GigaOm Radar for Software Supply Chain Securityv1.0

1. Executive Summary

Software supply chain attacks have become highly visible due to extensive media coverage such as of the Solarwinds attack in 2020 and the more recent MoveIt transfer tool attack. These incidents have broad impacts not only on IT and cybersecurity teams but also on consumers. In response to novel cyberthreats and an ever-expanding attack surface, comprehensive software supply chain security (SSCS) solutions have become vital to every organization’s cybersecurity strategy.

SSCS encompasses a suite of methodologies and tools designed to identify, catalog, and manage software components while scanning for vulnerabilities and misconfigurations across code, containers, and infrastructure as code (IaC). These solutions are pivotal in preventing data breaches, unauthorized access, and malicious attacks that can cripple operations, erode customer trust, and inflict significant financial damage. SSCS is essential for organizations of all sizes and industries, particularly those handling sensitive data or operating in highly regulated sectors. Over the next few years, many new regulations will come into effect in both the US and EU that require organizations to adopt SSCS tools in order to remain compliant and meet regulatory standards.

CxOs can no longer ignore either the escalating sophistication of cyberattacks or the growing complexity of software it creates and uses. This has created an environment where organizations are constantly under threat. The fallout from a successful attack can be devastating, including regulatory fines, legal repercussions, loss of customers, and irreparable damage to brand reputation. Investing in SSCS is a strategic decision that directly impacts an organization’s resilience, competitiveness, and long-term success.

While the need for SSCS stems primarily from a requirement to meet compliance or risk mitigation targets, the capabilities it provides have the added benefit of increasing developer productivity, ensuring business continuity, and protecting and growing revenue streams. By proactively identifying and remediating vulnerabilities and misconfigurations, organizations can avoid costly downtime, prevent data breaches, and maintain the trust of their customers.

The SSCS landscape is constantly evolving, driven by technological advancements and the changing nature of cyberthreats. Vendors are offering a wide range of solutions securing different portions of the SDLC, with some leaning toward shift-left solutions, others leaning toward shift-right, and still others presenting unique solutions positioned in the middle of the development lifecycle.

Businesses must adopt a comprehensive strategy for software development, deployment, and usage, employing automation to match fast-paced release schedules. Prioritizing SSCS and new technologies will strengthen defenses, reduce risks, and ensure long-term success in today’s digital landscape.

This is our first year evaluating the Software Supply Chain Security space in the context of our Key Criteria and Radar reports.

This GigaOm Radar report examines 23 of the top Software Supply Chain Security solutions and compares offerings against the capabilities (table stakes, key features, and emerging features) and nonfunctional requirements (business criteria) outlined in the companion Key Criteria report. Together, these reports provide an overview of the market, identify leading Software Supply Chain Security offerings, and help decision-makers evaluate these solutions so they can make a more informed investment decision.

2. Market Categories and Deployment Types

To help prospective customers find the best fit for their use case and business requirements, we assess how well Software Supply Chain Security solutions are designed to serve specific target markets and deployment models (Table 1).

For this report, we recognize the following market segments:

• SMB: These are smaller organizations with limited resources. They are likely to prioritize feature-specific platforms to meet business needs and limited budgets.
• Enterprise: These are larger organizations with complex IT environments. They are likely to have software development teams that collaborate with security teams and seek comprehensive and scalable SSCS platforms that integrate with existing security workflows.
• Public sector: This includes government agencies and organizations subject to regulatory compliance requirements. They prioritize secure SSCS platforms solutions that align with strict regulations.

In addition, we recognize the following deployment models:

• Cloud: The SSCS solution is hosted and managed by the vendor in the cloud, providing scalability without requiring local infrastructure.
• Hybrid: Hybrid solutions integrate both SaaS and on-premises components, allowing organizations to leverage cloud-based services and scalability while maintaining certain elements locally.
• On-premises: The solution is installed on local infrastructure or cloud infrastructure managed by the organization. This offers full control to adhere to compliance frameworks but requires internal resources for maintenance and updates.

Table 1. Vendor Positioning: Target Market and Deployment Model

Table 1 components are evaluated in a binary yes/no manner and do not factor into a vendor’s designation as a Leader, Challenger, or Entrant on the Radar chart (Figure 1).

“Target market” reflects which use cases each solution is recommended for, not simply whether that group can use it. For example, if an SMB could use a solution but doing so would be cost-prohibitive, that solution would be rated “no” for SMBs.

3. Decision Criteria Comparison

All solutions included in this Radar report meet the following table stakes—capabilities widely adopted and well implemented in the sector:

• Software composition analysis
• Integration with CI/CD
• Software bill of materials (SBOM) generation
• Policy management and enforcement
• Comprehensive auditing
• Vulnerability and threat intelligence integrations
• Dashboards for risk management

Tables 2, 3, and 4 summarize how each vendor in this research performs in the areas we consider differentiating and critical in this sector. The objective is to give the reader a snapshot of the technical capabilities of available solutions, define the perimeter of the relevant market space, and gauge the potential impact on the business.

• Key features differentiate solutions, highlighting the primary criteria to be considered when evaluating a software supply chain security solution.
• Emerging features show how well each vendor implements capabilities that are not yet mainstream but are expected to become more widespread and compelling within the next 12 to 18 months.
• Business criteria provide insight into the nonfunctional requirements that factor into a purchase decision and determine a solution’s impact on an organization.

These decision criteria are summarized below. More detailed descriptions can be found in the corresponding report, “GigaOm Key Criteria for Evaluating Software Supply Chain Security Solutions.”

Key Features

• Dependencies management: Comprehensive monitoring and management of software dependencies, both direct and transitive, is vital to ensure risks from vulnerabilities, licensing, and malicious code are mitigated.
• IaC security scanning: Users need to identify issues in cloud infrastructure before deployment to ensure alignment with security policies. To enable this, IaC security scanning analyzes IaC files for security vulnerabilities, malware, secrets, and misconfigurations.
• Container Image Security Scanning: Similar to IaC scanning, container scanning analyzes container images for vulnerabilities and misconfigurations. Since containers operate at the application level, additional capabilities differentiate the two features.
• Machine learning-based detection and response: All SSCS vendors offer some basic behavioral analytics capabilities, but not all of them use ML. Stronger solutions are beginning to use ML models to analyze patterns in code, builds, and deployments, look for anomalies, and identify potential security threats, then flag them for either investigation or remediation.
• Risk scoring and analysis: This feature ensures security teams can prioritize the greatest threats first. It identifies and prioritizes potential threats and vulnerabilities, enabling informed decision-making.
• Customization of security policies: With the unique requirements every business presents, customizable security policies allow organizations to tailor protection to their specific needs.
• Supply chain mapping and visualization: Detailed supply chain mapping and visualization provides crucial insights into complex dependencies and potential vulnerabilities.
• Automated security testing: Automated security testing (SAST, DAST, IAST) integrates continuous security checks into the software development lifecycle, scanning code, dependencies, and configurations for vulnerabilities. It employs a variety of tools and techniques to identify potential security flaws, misconfigurations, and compliance issues, enabling rapid detection and remediation of risks before they reach production environments.

Table 2. Key Features Comparison

Emerging Features

• Software exposure analysis: Software exposure analysis is a comprehensive set of measures that assist organizations in identifying their greatest risks. Effective analysis covers a wide range of potential threat vectors combined into a single view.
• Open source software governance: This feature encompasses the processes and tools that help organizations manage the use of open source software components throughout the software development lifecycle through tracking and inventorying and by ensuring license compliance.
• Automated remediation: Automated remediation streamlines the process of fixing identified security vulnerabilities and compliance issues in software supply chains. It leverages intelligent algorithms and predefined policies to automatically apply patches, update dependencies, or implement fixes, reducing manual intervention and accelerating the mitigation of potential threats.

Table 3. Emerging Features Comparison

Business Criteria

• Scalability: This metric reflects the ability of the solution to handle scaling, from dealing with multiple projects simultaneously to supporting complex organizational structures in large enterprise environments.
• Flexibility: Software development platforms continually undergo rapidly evolving changes throughout the SDLC, so a flexible software supply chain security platform should be able to operate in diverse environments and onboard new ones quickly, even as it responds to evolving threats.
• Cost: In ideal circumstances, any significant investment in an SSCS solution will be offset by the value of the risk mitigation it facilitates. Initially, decision-makers should consider the pricing model to determine whether a per-user or consumption-based plan meets organizational needs and will continue to scale.
• Compliance: Compliance in software supply chain security ensures adherence to regulatory requirements and industry standards and is increasingly important due to the growing risks associated with software supply chain breaches.
• Ecosystem: This metric indicates how well the solution integrates with other software in the SLDC and whether it interfaces with the cloud components of an organization’s existing IT environment. Ecosystems are crucial because they ensure seamless interaction, enhance defensive coverage, and increase the overall effectiveness of the security remediations.

Table 4. Business Criteria Comparison

4. GigaOm Radar

The GigaOm Radar plots vendor solutions across a series of concentric rings with those set closer to the center judged to be of higher overall value. The chart characterizes each vendor on two axes—balancing Maturity versus Innovation and Feature Play versus Platform Play—while providing an arrowhead that projects each solution’s evolution over the coming 12 to 18 months.

Figure 1. GigaOm Radar for Software Supply Chain Security

As you can see in the Radar chart in Figure 1, there is a significant concentration of 11 vendors positioned in the Maturity/Platform Play quadrant. This large cluster represents vendors focusing on incremental improvement of their solutions, with an emphasis on stability and continuity. In contrast, only six vendors appear in the Innovation/Feature Play quadrant, where they’re adding emerging features to improve their capabilities as they work toward appealing to a wider set of use cases and organizations.

