Does anyone have a recommendation for a SAST / DAST scanning tool that supports a variety of languages (front end and backend), has minimal false positives, supports automation (via API or other), integrates with IDEs and integrates with GitLab?

3.8k views1 Upvote6 Comments

Sort by:

Chief Information Security Officer in Software2 years ago

There are several reputable SAST/DAST tools in the market that cater to a wide variety of languages and offer integration with IDEs and GitLab. It's crucial to understand that no scanning tool will have zero false positives, but some have invested heavily in reducing them. When considering a solution, it's essential to evaluate it based on your specific requirements and conduct a proof of concept. Tools like Snyk, Checkmarx, Fortify, and Veracode are well-regarded in the industry, but the best fit would depend on your organization's specific context and needs. I'd recommend engaging with multiple vendors, assessing their tool's capabilities, and gathering feedback from peers in the industry to make an informed decision.

Director & Founder2 years ago

For SAST tools you can consider Sonarqube and Snyk.
For DAST Beagle Security, Intruder, and Detectify seems to do a good job.

CTO in Software5 years ago

For SAST and IAST, I'd talk to Checkmarx. Then if you want to layer on DAST, talk to Synopsys

CTO in Software5 years ago

DAST - Rapid7 AppSpider
DAST - SonarQube

Chief Security Officer in Software5 years ago

We are in the process of testing GitLab Ultimate. It has security features like SAST/DAST and fuzzing. I have also used Veracode in the past.

1 1 Reply

no title2 years ago

Gitlab doesn't have its own SAST and DAST features but it integrates with other open source tools for SAST and DAST. I tried Gitlab once, I prefer Github security a lot. Recently also gave a talk on devsecops and here are some commercial open source tools I recommended for devsecops roadmap in the talk. Security check Tools 1. Secure Access to Infrastructure Teleport 2. SAST Semgrep 3. Secret Scanning Trufflehog 4. IaC scanning TerraScan 5. Dependencies Dependabot 6. DAST/ IAST/ API Security Testing Akto.io

Content you might like

Do you think your security org has a “heroism” culture? (in other words are team members expected to exhaust themselves to achieve results?)

Yes28%

Only among certain teams43%

No13%

Don’t know / can’t say14%

View Results

Why do you think there are so few mature AI-driven autonomous pentesting solutions on the market, and why does this topic seem to generate more hype than in-depth technical discussion?

For those who have trialed an AI pentest solution: what was the single biggest gap you encountered?

With AI adoption accelerating across enterprises, what do you view as the top information security challenge that leaders should address? How can CISOs, VPs and Director’s align governance, risk and security investments to enable AI innovation without creating new exposures?

What’s your top barrier to adopting AI-driven pentesting?

Lack of mature vendor solutions44%

Trust in AI accuracy61%

Budget constraints28%

Skills to operate the tools44%

View Results

Does anyone have a recommendation for a SAST / DAST scanning tool that supports a variety of languages (front end and backend), has minimal false positives, supports automation (via API or other), integrates with IDEs and integrates with GitLab?

Sort by:

Content you might like

Do you think your security org has a “heroism” culture? (in other words are team members expected to exhaust themselves to achieve results?)

Why do you think there are so few mature AI-driven autonomous pentesting solutions on the market, and why does this topic seem to generate more hype than in-depth technical discussion?

For those who have trialed an AI pentest solution: what was the single biggest gap you encountered?

With AI adoption accelerating across enterprises, what do you view as the top information security challenge that leaders should address? How can CISOs, VPs and Director’s align governance, risk and security investments to enable AI innovation without creating new exposures?

What’s your top barrier to adopting AI-driven pentesting?

What sets us apart?

RELATED ONE-MINUTE INSIGHTS

How are U.S. CISOs Addressing Liability Risk?

CrowdStrike Outage: Impact And Recovery

Impact & Perceptions of A Privacy-First Digital Era

Challenges & Tools For A Privacy-First Internet Age

IT and Infosec Collaboration on Vulnerability Patching

Take Your Insights On-the-Go