Application Security Testing Platforms

Vendors in this market sell platforms. Forrester scores components.

That mismatch is not an oversight and it is the most useful thing to understand before running an evaluation. Every serious vendor here will show you a consolidated product covering static analysis, dependency scanning, dynamic testing, secrets detection, and API security under one licence and one dashboard. Forrester publishes separate Wave evaluations for static application security testing and for software composition analysis, scored against different criteria, on different dates, with partially different vendor sets.

The reason is straightforward once stated. Component quality varies enormously inside a single platform. A vendor with the best static analysis engine in the market can have unremarkable dependency scanning, and the consolidated pitch is designed so that you never notice.

What the category actually contains

Application security testing is a bundle of distinct technologies that got sold together.

Static analysis reads source code without running it, looking for patterns that indicate vulnerability. It runs early, catches a lot, and generates the false positives that give the whole category its reputation.

Software composition analysis inventories the open source and third-party components your application depends on, and checks them against known vulnerability databases. Most modern applications are mostly other people's code, which makes this arguably the higher-yield discipline.

Dynamic analysis attacks a running application from the outside, finding things that only appear at runtime. Interactive analysis instruments the application while it runs and sits between the two approaches.

Around those sit secrets scanning, infrastructure-as-code scanning, container image scanning, and API security testing.

Forrester's own framing in its current research is that all of these have become table stakes. The market is crowded, capabilities overlap heavily, and finding issues is no longer where durable differentiation lives.

Why the category exists at all

Two figures from Forrester's research make the case better than any vendor deck.

In Forrester's 2024 security survey, sixteen percent of security decision-makers whose organisation had suffered an external attack reported that a web application exploit was the vector.

More striking: over half the vulnerabilities added to the CISA Known Exploited Vulnerabilities catalogue in 2024 were API-related, up from around twenty percent the year before.

That second number describes a shift rather than a trend. The application layer is where attacks land, and within it the API surface has become the dominant exposure. Any evaluation weighted toward traditional web application scanning and light on API coverage is optimising against last year's threat model.

Inside The Forrester Wave: Static Application Security Testing Solutions, Q3 2025

Published on 9 September 2025 and authored by Janet Worthington with three contributors, the evaluation scored ten providers against twenty three criteria across current offering, strategy, and customer feedback.

The ten: Black Duck Software, Checkmarx, GitHub, GitLab, HCLSoftware, Mend.io, OpenText, Snyk, Sonar, and Veracode.

Each was assessed on three inputs: a completed vendor questionnaire, executive strategy briefings with demonstrations, and interviews with reference customers.

Checkmarx took the highest current offering score of the ten and placed as a Leader, with the maximum score in eight criteria including risk prioritisation, language and framework support, modern application development, policy management, application portfolio risk management, AI-powered tooling in the development lifecycle, roadmap, and supporting services. Forrester noted its investment in AI specifically, with a roadmap covering AI programming languages and frameworks, integration with code generators, and large language model security.

Veracode also placed as a Leader, credited for detection quality alongside remediation delivered in the IDE and on pull requests, and for repository integration that compiles and scans projects automatically to reduce onboarding burden. Reference customers highlighted access to application security consultants for remediation help, which is a service differentiator rather than a product one.

Among Strong Performers, Mend.io appeared in this evaluation for the first time, taking top scores in innovation and triage and being singled out as a customer favourite, positioned for enterprises wanting platform simplicity with strong support. Black Duck and HCLSoftware also placed as Strong Performers.

Note the third scoring dimension. This Wave uses customer feedback rather than market presence, consistent with Forrester's methodology change, which means vendor size counts for nothing here.

The companion evaluation nobody reads

Forrester published The Forrester Wave: Software Composition Analysis Software, Q4 2024 as a separate evaluation, and the guidance attached to it deserves more attention than SCA usually gets.

Forrester's position is that SCA software differs meaningfully in both functionality and output quality. Some products focus narrowly on open source components while others assess third-party and inner-source components, meaning shared code written inside your own organisation. Result quality varies by language and by the ability to detect vulnerabilities in transitive dependencies, which is to say the dependencies of your dependencies, where most real exposure hides.