The Feature Play versus Platform Play axis reveals a split in vendor strategies. While some players concentrate on specialized capabilities like SBOM management, code security testing tools, or binary analysis, the majority are striving to offer solutions that address a wide range of security needs throughout the SDLC. This split reflects the increasing need for comprehensive DevSecOps platforms that integrate security measures throughout the software supply chain, from development to deployment.

The SSCS market is a very competitive one in which many established vendors are rapidly consolidating features as they strive for market dominance, though none has yet achieved a clear advantage across all dimensions. However, several challengers with feature enhancements and new approaches to software security are demonstrating rapid innovation and market adoption, perhaps indicating the next generation of market leaders.

We see innovation driven by AI across vendors from both the top and bottom halves of the chart. That innovation includes the use of AI to build risk analysis models and provide remediation suggestions, as well as finding ways to ensure AI tools are captured as potential security risks.

While the majority of providers are rapidly advancing their offerings (Fast Movers), others struggle to keep pace with innovation or gain market traction (Forward Movers). This disparity underscores the challenge vendors face in driving ongoing product development while also being responsive to new threats in this sector.

There are a small number of Outperformers, categorized primarily by their strong performance on the emerging feature metrics and by their compelling roadmaps. These vendors will continue to set high capability standards that customers will expect all vendors to meet in the future.

Overall, the SSCS market is in a state of rapid growth and development, with established players being challenged by innovative newcomers. Comprehensive platforms will become the standard for organizations, as the importance of DevSecOps will shape the direction of this market, creating both opportunities and challenges for vendors.

In reviewing solutions, it’s important to keep in mind that there are no universal “best” or “worst” offerings; every solution has aspects that might make it a better or worse fit for specific customer requirements. Prospective customers should consider their current and future needs when comparing solutions and vendor roadmaps.

5. Solution Insights

Aikido Security

Solution Overview
Founded in 2022, Aikido Security is a software company that specializes in a developer-centric software security platform that provides advanced code scanning and cloud vulnerability assessments. The platform helps to prioritize real threats, reduces false positives, and makes vulnerabilities easily understandable for developers.

Aikido Security’s notable approach combines and leverages a number of open source security scanners in a single platform enhanced with proprietary code to cover any gaps. The solution provides cloud posture security management, dependency scanning, and software composition analysis (SCA), secrets detection, malware in dependencies, static and dynamic code analysis, IaC and container scanning, and attack blocking capabilities using Aikido Zen.

The company is working to improve its offering at a fast pace, with an aggressive roadmap that shows Aikido enhancing existing features and adding new capabilities.

Aikido Security is a Leader and Fast Mover positioned in the Innovation/Platform Play quadrant of the Radar chart.

Strengths
Aikido scored well on a number of decision criteria, including:

• Automated security testing: The solution includes both static and dynamic application security testing (SAST and DAST) solutions built on top of open source tools with customized rules and features.
• Risk scoring and analysis: The platform scores risks on an array of indicators that are customizable and allows organizations to add additional business context to repositories to aid in prioritizing.
• Dependencies management: Aikido’s dependency scanning capabilities continuously monitor for vulnerabilities and license compliance, and the solution offers remediation and automatic fix options.

Aikido Security earned a Fast Mover designation due to its high rate of development last year, adding expanded support for code repositories, cloud providers, container deployments, and virtual machine scanning. The solution also added automated remediation capabilities built around security testing and code suggestions.

Challenges
Aikido has room for improvement in a few areas, including:

• ML-based detection and response: The solution includes no such capabilities.
• Software exposure analysis: While the solution does offer some reachability analysis, improvements could be made to address prioritization and business impact.
• Supply chain mapping and visualization: The platform does have a simple view of individual security issues, but there are no visualizations to show a complete dependency tree or to provide a data flow view across the SDLC.

Purchase Considerations
Aikido Security licensing is tiered into two categories: Aikido Scan, which includes capabilities related to vulnerabilities and scanners, and Aikido Zen, which safeguards web apps at runtime. Aikido Scan has a free tier for small teams getting started, a discounted plan for startups with some eligibility limits, and Basic, Pro, and Custom plans for larger organizations, which scale by users. It also has some limits on how many repositories, images, and other items may be scanned. Aikido Zen is structured with the same tiers, but they are usage based according to requests, number of apps, and log retention.

By taking advantage of the free tier, customers can evaluate Aikido Security without needing to commit financial resources. However, organizations that require strong security should consider either the Pro or Custom tiers.

Use Cases
Aikido Security is a single solution that contains all major features, and the vendor is focusing on creating a robust platform for all use cases securing the supply chain.

Its comprehensive security services and robust data protection features make the platform an ideal choice for highly regulated industries, such as finance and healthcare, for which data integrity and compliance are paramount. Large enterprises can benefit from its scalability and automation capabilities, which are particularly valuable for organizations managing multiple applications and development teams. Additionally, Aikido Security has tailored its offering to accommodate development agencies, providing them with the flexibility to use its features across multiple Git workspaces, thus enhancing their workflow and security measures.

Anchore: Anchore Enterprise

Solution Overview
Founded in 2016, Anchore is a software company specializing in container security, software supply chain security, and federal government compliance. The company’s main product, Anchore Enterprise, is a fully managed SBOM-powered SCA platform for cloud-native security and compliance. It provides deep visibility into software components, identifies vulnerabilities and risks, and enforces security policies throughout the development lifecycle.

Anchore Enterprise generates and tracks SBOMs across the SDLC, from source code to production deployments, providing a detailed inventory of all software components, including direct and transitive dependencies. Employing a multilayered security approach, the platform continuously scans these SBOMs to identify misconfigurations, malware, secrets, license risks, and known vulnerabilities using a broad set of vulnerability feed sources. It applies a precision matching algorithm to accurately identify vulnerabilities while minimizing false positives.

Anchore is incrementally improving features in the platform by providing additional interoperability and compliance capabilities, along with alternative deployment models for its software. The solution leans heavily into its SBOM capabilities, making it a Feature Play.

Anchore is an Entrant and Forward Mover positioned in the Maturity/Feature Play quadrant of the Radar chart.

Strengths
Anchore scored high on a number of decision criteria, including:

• Dependencies management: The Anchore Policy Engine controls which dependencies are allowed in applications, and all metadata about dependencies is included in the platform’s SBOM management features.
• Container image security scanning: Anchore supports container scanning for all major formats as well as for many of the lesser known ones that other vendors do not support.
• Customization of security policies: The solution offers out-of-the box policy packs for regulated organizations and includes policy as code capabilities, which can be applied to data or metadata.

Challenges
Despite its good scores on a few key features, Anchore completely lacks some important capabilities, scoring zero for: IaC security scanning, ML-based detection and response, risk scoring and analysis, and supply chain mapping and visualization. It also lacks support for the emerging features: software exposure analysis and automated remediation.

Purchase Considerations
Anchore offers only on-premises deployment, so organizations must have the resources to manage this container-based deployment model. The company offers Pro and Premium licensing options, which are based on the number of users. The Pro tier, which allows only two users, is meant for SMBs and mature cloud-native users. Organizations that require a higher level of security with customized policy controls and want to start from an out-of-the-box policy pack or require more than 2,000 SBOMs to be generated in a month should select the Premium tier. Additional features, such as Kubernetes runtime security, ECS runtime security, and policy templates for FedRAMP and DoD customers, can be added at additional cost.

This solution is primarily suited for large enterprise customers and those with compliance requirements looking for SBOM management and software composition analysis.

Use Cases
Anchore strategically targets two primary industry verticals: regulated industries and enterprises. For regulated industries, particularly organizations dealing with the Department of Defense and FedRAMP, Anchore leverages its SBOM management features and robust reporting capabilities to assist with compliance across an expanding range of frameworks. In the enterprise sector, Anchore’s scalability and automation capabilities make it an ideal solution for large organizations managing multiple applications and development teams. In addition to SBOM management, Anchore also specializes in two additional key use cases: software composition analysis and container security scanning.

Aqua Security

Solution Overview
Founded in 2015, Aqua Security provides robust security solutions for containerized applications, serverless functions, and other cloud-native technologies.

The Aqua Cloud Native Security Platform is a comprehensive solution designed to secure cloud-native applications from development to production, and the Aqua SSCS platform is a module within the broader offering. Aqua SSCS combines static code scanning, SCA, IaC scanning, OSS health assessment, SBOM creation and analysis, pipeline integrity controls, toolchain governance controls, and the ability to create guardrails and gates at multiple points to ensure only trusted artifacts are allowed to progress and make it into production.

Supporting both agent-based and agentless security controls, the platform’s architecture is modular and extensible, allowing customers to select and deploy specific components, such as container security, based on their requirements.

Aqua is focused on incrementally improving the features in the platform, adding more language support, more risk analysis tools, and enhancing the user experience to ensure that organizations can leverage the tools included with the SSCS platform.

Aqua is a Leader and Forward Mover positioned in the Maturity/Platform Play quadrant of the Radar chart.

