DerScanner

What DerScanner is

DerScanner is an application security platform that scans source code, dependencies, bytecode, binaries, web applications, APIs and mobile apps. It combines static, dynamic, software composition and mobile application security testing, with analysis available for source code, bytecode and binaries. The platform supports IDE and CI/CD workflows, custom security rules, and automated fixes. Its AI-powered triage is described as reducing false positives by up to 90%, while a code-fix feature suggests ways to address findings.

Teams can deploy DerScanner in the cloud or on premises, including in air-gapped environments. Its SAST language coverage ranges from 1 to 43 programming languages, with the language count selected for the license. Findings map to security and compliance standards including CWE/SANS Top 25, OWASP Top 10, PCI DSS and HIPAA, and the company provides audit-ready reports. Repository connections support GitHub, GitLab and Bitbucket through webhooks. CI/CD options include TeamCity, Jenkins, Azure DevOps Server and SonarQube plugins, plus command-line integration. DerScanner has been offered since 2011 and is aimed at development and security teams, including organizations in regulated sectors and MSSPs. Pricing is by request; prospective customers can request a demo, proof of concept or tailored quote.

Who it suits

DerScanner suits development and security teams that need to scan multiple kinds of software artifacts and connect security checks with IDE, repository or CI/CD workflows. Its cloud, on-premise and air-gapped deployment options, along with compliance reporting, may fit regulated organizations and MSSPs.

Limits

The custom license specifies 1 to unlimited users and scans, but price is available by request. Features and language count are selected for the license; SAST coverage ranges from 1 to 43 languages. Azure DevOps Cloud integration is currently unavailable.

Getting started

1. Visit the DerScanner website.
2. Request a demo, proof of concept or tailored quote.
3. Select a custom license with the desired deployment, language count and features.
4. Choose cloud or on-premise deployment, including an air-gapped environment if needed.
5. Connect repositories or CI/CD tools using the supported integrations.

Verdict

Choose DerScanner if your team needs application security analysis across several artifact types, with deployment choices and development workflow integrations. Its compliance reporting and air-gapped option may suit regulated environments. Look elsewhere if you require Azure DevOps Cloud integration or a price listed upfront.