Static application security testing (SAST):
secure code as it is written
Dynamic application security testing (DAST):
surface monitoring, dynamically testing for vulnerabilities through simulated attacks, implementing OWASP ZAP
Infrastructure-as-code (IaC):
detect issues that leave your infrastructure open to attack
Cloud posture management (CSPM):
detect cloud infrastructure risks in real time
Container scanning:
scan containerized environments for risky packages
Secrets detection:
check code for exposed API keys, passwords, and more
Open source dependencies:
avoid vulnerable dependencies (SCA) with reachability analysis, and automatically generate SBOMs.
Open source license:
map out and avoid license risk, easily export SBOMs
Malware detection:
detect risks and protect your app from Software Supply Chain Attacks
Runtime protection:
protect your apps at run-time with an ‘embedded’ web application firewall
Custom scans:
connect your scanners, import findings from SonarQube and existing SAST tools