Strengths
Aqua scored high on a number of decision criteria, including:

• Container image security scanning: Aqua’s Trivy is an open source security scanner tool that is widely used by organizations and by some competitors to scan container images. The tool scans for vulnerabilities, malware, secrets, licensing and configuration issues, and can show vulnerability exploitability, reachability, and use in runtime.
• Automated security testing: Aqua SSCS provides robust code testing capabilities (SAST), as well as DAST tools for container security scanning at runtime. These tools also work security policies to ensure that, using continuous scanning, unapproved images are not deployed into production infrastructure.
• Supply chain mapping and visualization: The SSCS module creates a code-to-cloud infrastructure security graph that visualizes issues across both the supply chain and the cloud production environment, showing software inventory down to individual pipelines, repositories, and build artifacts. It will also display detailed threat mapping down to individual packages and versions.

Challenges
Aqua has room for improvement in a few areas, including:

• Risk scoring and analysis: Aqua provides average risk scoring, but the solution could be improved by adding data from more sources and incorporating contextual factors and other information, such as where sensitive information is stored or accessed by applications or which data a business has identified as important.
• ML-based detection and Response: Aqua primarily uses a human security team with AI tools to enrich its research for indicators of compromise (IoCs), and it also uses AI to assist with vulnerability remediation, enhancing both threat detection and mitigation processes. Aqua (and its customers) would benefit if it improved the automated response capabilities in the AI models being used.
• Software exposure analysis: Aqua SSCS adds prioritization to vulnerabilities that are reachable but could extend its capabilities to include automated remediation of discovered issues based on prioritization.

Purchase Considerations
Aqua Security offers a comprehensive suite of software supply chain security solutions, which may provide cost efficiencies for organizations looking to consolidate their security stack. While the platform is user-friendly, organizations with complex environments may benefit from professional services for optimal configuration.

The cloud-based deployment model eliminates on-premises infrastructure requirements, but potential buyers should review their data residency needs. Highly regulated organizations with on-premises infrastructure requirements should determine whether the AWS GovCloud deployment option meets their compliance requirements.

Licensing is based on the number of code repositories found in the source code management platforms, with flexible options to scale as organizational needs evolve.

Aqua SSCS should be licensed as a complete solution, and organizations should consider displacing incumbent solutions in order to take full advantage of the synergy across the platform. The full Aqua cloud-native application protection platform (CNAPP) solution should be evaluated for additional use cases across the organization.

Use Cases
Aqua is well-suited for organizations across most industries, particularly those with complex application environments and stringent security requirements. Aqua caters to a diverse range of verticals, with a particular focus on two key areas. First, it serves highly regulated industries such as finance, healthcare, and US federal agencies, leveraging its comprehensive security services and robust data security features to meet their strict requirements. Second, Aqua offers scalability and automation capabilities that are ideal for large organizations managing numerous applications and development teams. The platform’s features enable Aqua to effectively support the complex needs of both compliance-driven sectors and large-scale business operations.

Bytesafe

Solution Overview
Founded in 2018, Bytesafe is a security platform that protects organizations by securely managing software packages and dependencies in all parts of the software supply chain. In 2024, Bytesafe integrated its SBOM Observer into its core offering to help customers manage SBOMs and provide insights into their software supply chains.

The Bytesafe platform offers a comprehensive suite of features designed to enhance software security and management and provides cloud-based package management for both private and public software components. Its Dependency Firewall provides a number of functions to protect third-party packages, versions, and licenses, effectively blocking potential threats. SBOM Observer not only manages SBOMs, it also offers SCA tools, conducts impact analysis, and maintains a complete software inventory.

The platform continuously tracks license compliance to ensure adherence to legal requirements. Additionally, Bytesafe’s issue-tracking system automatically creates issues when problems are detected by the Dependency Firewall or SCA, which is integrated into various CI/CD platforms.

Bytesafe is a feature-focused solution, and the company is currently working to develop new integrations and capabilities to fix feature gaps and is actively improving SBOM Observer’s features and integration capabilities.

Bytesafe is a Challenger and Fast Mover positioned in the Innovation/Feature Play quadrant of the Radar chart.

Strengths
Bytesafe scored high on a number of decision criteria, including:

• Risk scoring and analysis: Bytesafe helps organizations prioritize the vulnerability remediation process, using a combination of risk scoring and impact analysis to determine the practical effect of each risk.
• Customization of Security Policies: The platform offers two options for configuring security policies: a visual policy builder for the most common policies and the ability to write custom policies using code, which allows access to the entire domain of options and conditions to meet an organization’s compliance objectives.
• Supply Chain mapping and visualization: The platform offers multiple levels of visualization across the SDLC, from endpoint to coding environment to servers and components to vulnerabilities.

Challenges
Despite its high scores on many criteria, Bytesafe completely lacks some important capabilities, including the key features of IaC security scanning, ML- based detection and response, and automated security testing. It also does not support the emerging feature of automated remediation.

Purchase Considerations
The platform’s combination of package management and the additional features included with SBOM Observer, along with its competitive pricing for up to 100 users, makes it a viable option for SMBs. Organizations requiring automated security testing or IaC scanning will need to consider alternative solutions. If an organization requires additional integrations, on-premises deployment, or advanced compliance features, it should evaluate the Enterprise package.

Use Cases
Organizations in regulated industries can rely on Bytesafe for critical security and compliance needs. Healthcare providers can maintain FDA-compliant software documentation while financial institutions can use the solution to meet SEC cybersecurity requirements through comprehensive SBOM tracking. Government contractors can use the platform to demonstrate compliance across federal procurement processes, streamlining formerly manual documentation tasks. Beyond regulatory requirements, security teams can leverage Bytesafe to monitor vulnerable components across their enterprise software portfolio, while DevSecOps teams track third-party dependencies in real-time for potential risks.

Check Point: CloudGuard

Solution Overview
Founded in 1993, Check Point Software Technologies Ltd. is a multinational provider of IT security solutions. Its CloudGuard solution is a cloud native application protection platform (CNAAP) whose security strategy emphasizes a prevention-first model, integrating security measures early in development to detect and mitigate risks before they reach production.

Check Point’s CloudGuard Cloud Workload Protection Platform (CWPP) is designed to protect cloud workloads through continuous security assessments and scanning. It includes CloudGuard Container Security, which offers a comprehensive approach to securing cloud software assets across the entire SDLC. Check Point’s CloudGuard Code Security module integrates into developers’ IDEs and CI/CD tools, scanning code and IaC templates for vulnerabilities, compliance issues, and secrets, thus ensuring secure software development practices.

The Check Point CloudGuard solution takes a comprehensive approach to software security, addressing various aspects of the development and deployment lifecycle. The platform has evolved to meet emerging cybersecurity challenges and has introduced new features to enhance its overall effectiveness in protecting a company’s SDLC and applications, ensuring they remain robust and relevant in the face of evolving threats.

Check Point is a Leader and Outperformer positioned in the Innovation/Platform Play quadrant of the Radar chart.

Strengths
Check Point scored high on most of the decision criteria in this report, including:

• IaC security scanning: The scanner identifies misconfigurations and security risks in IaC templates, with risk detection and compliance checks evaluated during analysis. Assets are continuously monitored, and the platform delivers real-time alerts to security teams.
• Container security scanning: The Workload Protection module scans for vulnerabilities and malware within container images and continuously monitors the registry and runtime of containers.
• Risk scoring and analysis: Check Point’s risk scoring provides a comprehensive assessment of vulnerabilities based on impact, exploitability, and prevalence in code. Organizations can customize the way risks are scored based on specific risk tolerances, security policies, and business impact. Risk scoring is continually analyzed, and the feature adds contextual analysis to scoring metrics.

Check Point earned an Outperformer designation due to its high rate of development in the last year, high release cadence, and strong roadmap for the coming year.

Challenges
Check Point has room for improvement in a few areas, including:

• Automated security testing: While this solution’s primary focus is on SAST testing, the company encourages organizations to adopt additional tools to provide DAST and interactive security testing (IAST) support.
• Dependencies management: Though the Code Security module offers vulnerability detection, version analysis, and license compliance, automated patching and code fixes are not part of this feature.

Purchase Considerations
Each Check Point product is licensed differently. CloudGuard Code Security is sold per developer, while CWPP is sold as part of the broader CloudGuard CNAPP and is priced per cloud asset. Organizations who already license other Check Point solutions should consider how their existing toolsets complement this offering.

Check Point CloudGuard can be deployed via a SaaS, hybrid, or on-premises model. Each option can be tailored to meet business needs, although regulated companies should consider the hybrid or on-premises options, depending on regulatory requirements.

While the CNAPP platform has extensive capabilities primarily aimed at large enterprises, smaller organizations that need to protect their software development process should consider implementing CloudGuard Code Security to secure the development processes.

Check Point CloudGuard should be licensed as a complete solution, and organizations should consider displacement of incumbent solutions in order to take full advantage of the synergy across the platform. The full CNAPP solution should be evaluated for additional use cases across the organization.

Use Cases
Check Point CloudGuard is well-suited for organizations across various industries, particularly those with complex application environments and stringent security requirements. Key use cases include highly regulated industries like finance and healthcare because of the solution’s comprehensive security services and data security features.

Enterprises benefit from its scalability and automation, making it well suited for large organizations with numerous applications and development teams. DevOps and DevSecOps teams can leverage the automation capabilities and integrations for seamless adoption into existing development workflows, integrating security testing into CI/CD pipelines for early and continuous vulnerability detection.

Checkmarx: Checkmarx One

Solution Overview
Checkmarx is an application security testing vendor that offers a range of solutions for identifying and addressing security vulnerabilities. The company has expanded its capabilities through acquisitions, including the purchase of Dustico in 2021 for secrets detection. Checkmarx One, a comprehensive application security platform, is focused on both identifying risks and remediating them across the entire application footprint and software supply chain, within one seamless platform that serves all relevant stakeholders.

