Best Static Application Security Testing Software in 2026
Updated
In short: Semgrep Code is ranked #1 of 20 as of 2 October 2026, ahead of Horusec and Skylos. The best-ranked option with a free plan is Horusec. The lowest first paid tier on this page is Puma Scan at $24.92/mo.
20 static application security testing software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
| # | Platform | Score | Why | From | Free plan | Paid from | Analysis target | |
|---|---|---|---|---|---|---|---|---|
| 1 | Semgrep Code | 8.9 | RecognisedAPIDocumented | $30/mo | Yes | — | — | View |
| 2 |  Horusec | 8.5 | RecognisedAPIDocumented | Free | Yes | — | source | View |
| 3 | Skylos | 7.6 | RecognisedAPIDocumented | Free | Yes | — | source | View |
| 4 | GitHub CodeQL | 7.4 | RecognisedAPIDocumented | $30/mo | Yes | — | — | View |
| 5 | PVS-Studio | 7.0 | RecognisedAPIDocumented | — | No | — | — | View |
| 6 | Black Duck Coverity | 6.9 | RecognisedAPIDocumented | — | — | — | source | View |
| 7 |  OpenGrep | 6.4 | RecognisedAPIDocumented | Free | Yes | — | source | View |
| 8 | CodeSonar | 6.3 | RecognisedAPIDocumented | — | — | — | — | View |
| 9 | Mend SAST | 6.2 | RecognisedAPIDocumented | $83.33/mo | — | — | source | View |
| 10 | Bearer | 6.1 | RecognisedAPIDocumented | — | Yes | — | — | View |
| 11 |  Bandit | 6.1 | RecognisedAPIDocumented | — | Yes | — | — | View |
| 12 |  gosec | 5.8 | RecognisedAPIDocumented | — | Yes | — | — | View |
| 13 |  Puma Scan | 5.8 | RecognisedAPIDocumented | $24.92/mo | Yes | — | source | View |
| 14 | MobSF | 5.7 | RecognisedAPIDocumented | — | Yes | — | source and binary | View |
| 15 |  Microsoft DevSkim | 5.6 | RecognisedAPIDocumented | — | — | — | — | View |
| 16 | Flawfinder | 5.3 | RecognisedAPIDocumented | — | Yes | — | — | View |
| 17 |  HCL AppScan Source | 5.2 | RecognisedAPIDocumented | — | No | — | — | View |
| 18 | Pysa | 4.9 | RecognisedAPIDocumented | — | — | — | source | View |
| 19 |  Brakeman | 4.8 | RecognisedAPIDocumented | — | — | — | — | View |
| 20 |  Dawnscanner | 4.8 | RecognisedAPIDocumented | — | — | — | source | View |
Is your platform on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which static application security testing software is ranked first on Inferse?
Semgrep Code is ranked #1 of 20 with a score of 8.9. Horusec is second and Skylos third.
How many of these have a free plan?
6 of the 20 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Puma Scan has the lowest first paid tier we found: $24.92/mo.
How is this list ranked?
Ranked on what each maker publishes, open and connectable first: a public API, open-source code, the depth of its documentation and a free tier to try it on. Model lists are sorted by the figure in their title, exactly as each provider publishes it. Paid placements never change a rank.