Best Interactive Application Security Testing Software in 2026
Updated
In short: Aikido CSPM is ranked #1 of 15 as of 4 October 2026, ahead of HCL AppScan and Waratek IAST. The best-ranked option with a free plan is HCL AppScan. The lowest first paid tier on this page is Aikido CSPM at $300/mo.
Interactive application security testing software examines applications during runtime, so fit depends partly on the systems and development process you need to cover. Compared on API testing, authenticated testing, instrumentation, and language coverage, the options also differ in runtime targets and deployment. CI/CD integration can be another point to assess alongside free-plan availability and paid-from pricing. Aikido CSPM, HCL AppScan, and Waratek IAST are among the entries shown. Use the listed testing and integration criteria to compare coverage with your applications and workflow needs.
15 interactive application security testing software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
5 of the 15 here have a free tier you can use, 0 have open-source code on record, and 0 have full bars: free, open, on most of your devices and documented.
| # | App | Signal | Free tier | Open code | Devices | From | Score |
|---|---|---|---|---|---|---|---|
| 1 | Aikido CSPMWeb · Windows · Mac · Linux · API | Three bars | — | 4 of 6 | $300/mo | 6.6 | |
| 2 | HCL AppScanWeb · Windows · Mac · Linux · Self-hosted · API · Extension | Three bars | — | 4 of 6 | Free | 6.6 | |
| 3 | Waratek IASTWeb · Windows · Linux · Self-hosted | Three bars | — | 3 of 6 | $2,499/mo | 6.6 | |
| 4 | DongTai IASTWeb · Linux · Self-hosted · API | Two bars | — | 2 of 6 | Free | 6.5 | |
| 5 | New Relic IASTWeb | Two bars | — | 1 of 6 | Free | 6.4 | |
| 6 | Contrast AssessWeb · Windows · Mac · Linux · Self-hosted · API | Two bars | — | — | 4 of 6 | — | 5.7 |
| 7 | Veracode DASTWeb · Windows · Mac · Linux · API | Two bars | — | — | 4 of 6 | — | 5.7 |
| 8 | NowSecure PlatformWeb · Android · iPhone · API | Two bars | — | — | 3 of 6 | — | 5.6 |
| 9 | Black Duck SeekerWeb · Windows · Mac · Linux | One bar | — | — | 4 of 6 | — | 5.5 |
| 10 | Black Duck PolarisWeb · API | One bar | — | — | 1 of 6 | — | 5.4 |
| 11 | OpenText Fortify on DemandWeb | One bar | — | — | 1 of 6 | — | 5.3 |
| 12 | AcunetixWeb · Windows · Linux · Self-hosted · API | Two bars | — | — | 3 of 6 | — | 5.2 |
| 13 | Checkmarx API SecurityWeb · Self-hosted · API | One bar | — | — | 1 of 6 | — | 5.0 |
| 14 | InvictiWeb · Self-hosted · API | One bar | — | — | 1 of 6 | — | 5.0 |
| 15 | Checkmarx OneWeb | No signal | — | — | 1 of 6 | — | 4.7 |
Is your app on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which interactive application security testing software is ranked first on Freedom251?
Aikido CSPM is ranked #1 of 15 with a score of 6.6. HCL AppScan is second and Waratek IAST third.
How many of these have a free plan?
4 of the 15 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Aikido CSPM has the lowest first paid tier we found: $300/mo.
How is this list ranked?
Ranked free-and-open first: a usable free tier and open-source code, then the platforms it runs on and its documentation. Paid placements never change a rank.