AppSecNews

ASPM

Application Security Posture Management

Aggregate, deduplicate and prioritize findings across every other tool in the program.

16 tools profiled

How it differs Collects findings from your other scanners, deduplicates them and ranks them by application context. It aggregates rather than scans, though some platforms bundle scanners of their own.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

9 tools match

Active Self hosted Clear all

  • AccuKnox

    AccuKnox

    ASPM

    A cloud workload and application posture platform built on KubeArmor, using eBPF for observability and kernel LSMs to enforce least-privilege policy on workloads.

    Commercial
    Growing

  • Apiiro

    Apiiro

    ASPM

    An application security posture platform that builds an inventory from source code and correlates scanner findings against code context, ownership and material change.

    Commercial
    Established

  • Cycode

    Cycode

    ASPM

    A posture platform that started with source control and CI/CD hardening and grew into first-party scanning plus correlation of findings across the delivery chain.

    Commercial
    Established

  • DefectDojo

    DefectDojo (originally an OWASP project)

    ASPM

    An open source vulnerability management system that imports scanner output through a large parser library, deduplicates findings and tracks them to closure.

    Open source
    Established Verified

  • Faraday

    Faraday Security

    ASPM

    A vulnerability management and collaboration platform built for offensive teams, importing output from security tools into a shared workspace with reporting.

    Freemium
    Established

  • AccuKnox

    AccuKnox

    A cloud workload and application posture platform built on KubeArmor, using eBPF for observability and kernel LSMs to enforce least-privilege policy on workloads.

    Commercial Growing
    ASPM

  • Apiiro

    Apiiro

    An application security posture platform that builds an inventory from source code and correlates scanner findings against code context, ownership and material change.

    Commercial Established
    ASPM

  • Cycode

    Cycode

    A posture platform that started with source control and CI/CD hardening and grew into first-party scanning plus correlation of findings across the delivery chain.

    Commercial Established
    ASPM

  • DefectDojo

    DefectDojo (originally an OWASP project)

    An open source vulnerability management system that imports scanner output through a large parser library, deduplicates findings and tracks them to closure.

    Open source Established
    ASPM

  • Faraday

    Faraday Security

    A vulnerability management and collaboration platform built for offensive teams, importing output from security tools into a shared workspace with reporting.

    Freemium Established
    ASPM

  • Legit Security

    Legit Security

    ASPM

    A posture platform that discovers and evaluates the whole build and release environment, then correlates code findings back to the pipelines that produced them.

    Commercial
    Growing

  • Software Risk Manager

    Black Duck (originally Code Dx)

    ASPM

    A correlation and triage platform, descended from Code Dx, that normalizes output from many analysis tools and merges overlapping findings into a single review queue.

    Commercial
    Established

  • ThreadFix

    Coalfire (originally Denim Group)

    ASPM

    A vulnerability resolution platform that normalizes scanner output, correlates static and dynamic findings, and can emit WAF rules as temporary mitigation.

    Commercial
    Established

  • Xygeni

    Xygeni

    ASPM

    A software supply chain security platform covering malicious package detection, pipeline and source control hardening, secrets, dependencies and code analysis.

    Commercial, free tier
    Growing

  • Legit Security

    Legit Security

    A posture platform that discovers and evaluates the whole build and release environment, then correlates code findings back to the pipelines that produced them.

    Commercial Growing
    ASPM

  • Software Risk Manager

    Black Duck (originally Code Dx)

    A correlation and triage platform, descended from Code Dx, that normalizes output from many analysis tools and merges overlapping findings into a single review queue.

    Commercial Established
    ASPM

  • ThreadFix

    Coalfire (originally Denim Group)

    A vulnerability resolution platform that normalizes scanner output, correlates static and dynamic findings, and can emit WAF rules as temporary mitigation.

    Commercial Established
    ASPM

  • Xygeni

    Xygeni

    A software supply chain security platform covering malicious package detection, pipeline and source control hardening, secrets, dependencies and code analysis.

    Commercial, free tier Growing
    ASPM
Tick up to 4 tools above.