Checkmarx One integrates multiple security testing methodologies. At its core, it offers static analysis (SAST) for source code vulnerability detection, dynamic analysis (DAST) for testing running applications, and API security. The platform also includes software composition analysis (SCA) to identify vulnerabilities and malicious code in open source components, AI security capabilities to enable secure use of AI code generation tools while defending against AI-related threats, repository health scoring to assess repository-level application risk, and secrets detection to identify sensitive credentials that may have been unintentionally exposed. Checkmarx One further extends its security coverage for cloud-native applications with IaC security and a dedicated container security solution to protect containerized applications throughout their development lifecycle. This modular approach allows organizations to address a wide range of application security concerns within a single, integrated platform.

Checkmarx is a Leader and Fast Mover positioned in the Maturity/Platform Play quadrant of the Radar chart.

Strengths
Checkmarx scored high on most of the key features in this report, including:

• IaC security scanning: Checkmarx offers IaC scanning in its paid offering as well as in a free open source tool, Keep Infrastructure as Code Secure, or KICS, which is also used by other vendors in their product offerings. The scanning tool provides automatic detection, analyzing IaC files to find vulnerabilities or misconfigurations. This analysis includes an extensive set of categories, including access control, best practices, structure, and semantics.
• Risk scoring and analysis: Checkmarx ASPM (application security posture management) aggregates risk and vulnerability data across Checkmarx solutions and other third-party integrated security solutions. The platform combines security posture, vulnerability, malware, and licensing risks to generate a risk score. The tool also provides prioritization of remediation efforts. This feature includes access to a database of third-party package risks that can be evaluated before incorporating into software.
• Automated security testing: The platform includes all three automated security testing tools, SAST, DAST, and API security, with a broad range of languages and frameworks supported.

Challenges
Checkmarx has room for improvement in a few areas, most notably support for the key feature of supply chain mapping and visualization, which it lacks. It could also bolster support for a pair of emerging criteria:

• Software exposure analysis: Checkmarx integrates with other vendors to find risk data for containers and identify which services are publicly available, which it then associates back to projects and repositories. Checkmarx could improve by adding automated remediation and incident response integration capabilities.
• Open source governance: The solution enables users to manage vulnerabilities and licensing risks, and they can also access Checkmarx’s knowledge center for additional information regarding certain risks in open source software. For a better rating in this area, the solution should expand automated policy enforcement, advanced auditing, and validated code features, which would allow for deeper management of open source in the SDLC.

Purchase Considerations
Checkmarx One is offered in several packages: Start with SAST, Essentials, Professional, and Enterprise. All packages are priced based on the number of contributing developers and vary by the features included. Organizations should consider their requirements to determine which product meets their specific needs, keeping in mind that some advanced features can be added onto the Start with SAST and Essentials packages.

The platform allows organizations to deploy into the Checkmarx managed SaaS infrastructure or into a single tenant configuration in the organization’s account, which can impact the way regulated companies consume the product. For organizations in highly regulated environments, additional deployment options are available.

Checkmarx also offers managed services, with price and scope based on customer needs, including by software project, groups of applications, and entire application security program.

Checkmarx should be licensed as a complete solution at the Professional and Enterprise tier, which will provide the broadest range of features to secure the entire SDLC. Organizations should consider displacing incumbent solutions in order to take full advantage of the synergy across the platform.

Use Cases
Checkmarx caters to a wide range of use cases across diverse industries. Key use cases include highly regulated industries like finance and healthcare because of the comprehensive security services and data security features it offers. Enterprises benefit from its scalability and automation, making it well suited for large organizations with numerous applications and development teams. DevOps and DevSecOps teams can leverage the automation capabilities and integrations for seamless adoption into existing development workflows, integrating security testing into CI/CD pipelines for early and continuous vulnerability detection.

Cloudsmith

Solution Overview
Cloudsmith is a cloud-native solution for managing and securing the software supply chain by serving as a universal artifact repository and control center for all of the software assets within an organization. The platform scans and caches essential packages, ensuring a secure and controlled environment for software development and deployment. It provides a single source of truth for an organization’s software components, including public, private, and open source packages. Along with artifact management, Cloudsmith provides a dependency firewall, which prevents critical issues from making it into production; a globally distributed infrastructure for the deployment of packages; and Cloudsmith Navigator, which combines data from various sources to provide novel insights into the quality of open source packages.

Cloudsmith’s distinct approach to software supply chain security is notable, and the company will continue to build new features into the platform and develop deeper integrations to secure the development process.

Cloudsmith is a Challenger and Fast Mover positioned in the Innovation/Feature Play quadrant of the Radar report.

Strengths
Cloudsmith scored high on a number of decision criteria, including:

• Dependencies management: Cloudsmith offers real-time management of direct and indirect dependencies at the repository level, allowing developers to reference code in the artifact management storage.
• Open source governance: By combining the artifact repository and the dependency firewall, Cloudsmith ensures developers are working from code that is evaluated against security policies and assessing public repositories for code quality.
• Customization of security policies: Cloudsmith offers a robust customization option for policies as applied to the SDLC, and these policies are evaluated within the dependency firewall.

Challenges
Cloudsmith has room for improvement in a few areas. IaC security scanning and ML-based detection and response—both key features in the report—are not supported in the Cloudsmith offering. And Cloudsmith’s container image scanning services are mostly limited to vulnerabilities. For more complete security, the solution should be able to scan runtimes and scan continuously. Finally, Cloudsmith does not offer automated security testing; rather, it integrates with vendors that provide these services. However, with its API integration, Cloudsmith can provide control over the assets in use to ensure any findings are covered under Cloudsmith policies.

Purchase Considerations
Cloudsmith licensing consists of four tiers: Core, Pro, Velocity, and Ultra. There are no limits on users or number of packages; instead, pricing is determined based on artifact data and package delivery in GB. Organizations that require a higher level of security should consider the Velocity or Ultra tiers. With the lowest tier having zero cost, both SMB and enterprise customers can evaluate Cloudsmith without needing to commit financial resources.

Organizations intending to move their artifact management to a fully managed cloud-native solution with robust security controls, and those that need to distribute software globally, should take a look at this vendor.

Cloudsmith does not compete with security tools that include automatic security testing and scanners but ingests their scan data to support policy management and compliance requirements. Organizations requiring such capabilities will need to ensure the solutions they choose can integrate with Cloudsmith.

Use Cases
Cloudsmith is well suited for organizations across various verticals, particularly highly regulated industries such as finance, healthcare, and government, due to its comprehensive security services, data security features, and artifact management capabilities. Its scalability and automation also make it an excellent choice for large enterprises with numerous applications and development teams. Key use cases for Cloudsmith include artifact management, global distribution of software packages, and ensuring the quality of open source software. These features and use cases make Cloudsmith a versatile and powerful solution for organizations seeking robust software management and distribution tools.

Cycode: Cycode Complete ASPM

Solution Overview
Founded in 2019, Cycode is a complete application security posture management (ASPM) and SSCS platform for developer security that can integrate or replace an organization’s existing security testing tools while providing visibility, prioritization, and remediation of vulnerabilities across the entire SDLC. In March of 2024, Cycode acquired Bearer, which combines sensitive data context with static code analysis to assist organizations in making security and privacy decisions.

Cycode Complete ASPM is a modular platform that works with Cycode’s Risk Intelligence Graph for prioritization and code-to-cloud traceability across the software supply chain. The platform comprises three essential modules designed to enhance security throughout the application lifecycle. Application Security Testing encompasses SCA, application security testing, and scanning for IaC and containers. Pipeline Security focuses on safeguarding CI/CD processes by detecting secrets, ensuring CI/CD security, preventing source code leakage, and hardening builds with artifact integrity. Finally, ConnectorX serves as an integration platform that facilitates the connection of third-party security tools, further strengthening the overall security framework.

Cycode is a Leader and Fast Mover positioned in the Innovation/Platform Play quadrant of the Radar report.

Strengths
Cycode scored high on a number of decision criteria, including:

• Ecosystem: Cycode has an extensive marketplace of integrations and connectors covering tools that security and engineering teams need across the SDLC, including third-party application security tools and supply chain security competitors.
• Risk scoring and analysis: Cycode delivers dynamic risk scoring that continuously updates risk scores in real time, providing organizations with an accurate assessment of their security posture. By incorporating business impact analysis into its risk calculations, Cycode also ensures security findings are contextualized within the organization’s specific operational framework. This real-time approach ensures security efforts are always aligned with current threats and business priorities, maximizing the effectiveness of security initiatives.
• IaC security scanning: The platform continuously monitors IaC templates and code, looking for configuration drift and misconfigurations while analyzing for policy violations. When policy violations are detected, the code suggestion engine offers recommendations for code fixes and can also auto-resolve vulnerabilities in the CI/CD workflow.

Challenges
Cycode has room for improvement in a few areas. These include:

• Automated remediation: While Cycode offers AI-generated code fixes, it could expand them to include patching, and it could integrate more closely with open source teams to address vulnerabilities.
• Container image security scanning: The platform focuses on vulnerabilities in containers but could improve by adding runtime protection and image-hardening suggestions.
• Software exposure analysis: While the solution checks for exposed code in public repos and provides exposure path analysis, it doesn’t offer automated remediation of actively exploitable vulnerabilities in production code.

Purchase Considerations
Cycode’s pricing structure is easy-to-understand, as it is priced per developer, with access to all tools included in the platform.

