17.9
42Crunch provides API security testing and runtime protection, and applies contract-driven governance to MCP servers used by AI agents.
Free planWebAPIExtension
Best Application Security Testing in 2026
Application security testing tools help inspect software and APIs for security issues. This category includes services and products delivered through web, Linux, Windows, API, self-hosted and macOS setups. If you work from an Android phone or tablet, check the product page for an Android app before choosing. Compare the free plan, paid starting price, testing methods, supported languages, CI/CD integrations,…
27.6
OWASP ZAP, now identified as ZAP or ZAP by Checkmarx, is a free, open-source web application scanner and proxy for security testing.
Free planOpen sourceAPIExtensionLinux
37.4
Endor Labs is an application security platform for code, dependencies, secrets, container images, and AI coding agents.
Free planWebAPIExtension
- 4
Beagle Security
Beagle Security is an agentic AI penetration testing platform for web applications, APIs, and GraphQL.
Free planWebAPI6.9From $99 a month - 5
Detectify Surface Monitoring
Detectify Surface Monitoring continuously monitors internet-facing subdomains for exposed files, vulnerabilities, and misconfigurations.
Free planWebAPI6.9From €2,500 a year - 6
StackHawk HawkScan
StackHawk HawkScan is a dynamic application security testing scanner for web applications and APIs.
WebAPILinuxmacOS6.8From $10 a month - 7
w3af
w3af is a free, open-source web application security scanner for developers and penetration testers assessing web vulnerabilities.
Free planWebAPILinuxmacOS6.8Free plan - 8
Acunetix
Acunetix, now Invicti Web + API, scans running web applications and APIs for exploitable vulnerabilities.
WebAPILinuxSelf-hosted6.7$500 one-time - 9
Bright Security DAST
Bright Security DAST is a dynamic application security testing tool offered as SaaS.
WebAPILinuxmacOS6.5 - 10
FOSSA
FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the development lifecycle.
Free planWebAPILinuxSelf-hosted6.4Free plan - 11
Semgrep AppSec Platform
Free planWeb6.4From $15 a month - 12
Contrast Assess
Contrast Assess is an Interactive Application Security Testing tool for identifying security risks in running applications.
WebAPILinuxmacOS6.3 - 13
Invicti
Invicti is an application security platform for finding, prioritizing, and fixing application risk.
WebAPISelf-hosted6.3$500 one-time - 14
Mend.io
Mend.io is a paid application security platform for code, AI components, and the attack surface connecting them.
Web6.1From $250 a year - 15
PVS-Studio
PVS-Studio analyzes source code to detect bugs and possible vulnerabilities.
LinuxmacOSWindows6.1 - 16
Akto API Security Platform
WebAPILinuxSelf-hosted6.0 - 17
CodeSonar
CodeSonar is a static application security testing tool for finding security and quality defects in source code and compiled binaries.
WebLinuxSelf-hostedWindows6.0 - 18
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.7 - 19
DerScanner
WebAPILinuxSelf-hosted5.6 - 20
Rapid7 InsightAppSec
WebWindows5.5From $175 a month - 21
Klocwork
WebLinuxWindows5.2 - 225.0
- 23
Checkmarx One
Checkmarx One is a web-based application security platform focused on source code analysis.
Web4.9 - 24
OpenText Fortify Software Security Platform
OpenText Fortify Software Security Platform is a web-based application security product for hybrid deployment environments.
Web4.9 - 254.9
Choosing well
Check device and platform access
The platform facts for products in this category include web, Linux, Windows, API, self-hosted and macOS. Android is not named in those facts, so verify phone and tablet access before you commit.
If your workflow needs a browser, local installation or self-hosting, match that delivery option to your setup.
Compare free plans and trials
A free plan is available from products such as 42Crunch API Security Platform, Akto API Security Platform, Beagle Security and Endor Labs. Detectify Surface Monitoring also lists a free plan with pricing from €90 per month.
Beagle Security lists paid plans from $99 per month annually and a 14-day trial. Burp Suite Enterprise Edition lists a 30-day trial, while CodeSonar lists a free trial.
Match the testing scope
Compare the testing methods and languages supported by the products you are considering. The category also compares SCA inclusion and API testing, which can matter when your code uses dependencies or exposes services.
API-focused options include 42Crunch API Security Platform and Akto API Security Platform.
Fit deployment and CI/CD
Review deployment options such as web, API, self-hosted or local operating-system support. Check CI/CD integrations if scans need to run as part of a build or release process.
Products listing API, Linux, macOS, self-hosted, web or Windows support include Bright Security DAST, Contrast Assess and DerScanner.
Check code access and licensing
Open-source code is offered by products in this category. If you need to read or change the code, check the licence and project terms before adopting a tool.
Also compare whether the product has a free plan, a free trial or a paid model, since those are separate offers.
Questions people ask
Do these tools have Android apps?
Android is not named in the platform facts provided. Check the product page for Android support if you need to manage scans from a Xiaomi, Redmi or POCO phone or tablet.
Can I start without paying?
Products in this category offer free plans or free trials. Akto, Beagle Security, Endor Labs and 42Crunch list free plans; Beagle, Burp Suite Enterprise Edition and CodeSonar list trial options.
Which platforms are listed?
The listed platform options are web, Linux, Windows, API, self-hosted and macOS. Confirm the exact deployment choices for the product you want.
Are API tests included?
API testing is one of the comparison fields for this category. Check the individual product details to see how API testing is handled.
Can these tools connect to CI/CD?
CI/CD integrations are part of the comparison. Review the product details for the integrations and deployment flow that fit your build process.