⌂ Home

DevSecOps Tools Landscape

Reference map of security tools by category and pipeline phase — click a phase to filter

Pipeline phases (interactive)

Select a phase to highlight tools commonly used there. Choose All phases to see the full catalog.

PLAN CODE BUILD TEST DEPLOY OPERATE threat IDE/SAST SCA/CI DAST/IAST IaC policy CSPM/runtime modeling secrets containers API fuzz approvals SIEM/SOAR

Tool catalog

Categories: SAST, DAST, SCA, container security, IaC scanning, secrets detection, CSPM. License column is indicative only.

ToolCategoryPrimary phase(s)What it doesOSS / Commercial
OWASP Threat DragonThreat modelingPlanDiagram-driven STRIDE-style threat models tied to Git.OSS
Microsoft Threat Modeling ToolThreat modelingPlanData-flow diagrams with STRIDE rule templates.Free (not OSS)
SonarQube / SonarCloudSASTCode, BuildStatic analysis for bugs, hotspots, and security rules in PRs.Both
SemgrepSASTCode, BuildFast pattern-based static analysis with community rules.OSS + commercial
Checkmarx SASTSASTCode, BuildEnterprise static analysis with centralized policy.Commercial
Veracode Static AnalysisSASTCode, BuildCloud static scanning with policy gates.Commercial
GitGuardian ggshieldSecrets detectionCode, BuildScans commits and CI for leaked credentials.Both
TruffleHogSecrets detectionCode, BuildHigh-signal secret scanning with verified validators.OSS
GitleaksSecrets detectionCode, BuildRegex and entropy-based secret detection in repos.OSS
OWASP Dependency-CheckSCABuildCorrelates dependencies to NVD CVEs.OSS
Snyk Open SourceSCABuildDependency vulnerability and license analysis.Both
Mend (WhiteSource)SCABuildEnterprise dependency governance and SBOM.Commercial
Gradle OWASP plugin / npm auditSCABuildBuild-native dependency CVE checks.OSS
TrivyContainer securityBuild, DeployImage/filesystem vuln scan, IaC misconfig, secrets.OSS
GrypeContainer securityBuild, DeploySBOM-oriented image vulnerability scanner.OSS
ClairContainer securityBuild, OperateStatic analysis of container image layers.OSS
Sigstore / CosignContainer securityBuildSign and verify OCI artifacts and SBOMs.OSS
OWASP ZAPDASTTestProxy and automated scanner for web apps/APIs.OSS
Burp SuiteDASTTestManual and automated web security testing.Both
Acunetix / InvictiDASTTestContinuous web vulnerability scanning.Commercial
Contrast Security / Seeker-styleDASTTestInteractive/IAST-style runtime-assisted testing.Commercial
CheckovIaC scanningDeployStatic policy checks for Terraform, K8s, CloudFormation.OSS
Terraform tfsecIaC scanningDeploySecurity scanner focused on Terraform HCL.OSS
cfn-lint + guard rulesIaC scanningDeployCloudFormation validation and policy-as-code.OSS
OPA / ConftestIaC scanningDeployRego policies against Kubernetes YAML and IaC JSON.OSS
WizCSPMOperateCloud posture, CIEM, data risk graph across providers.Commercial
Prisma Cloud / CWPPCSPMOperatePosture, compliance, workload protection.Commercial
ScoutSuite / ProwlerCSPMOperateOpen multi-cloud security assessments.OSS
AWS Security Hub + ConfigCSPMOperateNative AWS control plane aggregation and rules.Commercial (AWS)

How to read the map

  • SAST finds code-level flaws early; pair with secure code review.
  • DAST exercises running systems; catches deployment and config mistakes.
  • SCA focuses on third-party risk; feeds patch and SBOM processes.
  • Container security combines image scanning, signing, and minimal base images.
  • IaC scanning shifts policy left on cloud and Kubernetes manifests.
  • Secrets detection reduces credential sprawl in Git and build logs.
  • CSPM maintains continuous cloud control validation in production.

Operational tips

Prefer outcomes over tool count: tune rules, reduce false positives, and wire top findings into product backlogs. Correlate DAST + SAST + SCA on the same feature branch when possible to see chained risk (vulnerable dependency reachable via new route).