The platform’s extensive features and scalability make it a valuable investment for any organization, but smaller organizations may need to prioritize implementation of specific components based on their needs. The platform allows organizations to deploy in the Cycode SaaS infrastructure or using a hybrid or on-premises model, which provides options for the ways regulated companies consume the product.

While Cycode can be licensed as a complete solution, organizations should take full advantage of the synergy across the platform with the deep integrations and marketplace; other tools and vendors can be added to the platform’s application risk engine for visibility, prioritization, and remediation efforts.

Use Cases
Cycode Complete ASPM is an ideal solution for organizations across diverse industries and use cases. Its scalability and automation cater to large organizations with extensive applications and multiple development teams. SMBs can also benefit because the suite of tools helps to protect their software development processes while allowing for growth and the addition of features as needed. Additionally, organizations with existing toolsets can seamlessly integrate Cycode through the ConnectorX marketplace, enabling them to continue using their current tools while enhancing their security measures or replacing them as necessary.

Fortinet: Lacework FortiCNAPP

Solution Overview
Founded in 2000, Fortinet is a cybersecurity company providing a broad portfolio of network security products and solutions that protect networks, users, and data from evolving threats. To bolster its cloud and container security capabilities, Fortinet acquired Lacework, an AI-powered CNAPP provider, on August 1, 2024, and Next DLP, a data security startup, on August 5, 2024.

FortiCNAPP offers comprehensive software supply chain security through multiple integrated capabilities. It includes IaC scanning to detect misconfigurations before deployment, vulnerability management for containers and hosts, and anomaly detection using machine learning. The platform provides cloud security posture management (CSPM) to assess cloud configurations and cloud infrastructure entitlement management (CIEM) to optimize access permissions. It enforces security policies and compliance automatically, integrates security into CI/CD pipelines and repositories, and performs code security analysis, including SBOM generation, software composition analysis, and SAST capabilities. Fortinet delivers these features as a SaaS offering, with options for on-premises deployment of certain components, like code scanners and agents.

Fortinet is focused on incrementally improving platform features by adding more language support, more format support in other tools, and by integrating the Lacework platform with Fortinet products to ensure organizations can leverage the tools included with the SSCS platform.

Fortinet is a Leader and Fast Mover positioned in the Maturity/Platform Play quadrant in the Radar chart.

Strengths
Fortinet scored high on a number of decision criteria, including:

• IaC security scanning: This feature analyzes infrastructure code templates before deployment to detect potential misconfigurations and vulnerabilities, and provides automated remediation and suggested changes to reduce risk and meet security policies. Fortinet also provides hardened IaC deployment templates and out-of-the-box policies so organizations can get secure quickly.
• Risk scoring and analysis: The solution employs a comprehensive and nuanced approach to risk scoring and analysis and is designed to provide continuous, contextual assessments of threats using contextual analysis, threat intelligence feed integrations, exploitability and business impact assessments, attack path analysis, and analysis of asset coverage, exposure level, exploit data, and a determination of whether the package is active in running workloads.
• Customization of security policies: Fortinet offers deep capabilities for customizing security policies and frameworks combining templates with customization. It also includes the ability to turn policy into code using custom queries.

Challenges
Fortinet has room for improvement in a few areas, including:

• Dependencies management: Though the platform is able to track dependencies in real time and assess license compliance, it does not have automated updates and patching for open source packages but does offer remediation suggestions in the IDE and includes SmartFix, which reviews all dependencies, making recommendations for versions that do not include common vulnerabilities and exposures (CVEs).
• Open source governance: While the solution provides sufficient information about vulnerabilities and license compliance, Fortinet could improve it by adding automated governance for new open source usage, deeper policy enforcement capabilities, and additional auditing.
• ML-based detection and response: Though the solution does offer some risk analysis using ML models, it would require the addition of the vendor’s FortiSOAR product to include automated response capabilities and the ability to leverage self-learning models.

Purchase Considerations
This solution is offered only as a SaaS solution through which some of the agents and scanners can be used within a customer’s network. The cloud-based deployment model eliminates on-premises infrastructure requirements, but potential buyers should review their data residency needs. Highly regulated organizations with on-premises infrastructure requirements need to carefully determine whether the SaaS option meets their compliance requirements.

Licensing is based on the number of developers and includes unlimited scanning. This per-seat flexible option scales as organizations grow in developer headcount. With the recent mergers, organizations should reach out to the vendor to confirm integration timeline and to discover any upcoming pricing changes.

Lacework FortiCNAPP should be licensed as a complete solution, and organizations should consider displacement of incumbent solutions in order to take full advantage of the synergy across the platform. If an organization is already a customer and looking to add SSCS capabilities, native integration with other products in the platform can extend existing security procedures into code security.

Use Cases
Fortinet caters to a wide range of use cases across diverse industries. Its comprehensive security services and data protection features make it a suitable choice for highly regulated sectors like finance and healthcare. DevOps and DevSecOps teams benefit from its automation capabilities and integrations, enabling seamless integration into existing development workflows and incorporating security testing into CI/CD pipelines for early and continuous vulnerability detection. Additionally, Fortinet’s scalability and automation make it ideal for large enterprises with numerous applications and development teams.

FOSSA*

Solution Overview
Founded in 2015, FOSSA provides a platform that helps organizations manage and maximize open source software while remaining secure and compliant, enabling them to track the open source portions of their code with automated license scanning, vulnerability, and SBOM management. In August of 2024, FOSSA acquired StackShare, a company that helps developers discuss, track, and share the tools they use to build applications.

The FOSSA platform comprises four major components that work together to ensure comprehensive project oversight. FOSSA Compliance scans all projects for licensing issues and assesses them against established policies. FOSSA Security focuses on identifying vulnerabilities within the code. FOSSA Quality evaluates the overall quality of the code and examines project dependencies. Lastly, FOSSA SBOM Management handles SBOMs, whether imported or generated, and facilitates hosting or publishing them for distribution beyond the organization.

FOSSA is focused on meeting regulatory and customer requirements regarding a complete inventory of software products developed both internally and for customers.

FOSSA is an Entrant and Forward Mover positioned in the Innovation/Feature Play quadrant of the Radar chart.

Strengths
FOSSA scored relatively well on a few decision criteria, including:

• Dependencies management: FOSSA offers real-time monitoring of direct and indirect dependencies that connect with the SBOM management capabilities, creating a holistic inventory of software that allows integration with DevOps patching and pull requests.
• Open source governance: With the customizable filters and policies available, users are able to manage vulnerabilities and licenses in their open source software. The solution also integrates with IDE environments and offers alerts that can be integrated into an organization’s messaging channels.
• Customization of security policies: FOSSA’s security policy engine automatically deploys, manages, and enforces granular security policies using customizable rules. Software vulnerabilities can be managed via allow or deny policies that filter for severity and weakness analysis. In addition, the system can be configured to identify open source vulnerabilities and block problematic code review pull requests. Organizations are thus able to have complete visibility into affected dependency versions and projects, which allows them to understand the scale and scope of their security issues.

Challenges
However, FOSSA completely lacks some important capabilities. These include IaC security scanning, ML-based detection and response, and automated security testing.

Purchase Considerations
FOSSA has an easy-to-understand pricing structure that includes a free tier that allows businesses to get started without a financial commitment. There are two other tiers: Business, with more customization and workflow integrations, and Enterprise, with advanced security and compliance automation; and two potential add-ons—Advanced Security for Business and SBOM Management.

Organizations needing to meet regulatory compliance and pass audits should consider the features of this platform, but they will need to consider other platforms if they are looking for security testing that goes beyond vulnerabilities. Adding the SBOM Manager product into the total cost should be considered, as companies must supply SBOMs for compliance. This tool represents significant time savings for developers and DevSecOps teams required to maintain SBOMs for all software used within an enterprise.

Use Cases
FOSSA targets several key industry verticals, including regulated industries, government, and organizations of all sizes, and it is accessible to smaller teams and startups through its free tier, which includes vulnerability management, license compliance, and container scanning for up to 25 contributors. For regulated industries and the government sector, FOSSA provides SBOM management features and robust reporting capabilities to help organizations comply with a growing list of regulatory frameworks.

The platform focuses on specific use cases such as SBOM management, vulnerability and license management, and compliance and auditing.

GitHub: GitHub Advanced Security*

Solution Overview
GitHub is a leading software developer platform that provides tools for code hosting, project management, and team collaboration and hosts millions of repositories and projects. It was acquired by Microsoft in 2018 and continues to operate as a standalone business, but the acquisition accelerated its growth and the rate of release for new features.

GitHub Advanced Security comprises a set of tools to help developers build more secure software. It includes scanning capabilities for finding vulnerabilities in code and for preventing the leak of sensitive information. Further capabilities include secret scanning, SBOM generation, and management of dependencies, with the ability to define and create rules for automated remediation. It is part of the larger GitHub offering and requires organizations to subscribe to GitHub Enterprise or have Azure DevOps. For AI-powered security remediations, organizations will also need to include Copilot Enterprise.

GitHub provides options for all organizations, from free public code repositories to advanced enterprise features, and will continue incrementally improving current features.

GitHub is a Challenger and Forward Mover positioned in the Maturity/Feature Play quadrant of the Radar report.

Strengths
GitHub scored high on a number of decision criteria, including:

• Dependencies management: Advanced Security includes a dependency graph to trace direct and transitive dependencies in code, alerting against policy violations and including automatic version updates.
• Customization of security policies: GitHub does an excellent job of enabling organizations to customize policies related to secure access, code inclusion, secrets usage, and code branching. The platform also allows organizations to create policies from code, enabling replication across instances.
• Automated remediation: The platform can automatically patch known vulnerabilities and apply updates to code repositories. In addition, Copilot Autofix can offer code suggestions, apply fixes, and create pull requests for remediating security vulnerabilities.

