2022 that help organizations benchmark the progress and maturity of their application security programs against their peers in the same industry. This enables security leaders to make a strong business case for their application security investments.
  • FedRAMP compliance: In 2022, Veracode achieved the U.S. Federal Risk and Authorization Management Program (FedRAMP) moderate authorization, which certifies that it meets specific security requirements, including controls specified by the Federal Information Security Management Act (FISMA) and the NIST 800-53 publications.

  Cons:

  • SaaS-only offering: Veracode offers a SaaS-only product, which limits its entry possibilities in select markets that are not yet comfortable exposing their code to the cloud. The UI can appear sluggish when packaging and uploading large files for scanning.
  • Limited support for IaC security: Although Veracode made significant progress on adding container security and IaC scanning capabilities in 2022, it does not currently support infrastructure configuration drift detection or enable organizations to define their own custom IaC policies.
  • Lack of SBOM ingestion: Veracode currently lacks the ability to ingest and attest SBOMs as part of automated policy decisions in CI/CD pipelines.

Reference

• Gartner, Magic Quadrant for Application Security Testing, 17 May 2023, ID G00770949

View Market Definition
View Vendor Movements