Best Static Application Security Testing Software in 2026
Updated
In short: Skylos is ranked #1 of 24 as of 4 October 2026, ahead of Snyk Open Source and Horusec. The best-ranked option with a free plan is Snyk Open Source. The lowest first paid tier on this page is Puma Scan at $24.92/mo.
Static application security testing software analyzes code, but entries differ in what they analyze and how they fit into development workflows. Compare analysis targets and supported languages with IDE and CI/CD support; fix guidance and included SCA are further distinctions. Deployment options, free-plan availability, and paid starting prices add practical context. Skylos, Snyk Open Source, and Horusec lead the ranking, followed by Puma Scan and Semgrep Code. Consider your codebase and workflow when weighing the listed language coverage, integrations, and deployment details.
24 static application security testing software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
7 of the 24 here have a free tier you can use, 0 have open-source code on record, and 0 have full bars: free, open, on most of your devices and documented.
| # | App | Signal | Free tier | Open code | Devices | From | Score |
|---|---|---|---|---|---|---|---|
| 1 | SkylosWeb · Windows · Mac · Linux · Self-hosted · API · Extension | Three bars | — | 4 of 6 | Free | 6.7 | |
| 2 | Snyk Open SourceWeb · Windows · Mac · Linux · API | Three bars | — | 4 of 6 | $25/mo | 6.7 | |
| 3 | HorusecWeb · Windows · Mac · Linux · Self-hosted · API · Extension | Three bars | — | 4 of 6 | Free | 6.6 | |
| 4 | Puma ScanWindows · Mac · Linux · Self-hosted | Three bars | — | 3 of 6 | $24.92/mo | 6.6 | |
| 5 | Semgrep CodeWeb · Windows · Mac · Linux · Self-hosted · API · Extension | Three bars | — | 4 of 6 | $30/mo | 6.6 | |
| 6 | FlawfinderWindows · Mac · Linux · Self-hosted | Three bars | — | 3 of 6 | Free | 6.5 | |
| 7 | OpenGrepWindows · Mac · Linux | Three bars | — | 3 of 6 | Free | 6.5 | |
| 8 | Veracode DASTWeb · Windows · Mac · Linux · API | Two bars | — | — | 4 of 6 | — | 5.7 |
| 9 | Black Duck CoverityWeb · Windows · Mac · Linux · Self-hosted | Two bars | — | — | 4 of 6 | — | 5.6 |
| 10 | Mend SASTWeb · Windows · Mac · Linux · Self-hosted | Two bars | — | — | 4 of 6 | $83.33/mo | 5.6 |
| 11 | PVS-StudioWindows · Mac · Linux | Two bars | — | — | 3 of 6 | — | 5.6 |
| 12 | CodeSonarWeb · Windows · Linux | One bar | — | — | 3 of 6 | — | 5.3 |
| 13 | KlocworkWeb · Windows · Linux | One bar | — | — | 3 of 6 | — | 5.3 |
| 14 | Microsoft DevSkimNo platforms listed | No signal | — | — | 0 of 6 | — | 5.2 |
| 15 | MobSFWeb | No signal | — | — | 1 of 6 | — | 5.2 |
| 16 | NodeJsScanMac · Linux | No signal | — | — | 2 of 6 | — | 5.2 |
| 17 | PysaMac · Linux | No signal | — | — | 2 of 6 | — | 5.2 |
| 18 | BanditMac · Linux | No signal | — | — | 2 of 6 | — | 5.1 |
| 19 | BearerMac · Linux | No signal | — | — | 2 of 6 | — | 5.1 |
| 20 | DawnscannerNo platforms listed | No signal | — | — | 0 of 6 | — | 5.1 |
| 21 | gosecMac · Linux | No signal | — | — | 2 of 6 | — | 5.1 |
| 22 | Checkmarx API SecurityWeb · Self-hosted · API | One bar | — | — | 1 of 6 | — | 5.0 |
| 23 | BrakemanNo platforms listed | No signal | — | — | 0 of 6 | — | 4.9 |
| 24 | HCL AppScan SourceWindows · Linux | No signal | — | — | 2 of 6 | — | 4.7 |
Is your app on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which static application security testing software is ranked first on Freedom251?
Skylos is ranked #1 of 24 with a score of 6.7. Snyk Open Source is second and Horusec third.
How many of these have a free plan?
7 of the 24 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Puma Scan has the lowest first paid tier we found: $24.92/mo.
How is this list ranked?
Ranked free-and-open first: a usable free tier and open-source code, then the platforms it runs on and its documentation. Paid placements never change a rank.