Challenges
GitHub has room for improvement in a few areas. By focusing on the creation and testing of code in the SDLC, Advanced Security lacks the tools needed for IaC security scanning and container image security scanning. While other solutions can integrate with GitHub and leverage Actions to assist with remediation efforts, without these features native to the platform, organizations will have to add other solutions to fill these gaps, increasing the complexity of workflows and deployments.

GitHub is deemed a Forward Mover in this report due its lack of a roadmap which would add capabilities in IaC and container security.

Purchase Considerations
Organizations considering GitHub Advanced Security should evaluate their specific software supply chain security needs and the extent to which they rely on the GitHub platform. If they already use GitHub for collaboration and code management, the integrated security features can be a valuable addition.

Licensing is clear to navigate, as each product is licensed per developer, but organizations will need to be on the Enterprise tier to take advantage of the Advanced Security and Copilot options.

If organizations require the missing scanning capabilities, they will need to integrate with other vendors. Because most other vendors recognize GitHub as one of the largest public code repositories, most are capable of integrating with it.

Use Cases
GitHub caters to a wide range of use cases across diverse industries, including highly regulated sectors like finance and healthcare, because its comprehensive security services and data protection features ensure compliance and safeguard sensitive information. It is also ideal for DevOps teams, offering automation capabilities and seamless integration into existing development workflows, enabling smoother operations. Additionally, GitHub’s scalability and automation tools make it well suited for organizations of all sizes, allowing businesses to grow, adapt, and add features as needed.

GitLab: GitLab Ultimate*

Solution Overview
GitLab is a provider of a leading web-based DevOps platform that offers a complete solution for software development, collaboration, and deployment. The company’s focus on a single application for the entire DevSecOps lifecycle has resonated with development teams seeking an integrated and efficient workflow. In March of 2024, GitLab acquired Oxeye, with the initial focus on accelerating GitLab’s SAST roadmap.

GitLab offers three pricing tiers: Free provides basic features for individuals and small teams, while Premium adds advanced CI/CD and security capabilities, and Ultimate supplies enterprise-grade features. There are also self-managed and dedicated solutions that allow on-premises and public or private cloud deployments with similar tier options. GitLab Duo, available with the Premium and Ultimate, adds AI-powered features to assist developers.

GitLab continues to expand its platform through organic development, adding new features and capabilities to address various aspects of the SDLC security.

GitLab is a Challenger and Fast Mover positioned in the Maturity/Platform Play quadrant. The platform boasts a robust foundation, offering reliable performance and consistent functionality. Its established architecture ensures stability, minimizing disruptions and unexpected changes.

Strengths
GitLab scored high on a number of decision criteria, including:

• Dependencies management: This feature scans projects for dependencies, detects vulnerabilities, and provides suggestions for recommended updates. It supports multiple languages, integrates with CI/CD pipelines, and provides detailed reports. Users can automate dependency updates, view dependency graphs, and receive alerts for security issues in third-party components.
• ML-based detection and response: Within the core Ultimate pricing tier, AI models are used to evaluate risk and enrich reporting capabilities for highest risks. The GitLab Duo AI suggestions also have vulnerability explanations, root cause analysis, and code generation features.
• Automated security testing: GitLab Ultimate includes tools for both SAST and DAST integrated directly in IDE environments and offers continuous scanning.

Challenges
GitLab has room for improvement in a few areas, including:

• IaC security scanning: The solution uses KICKS, an open source scanner that scans for vulnerabilities and generates merge requests integrated with approval workflows. A more robust solution would include misconfiguration detection and additional proprietary enhancements on top of the KICKS platform.
• Container image security scanning: Though the solution scans for vulnerabilities and can provide auto-generated suggestions for remediation efforts, a more advanced feature would add hardening suggestions, prebuilt images, or policy templates.
• Supply chain mapping and visualization: While GitLab does not include a graphical representation of the supply chain, there are reports that show dependencies in a table format. The product should be able to show dependencies across the supply chain and demonstrate how reachability exists in the supply chain.

Purchase Considerations
While GitLab offers two other pricing options and the Premium tier includes SAST, secret detection, and some basic policy control, organizations with extensive security requirements should consider GitLab Ultimate, which includes the highest level of customization and features. Customers can choose among a SaaS, self-managed, or dedicated instance public cloud, offering flexibility. There are also add-ons specifically designed for AI coding assistance that are available for an additional cost in two tiers, Pro and Enterprise. All tiers are priced per user.

GitLab Dedicated, hosted on a dedicated cloud instance, includes all features of Ultimate but also meets the needs of organizations that require data isolation, residency, and additional security features to meet regulations. This option requires a 1,000-seat minimum commitment and should be considered only by large enterprises.

Organizations that are already customers of GitLab or those evaluating, implementing, or migrating to a new DevOps solution should consider using the Ultimate tier to consolidate costs and reduce complexity in their companies.

Use Cases
GitLab caters to a wide range of use cases across diverse industries. For highly regulated sectors like finance and healthcare, its comprehensive security services and data protection features make it an ideal choice. DevOps and DevSecOps teams benefit from its automation capabilities and integrations, enabling seamless integration into existing development workflows while incorporating security testing into CI/CD pipelines for early and continuous vulnerability detection. Additionally, its scalability and automation features make GitLab a perfect fit for large enterprises, as it supports organizations with numerous applications and development teams.

JFrog: JFrog Software Supply Chain Platform*

Solution Overview
Founded in 2008, JFrog provides a comprehensive software supply chain platform. In May 2024, JFrog partnered with GitHub to integrate their platforms and ease developer workflows. In June 2024, JFrog announced the acquisition of Qwak AI, an AI workflow and MLOps company, to bolster JFrog’s existing offerings and provide a unified platform for developers.

The JFrog Platform takes an integrated approach to software supply chain security, embedding it within the tools and workflows developers use throughout the software development lifecycle. JFrog’s modular architecture allows for seamless integration and scalability, ensuring the platform can handle the demands of large-scale enterprise environments.

The platform’s components include JFrog Artifactory, JFrog Xray, JFrog Pipelines, JFrog Curation, JFrog Advanced Security, JFrog Distribution, JFrog Runtime, and JFrog ML. JFrog Artifactory is the core repository manager, providing a secure, single source of truth for all artifacts and dependencies. JFrog Xray is a universal SCA and security tool that performs deep security scans, vulnerability detection, and license compliance checks. JFrog Pipelines facilitates CI/CD orchestration and workflow automation, ensuring security checks are integrated into the development pipeline, while JFrog Distribution enables secure and efficient distribution of software updates. Additionally, JFrog Advanced Security extends these capabilities with contextual vulnerability analysis and code scanning, providing a more comprehensive security posture for containerized applications.

JFrog is a Challenger and Fast Mover positioned in the Maturity/Platform Play quadrant. The company’s continuous innovation and steady growth in the software supply chain security space are evident in its comprehensive and expanding feature set, with existing features widely used in regulated industries.

Strengths
JFrog scored high on a number of decision criteria, including:

• Automated security testing: JFrog Xray provides robust code testing capabilities, and though it doesn’t provide any DAST or IAST tools, it is committed to integrations with other vendors who provide these capabilities.
• IaC security scanning: JFrog Xray analyzes IaC templates and configurations for potential misconfigurations and security risks before deployment across most popular IaC tools. The scanner checks configurations against security policies, providing detailed reports and remediation suggestions with additional context on each vulnerability to ensure secure and compliant deployments.
• Container image security scanning: JFrog Xray provides a comprehensive security analysis of container images by examining all layers for vulnerabilities, license compliance issues, and security risks. The product provides continuous monitoring, runtime scanning, alerting, and detailed reports with remediation suggestions. It can also scan container binaries without access to source code.

Challenges
JFrog has room for improvement in a few areas, including:

• ML-based detection and response: JFrog incorporates some machine learning capabilities for security scanning and vulnerability detection, but these features do not use a level of automation that other vendors employ when offering automated remediation suggestions.
• Supply chain mapping and visualization: The solution provides a simple table for displaying dependencies, vulnerabilities, and tools. However, it could be improved by adding a detailed graphical representation showing how everything is related along the entire development pipeline to assist teams with assessing risk.
• Automated remediation: While JFrog can block deployment of vulnerable artifacts based on security policies, it does not have the ability to suggest code fixes. It does integrate with other tools that provide automated pull requests and code suggestions, but remediation requires manual intervention by developers.

Purchase Considerations
The JFrog Platform offers flexible deployment options to cater to different organizational needs. It can be deployed as a self-hosted solution, allowing organizations to maintain control over their infrastructure, or as a fully managed SaaS offering hosted on major cloud service providers. The platform supports multicloud environments, enabling organizations to distribute their container repositories and security scanning across different cloud providers or hybrid setups. This flexibility extends to the platform’s integration capabilities, allowing it to fit into existing CI/CD pipelines and DevOps workflows, enabling security checks at multiple stages of the container lifecycle.

Use Cases
JFrog caters to a wide range of use cases across diverse industries. Its comprehensive security services and data protection features make it an ideal solution for highly regulated industries such as finance and healthcare. DevOps teams benefit from its automation capabilities and integrations, enabling seamless integration into existing development workflows. Additionally, JFrog’s scalability and automation features make it well suited for large enterprises, supporting organizations with numerous applications and development teams.

