OWASP DefectDojo

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

OWASP DefectDojo is ranked #3 of 29 in vulnerability management software on Inferse. It runs on API, Linux, Self-hosted, Web. There is a free plan. A free trial is offered. Paid plans start at $100/mo.

Compared on vulnerability management software

Free plan: Yesdefectdojo.com
Finding deduplication: Yesdefectdojo.com
Risk prioritization: risk-baseddefectdojo.com
Remediation workflows: Yesdefectdojo.com
Ticketing sync: Yesdefectdojo.com
Deployment model: hybriddefectdojo.com

Facts

Purpose: DefectDojo aggregates security scanner findings, deduplicates them, prioritizes risk, and supports remediation.defectdojo.com · 2 Oct 2026
Scanner coverage: The platform says it natively integrates with 500+ security tools across categories including SAST, DAST, SCA, cloud, and containers.defectdojo.com · 2 Oct 2026
Automation: Pro includes triage rules for auto-triage, auto-close, and risk acceptance, and Sensei can ship fixes as pull requests.defectdojo.com · 2 Oct 2026
Integrations: Community Edition accepts all 500+ integrations through file import or API push, while Pro lists 130+ scheduled-pull connectors.defectdojo.com · 2 Oct 2026
Ticketing: Community Edition has bi-directional Jira, while Pro adds GitHub, GitLab, Azure DevOps, and ServiceNow ticketing.defectdojo.com · 2 Oct 2026
Governance: Pro lists SSO using SAML 2.0 or OIDC, granular RBAC, a full audit trail, SLA enforcement, and audit-ready reporting.defectdojo.com · 2 Oct 2026
Compliance: The Trust Center lists SOC 2 Type 2, GDPR, and the EU Cyber Resilience Act among its compliance areas.trust.defectdojo.com · 2 Oct 2026
Support: Pro includes SLA-backed support and a dedicated Customer Success Engineer; Community Edition support is via OWASP Slack and GitHub.defectdojo.com · 2 Oct 2026
Self-hosting and data: The company says users can self-host, air-gap the product, and export data through a documented REST API.defectdojo.com · 2 Oct 2026
Audience: The vendor describes the platform as serving AppSec teams, executives, penetration testers, DevSecOps, compliance teams, PSIRTs, and SOCs.defectdojo.com · 2 Oct 2026
Notable limit: Pro Reachability is labeled beta and described as providing five verdicts, with KEV overriding the ceiling.defectdojo.com · 2 Oct 2026