One finding from that research has aged into urgency. At the time of the Q4 2024 evaluation, only a few SCA vendors were scanning AI models or producing AI bills of materials, which Forrester described as functionality needed broadly and quickly. Given that a third of organisations reported generative AI in production applications in Forrester's 2024 survey, a dependency scanner blind to models and their provenance has a hole in exactly the newest part of your supply chain.

If you are consolidating onto one platform, this is the specific question to press. Strong static analysis and weak composition analysis is a common combination, and the second is where more of your actual attack surface lives.

What the customer research shows

The Buyer's Guide accompanying these evaluations, built from reference customer interviews, produces a picture that cuts against how this market is usually described.

Customers stay. Average tenure with an SCA vendor runs over three and a half years. Satisfaction is high, with twenty two of twenty eight references rating their vendor nine or ten out of ten.

And most evaluated three vendors before buying, which Forrester encourages rather than treating as excessive diligence.

That combination says something specific. This is not a market where buyers are miserable and churning. It is a market where switching is painful enough that people make the decision carefully and then live with it, which raises the stakes on the initial evaluation and lowers the value of the assumption that you can correct a bad choice later.

Long tenure also means reference customers are describing a product they chose several years ago and a vendor relationship that has had time to mature. That is useful for judging support quality and much less useful for judging whether the current roadmap is credible.

The paradigm shift underneath

Here is the part that reframes everything above.

Janet Worthington, the analyst behind the SAST Wave, has since published Forrester's argument that application security testing has reached an inflection point. Detection is becoming commoditised, context is not, and what separates products now is the ability to correlate findings with exploitability, reachability, runtime exposure, and business impact rather than the ability to find things.

Forrester has gone further and established a successor category, agentic development security, framed not as a rebranding of existing tools but as a new security paradigm for AI-powered development. The reasoning is that AI coding agents generate code, select dependencies, modify infrastructure, and execute instructions at machine speed, and that traditional models built for human-paced development and discrete scanning stages are poorly suited to that reality.

The specific failure modes Forrester documents are worth knowing here because they change what you should test for. Coding agents commonly ship unauthenticated or improperly authorised endpoints, trust client-supplied data for security-critical decisions including prices and roles, omit input validation and rate limiting, and reuse unsafe patterns because they optimise for correctness and brevity rather than risk.

None of those are exotic. All of them produce software that works. And because an agent applies the same reasoning consistently, the same weakness appears everywhere rather than once.

So the practical situation for a buyer in this category is awkward. The current Waves evaluate mature products against criteria built for human-paced development, and the analyst who wrote them has publicly said the operating model is changing. Both things are true and useful. The Waves tell you who is good at the existing job. The successor framing tells you the job is changing.

What to test

Evaluate the components separately even if you buy the platform. Score static analysis, composition analysis, and API testing against your own requirements individually. A single platform score conceals exactly the variation you need to see, which is presumably why Forrester scores them separately.

Run it against your own repositories, including the difficult ones. False positive rates quoted in a demo are measured on curated code. The number that matters is what your engineers will accept from your codebase, and it is the number that determines whether the tool gets used or ignored.

Test transitive dependency depth explicitly. Ask how many levels deep the composition analysis goes and how it handles a vulnerability in a dependency of a dependency of a dependency. Vendors differ and the difference is where real exposure sits.

Ask about AI bills of materials and model scanning directly. If you have generative AI in production, this is a live gap in most products rather than a future one.

Check the remediation path, not the finding. Both Leaders in the current SAST evaluation differentiated on fixing rather than detecting, with in-IDE suggestions, pull request integration, and in one case access to human consultants. In a market where detection is commoditised, remediation quality is the thing you are actually paying for.

And ask the agentic questions. What does the platform do about the volume of code that AI agents now produce, and does it offer guardrails at generation time rather than only findings afterwards. That capability barely existed when these evaluations ran, which makes vendor answers a genuine differentiator rather than a checkbox.

Forrester does not endorse any vendor named here, and tier placement should not be read as a recommendation to buy.