Legit Security

Solution Overview
Founded in 2021, the Legit platform protects the software supply chain from attack by automatically discovering and securing the pipelines, infrastructure, code, and people. It combines automated discovery and analysis capabilities with security policy enforcement to reduce risk and protect software projects. Legit maps security controls to regulations, security frameworks, and customized requirements, continuously monitoring for noncompliance, and will produce evidence needed for audits.

The Legit Security platform offers a comprehensive suite of capabilities through its integrated products. These include a range of scanning tools such as software composition analysis, static code analysis testing, IaC scanning, pipeline security, misconfiguration detection, and repository posture management. The platform also provides robust secrets security features, encompassing detection, remediation, and prevention capabilities. Additionally, it supports compliance frameworks with reporting and attestation functionalities. The platform generates an SBOM and incorporates AI discovery and governance features, enabling the identification of risky AI models and GenAI-developed code, along with the use of code assistants to ensure governance is applied from the outset of the SDLC.

Legit Security continues to improve its core platform capabilities with additional integrations and extended compliance and AI discovery features.

Legit Security is a Leader and Fast Mover positioned in the Maturity/Platform Play quadrant. The platform boasts a robust foundation, offering reliable performance and consistent functionality, and will continue expanding its features and capabilities.

Strengths
Legit Security scored high on a number of decision criteria, including:

• Risk scoring and analysis: Legit provides a risk score associated with vulnerabilities and risks uncovered across the SDLC, which also considers scores assigned by integrated application security tools. The score is further enriched with business impact data to provide a representation of business risk.
• Supply chain mapping and visualization: The platform has the ability to completely visualize the software development environment by mapping connections along the SDLC and displaying dependencies and vulnerabilities. It can also assist security teams in identifying assets that were previously unknown.
• Software exposure analysis: The platform maps risks across the entire SDLC and components: code, developers, plugins, and systems. It offers incident response and scanning for private code in public repositories.

Challenges
Legit Security has room for improvement in a few areas, including:

• Container image security scanning: Legit Security does not natively offer this feature, but the platform has prebuilt integrations with other application security tools, allowing organizations to rely on their previous investments.
• Dependencies management: Legit Security handles dependency management by scanning for vulnerabilities and licenses to ensure compliance with policies. For a higher score, the vendor will need to add automatic upgrades, patches, and code suggestions with context to automate the security review process for developers.
• Open source governance: The platform can enforce policies to control the use of risky libraries and evaluate license compliance, but in order to improve this score, it should expand its enforcement capabilities to include automated remediation during the development lifecycle.

Purchase Considerations
The Legit platform is priced per developer per year, with all capabilities included in the offering. While the secret scanning module can be purchased separately, it is included in the complete solution.

Legit security can be deployed in a SaaS, hybrid, or on-premises model. Each option can be tailored to meet business needs, and regulated companies should consider the hybrid or on-premises options, depending on regulatory requirements.

Organizations seeking a comprehensive security platform that seamlessly integrates with their existing toolset will find Legit Security to be a compelling solution. This use case is particularly relevant for companies looking to streamline their security operations without replacing their current tools, even though the platform can replace incumbent vendors. Legit Security’s platform acts as a unified interface, consolidating risk signals into a single stream, reducing noise and duplicative results from other integrated scanning solutions. This approach not only maximizes the value of existing investments but also improves overall security posture by ensuring consistent policy enforcement and providing comprehensive visibility across the entire software development lifecycle.

Use Cases
Legit Security caters to a wide range of use cases across diverse industries. Its comprehensive security services and data protection features make it well-suited for highly regulated industries like finance and healthcare. DevOps and DevSecOps teams benefit from its automation capabilities and integrations, allowing for seamless adoption into existing development workflows while integrating security testing into CI/CD pipelines for early and continuous vulnerability detection. Additionally, Legit Security’s scalability and automation make it ideal for large enterprises with numerous applications and development teams.

Lineaje

Solution Overview
Founded in 2022, Lineaje provides a comprehensive governance platform for SSCS management to organizations that source, build, buy, or use software applications.​ Lineaje can discover the full lineage of software developed in-house, open sourced, and purchased. Organizations can define policies against their software supply chain, and Lineaje will identify violations.

The Lineaje platform provides a comprehensive governance solution comprising a number of products:

• SBOM360 is a comprehensive solution that identifies software components, assesses their integrity, and evaluates inherent risks. It offers additional capabilities for planning and remediation, optimizing software operations while eliminating vulnerabilities and risks.
• SBOM360 Hub serves as a centralized repository for managing, creating, publishing, and sharing SBOMs, evidence artifacts, and vulnerability data across the distribution chain, facilitating smooth sales processes and risk mitigation.
• Open Source Manager provides governance to manage and mitigate risks associated with open source software development.
• Third-Party Risk Manager helps organizations identify and eliminate risks in purchased software.

Lineaje continues to focus on building a platform for SSCS, working on emerging features, and filling feature gaps while embracing new AI technologies.

Lineaje is a Leader and Outperformer positioned in the Innovation/Feature Play quadrant. The company’s continuous innovation and steady growth in the SSCS space are evident in its comprehensive and expanding feature set.

Strengths
Lineaje scored high on a number of decision criteria, including:

• Dependencies management: The Lineaje solution offers dependency tracking, including package versioning and a robust policy enforcement feature set. It also includes options for automated remediation of vulnerabilities, detection of geo-provenance of code in open source packages, out-of-date packages, and alternative dependency selection.
• Risk scoring and analysis: Lineaje assesses risk across six scores divided into two categories: inherent risk level and lineage component attestation level. These metrics offer organizations a detailed framework by which to quantify risk levels and identify tamperability risks, allowing organizations to prioritize remediation and achieve alignment with compliance frameworks.
• Container image security scanning: The solution scans the entire container, including the environment, operating system, runtime, libraries, and dependencies, allowing organizations to identify more vulnerabilities and risks.

Challenges
Lineaje has room for improvement in the following decision criteria:

• IaC security scanning: The Lineage platform has no IaC scanning capabilities.
• Automated security testing: The solution does not include any SAST, DAST, or IAST scanners, though it can integrate with vendors who do provide this testing.
• Software exposure analysis: Lineaje’s focus is around risk scoring and prioritization, but the solution could add further integrations with scanning tools to assist with identification of most vulnerable components.

Purchase Considerations
Lineaje employs a tiered subscription-based model based on which product is purchased and the volume of projects it will be used for. The platform’s extensive features and scalability make it a valuable investment for larger enterprises, but smaller organizations may need to prioritize specific components based on their needs and risks.

Lineaje should be licensed as a complete solution, and organizations should consider displacement of incumbent solutions in order to take full advantage of the synergy across the platform. Lineaje offers three deployment models—in the vendor’s cloud infrastructure, as a hybrid, or on-premises—enabling regulated companies to consume the product as needed.

Organizations with the need to manage and maintain large volumes of SBOMs should also consider this solution to consolidate search, comparison activities, and management of them into a platform.

Use Cases
Lineaje caters to a wide range of use cases across various industries. For software publishers, it offers SBOM storage, which allows external partners to review builds easily. Its scalability and automation make it well-suited for enterprises with numerous applications and development teams. Additionally, Lineaje’s comprehensive coverage of internally developed projects, third-party software, and reporting capabilities make it ideal for highly regulated industries such as finance, healthcare, and government because of their strict security and compliance requirements.

Mend.io*

Solution Overview
Mend.io is a leading provider of open source security and license compliance management solutions. The company’s core focus is on helping organizations mitigate risks associated with open source components by automating vulnerability detection and remediation processes. Mend.io acquired Atom Security in 2023, gaining a risk-based approach to container image vulnerability prioritization, and has consistently invested in enhancing its platform with new features and integrations.

The Mend AppSec Platform offers continuous monitoring of open source dependencies, providing real-time alerts and remediation guidance to mitigate risks associated with known vulnerabilities and license compliance issues. Mend.io’s platform integrates into existing development workflows and empowers organizations to proactively address security risks in their open source software supply chain.

The Mend AppSec Platform is a comprehensive solution that integrates several key components to enhance software security:

• Mend SCA scans codebases to identify open source components and their associated vulnerabilities.
• Mend Remediate offers automated remediation suggestions and prioritizes vulnerabilities based on severity and risk.
• Mend Renovate automates the process of updating dependencies to the latest secure versions, ensuring applications remain current and protected.
• Mend Policy Management enforces organizational policies on open source usage and compliance, helping teams to maintain consistent security standards across their projects.

Mend.io is a Challenger and Fast Mover positioned in the Maturity/Platform Play quadrant. The platform offers a robust foundation, reliable performance, and consistent functionality. Its robust architecture ensures stability, minimizing disruptions and unexpected changes.

Strengths
Mend.io scored high on a number of decision criteria, including:

• Dependencies management: The Mend Renovate solution includes automated dependency updates, continuous checking for updates, and a merge confidence calculation to enhance development speed.
• Container image security scanning: The solution performs scanning and reachability analysis both early in the development process and at runtime, though it does not provide recommended fixes for identified issues.
• Automated security testing: Mend.io solution’s primary focus is on SAST testing with fast scanning, prioritization, and a single unified stream of results to help address alert fatigue and improve visibility by project. Mend.io partners with Invicti for DAST and IAST functionality.

