17.9
42Crunch provides API security testing and runtime protection, and applies contract-driven governance to MCP servers used by AI agents.
Free planWebAPIExtension
Best Application Security Testing in 2026
27.6
OWASP ZAP, now identified as ZAP or ZAP by Checkmarx, is a free, open-source web application scanner and proxy for security testing.
Free planOpen sourceAPIExtensionLinux
36.9
Beagle Security is an agentic AI penetration testing platform for web applications, APIs, and GraphQL.
Free planWebAPI
- 4
Detectify Surface Monitoring
Detectify Surface Monitoring continuously monitors internet-facing subdomains for exposed files, vulnerabilities, and misconfigurations.
Free planWebAPI6.9From €2,500 a year - 5
Endor Labs
Endor Labs is an application security platform for code, dependencies, secrets, container images, and AI coding agents.
Free planWebAPILinuxmacOS6.8Free plan - 6
StackHawk HawkScan
StackHawk HawkScan is a dynamic application security testing scanner for web applications and APIs.
WebAPILinuxmacOS6.8From $10 a month - 7
w3af
w3af is a free, open-source web application security scanner for developers and penetration testers assessing web vulnerabilities.
Free planWebAPILinuxmacOS6.8Free plan - 8
Acunetix
Acunetix, now Invicti Web + API, scans running web applications and APIs for exploitable vulnerabilities.
WebAPILinuxSelf-hosted6.7$500 one-time - 9
Bright Security DAST
Bright Security DAST is a dynamic application security testing tool offered as SaaS.
WebAPILinuxmacOS6.5 - 10
FOSSA
FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the development lifecycle.
Free planWebAPILinuxSelf-hosted6.4Free plan - 11
Contrast Assess
Contrast Assess is an Interactive Application Security Testing tool for identifying security risks in running applications.
WebAPILinuxmacOS6.3 - 12
Invicti
Invicti is an application security platform for finding, prioritizing, and fixing application risk.
WebAPISelf-hosted6.3$500 one-time - 13
Mend.io
Mend.io is a paid application security platform for code, AI components, and the attack surface connecting them.
Web6.1From $250 a year - 14
PVS-Studio
PVS-Studio analyzes source code to detect bugs and possible vulnerabilities.
LinuxmacOSWindows6.1 - 15
Akto API Security Platform
WebAPILinuxSelf-hosted6.0 - 16
CodeSonar
CodeSonar is a static application security testing tool for finding security and quality defects in source code and compiled binaries.
WebLinuxSelf-hostedWindows6.0 - 17
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.7 - 18
DerScanner
WebAPILinuxSelf-hosted5.6 - 19
Rapid7 InsightAppSec
WebWindows5.5From $175 a month - 20
Klocwork
WebLinuxWindows5.2 - 215.0
- 22
Checkmarx One
Checkmarx One is a web-based application security platform focused on source code analysis.
Web4.9 - 23
OpenText Fortify Software Security Platform
OpenText Fortify Software Security Platform is a web-based application security product for hybrid deployment environments.
Web4.9 - 244.9
- 254.9