Challenges
Mend.io has room for improvement in a few areas, including:

• Software exposure analysis: Mend SAST has secrets detection in code but does not include automated remediation after detection. The solution should also include incident response and integration with additional ticketing platforms.
• Supply chain mapping and visualization: While none of the Mend.io solutions include a graphical representation of the supply chain, there are reports that show dependencies in a table format. The product should expand its functionality to show dependencies and reachability across the supply chain in a graphical representation.
• ML-based detection and response: Mend.io has some machine learning models for code matching and risk analysis, but it could expand those capabilities to include anomaly detection, automated responses, and code suggestions.

Purchase Considerations
Mend.io’s easy-to-understand pricing structure is arranged per developer for all four primary modules. This structure can simplify budget forecasting for managers, but potential customers should carefully evaluate their use cases to ensure the costs associated with this solution align with organizational needs and they are not adding cost for features that will not be used.

Mend.io’s solution offers both a fully managed and a hybrid SaaS solution through which the Mend.io backend is managed by Mend.io and the local agent runs inside the CI/CD scanning the code, so no code leaves the customer’s environment. Mend.io does not offer dedicated instances or on-premises deployment options, which should be considered by organizations with extensive compliance requirements, such as US Federal agencies.

The solution provides many capabilities but can be complex to fully use. Customers will need to understand the skills required in their teams to fully leverage this solution.

Use Cases
Mend.io caters to a wide range of use cases across diverse industries. Its comprehensive security services and data protection features make it a suitable choice for highly regulated sectors such as finance and healthcare. DevOps and DevSecOps teams will benefit from its automation capabilities and integrations, enabling seamless adoption into existing development workflows and integrating security testing into CI/CD pipelines for early and continuous vulnerability detection. Additionally, Mend.io’s scalability and automation make it ideal for large enterprises with numerous applications and development teams.

Palo Alto Networks*: Prisma Cloud

Solution Overview
Founded in 2005, Palo Alto Networks provides advanced cybersecurity solutions, including next-generation firewalls, automated SecOps, and cloud-based security offerings. The company’s platform approach delivers integrated solutions to secure networks, clouds, and devices against sophisticated cyberthreats. Over the past three years, Palo Alto Networks has been evolving its Prisma Cloud platform via multiple acquisitions, including Cider Security in 2022, to add code security improvements, and the recent acquisition of IBM’s QRadar in May of 2024, to add additional integrations and security information and event management (SIEM) capabilities.

Prisma Cloud offers a comprehensive SSCS solution spanning many different products, protecting organizations from code to cloud. It provides visibility into vulnerabilities across the development lifecycle, scanning code repositories, container images, and infrastructure as code. The platform automates security checks, enforces policies, and integrates with CI/CD pipelines. Prisma Cloud helps prevent supply chain attacks by verifying software integrity, scanning secrets, detecting malicious dependencies, and ensuring compliance with security best practices throughout the software delivery process.

Prisma Cloud Enterprise covers three functions: visibility and control, runtime protection, and risk prevention, with features that include cloud security posture management, cloud infrastructure entitlement management, and runtime protections with host, container, serverless, and web application security tools. In addition, risk protection extends with SCA and IaC, secrets, and CI/CD security.

Palo Alto Networks is a Leader and Fast Mover positioned in the Maturity/Platform Play quadrant. The platform boasts a robust foundation, offering reliable performance and consistent functionality. Its mature architecture ensures stability, minimizing disruptions and unexpected changes. Organizations benefit from a dependable ecosystem, which allows confident long-term adoption and seamless integration into existing workflows.

Strengths
Palo Alto Networks scored high on a number of decision criteria, including:

• Container image security scanning: Prisma Cloud provides continuous container image scanning across major public cloud vendors, ensuring real-time visibility into vulnerabilities and compliance issues. It offers prebuilt templates for various compliance standards, simplifying adherence to regulatory requirements. The solution integrates smoothly into existing development toolchains, supporting DevSecOps practices.
• ML-based detection and response: Prisma Cloud employs sophisticated machine learning for comprehensive security that features anomaly detection, threat identification, and automated response across development environments. The AI model conducts continuous behavior analysis to predict potential attacks.
• Customization of security policies: Prisma Cloud includes out-of-the-box policies and deep customization capabilities that use policy as code in both Python and YARA, as well as UI-based low-code options for organizations that require nuanced security policy configurations.

Challenges
Palo Alto Networks has room for improvement in a few areas, including:

• Automated remediation: Prisma Cloud automatically generates code fixes and patches to address vulnerabilities. It offers integrated pull request comments, fixes, and smart fixes that automate the security code review process and streamline remediation efforts. This feature could be improved by using LLM models to generate code fixes, assisting developers with creating secure code.
• Supply chain mapping and visualization: The solution provides a comprehensive visual map of the software supply chain for each repository, including details about users, applications, tools, and third-party software within the diagram. This feature scored very well and could be further improved by providing data flow analysis across the entire software deployment supply chain.

Purchase Considerations
Prisma Cloud is available in two deployment models: SaaS and self-hosted. The Palo Alto Networks-hosted option is divided into two cloud security plans: Foundations and Advanced, in which capabilities are combined into packages addressing common organizational requirements, though customers can build customized plans depending on requirements. Each product module has a different cost associated with and defined by credits, which are capacity units as defined by Palo Alto Networks.

The self-hosted plan, Prisma Cloud Compute Edition, comprises product modules providing a number of security capabilities that offer organizations flexibility in terms of where and how they secure their cloud environments. This plan also uses credits for each product, with a specific number needed for each module and resource protected.

This flexibility ensures Prisma can be tailored to fit various operational needs, whether in public clouds, private data centers, or hybrid environments.

Prisma Cloud should be licensed as a complete solution, and organizations should consider displacement of incumbent solutions in order to take full advantage of the synergy across the platform. If an organization is already a customer and looking to add SSCS capabilities, native integration with other products in the platform can extend existing security procedures to cover the software development lifecycle as well.

Use Cases
Palo Alto Networks caters to a wide range of use cases across diverse industries. Its comprehensive security services and data protection features make it a suitable choice for highly regulated sectors such as finance and healthcare. DevOps and DevSecOps teams benefit from its automation capabilities and integrations, enabling seamless adoption into existing development workflows while integrating security testing into CI/CD pipelines for early and continuous vulnerability detection. Additionally, Palo Alto Networks’ scalability and automation make it well suited for large enterprises with numerous applications and development teams.

Qualys: Enterprise TruRisk Management

Solution Overview
Qualys is a well-established provider of cloud-based security and compliance solutions, serving a wide range of industries and organizations. The company has a strong track record of delivering reliable and scalable security solutions, including vulnerability management, policy compliance, and threat detection and response. Qualys has continued to expand its portfolio through internal development and acquisitions, such as the recent addition of the TotalCloud SaaS security platform, which complements its existing security offerings.

Qualys’s Enterprise TruRisk Management platform can continuously monitor, assess, and reduce cyber risk using various Qualys products built on the platform. These allow organizations to manage risk from software assets located on-premises or with cloud providers.

The Enterprise TruRisk Management platform comprises several key components that work together to secure software effectively:

• CyberSecurity Asset Management creates a comprehensive inventory of all discovered assets, including open source software and commercial components.
• Vulnerability Management Detection and Response scans for vulnerabilities and includes software composition analysis, integrating seamlessly with the risk management engine.
• The Patch Management tool handles the patching of vulnerabilities and updates.
• The Policy Compliance engine evaluates adherence to baselines and compliance frameworks.
• The Web Application Scanning tool provides dynamic application security scanning for web applications and APIs.
• TotalCloud serves as a centralized location where risks are correlated across various Qualys sources, offering a prioritized view of cloud risks.
• QFlow provides workflow automation for code and policy customization, enhancing the overall security posture of the organization.

Qualys is a Challenger and Fast Mover positioned in the Maturity/Platform Play quadrant. The platform boasts a robust foundation, offering reliable performance and consistent functionality. Its mature architecture ensures stability, minimizing disruptions and unexpected changes. Organizations benefit from a dependable ecosystem, enabling confident long-term adoption and seamless integration into existing workflows.

Strengths
Qualys scored high on a number of decision criteria, including:

• Customization of security policies: Policies are fully customizable, and organizations can program their own controls using the QFlow no-code platform.
• IaC security scanning: The platform scans IaC templates, evaluating them against more than 700 controls that correlate to global and US compliance frameworks, ensuring developers can remediate misconfigurations before production.
• Container image security scanning: The platform scans container images during both build and runtime to identify vulnerabilities. Qualys integrates the scanning with its AI threat analysis to identify unknown malware and evaluate images against emerging threats. The tool also scans for sensitive information, reducing the risk of credential leaks leading to compromises.

Challenges
Qualys scored well across many key features, but it falls short in two areas, lacking capabilities for both dependencies management and supply chain mapping and visualization. In addition, for automated security testing, while Qualys has a robust DAST tool, it does not have SAST or IAST capabilities or integrate with other tools that can provide these capabilities.

Purchase Considerations
Qualys offers a comprehensive suite of software supply chain security solutions, which may provide cost efficiencies for organizations looking to consolidate their security stack. While the platform is user-friendly, organizations with complex environments may benefit from professional services for optimal configuration. Qualys provides extensive training resources and support options, including online courses and dedicated support teams. The cloud-based deployment model eliminates on-premises infrastructure requirements, but potential buyers should review their data residency needs. Licensing is based on asset count and selected modules, with flexible options to scale as organizational needs evolve.

Qualys should be licensed as a complete solution, and organizations should consider displacement of incumbent solutions in order to take full advantage of the synergy across the platform.

Use Cases
Qualys caters to a wide range of use cases across diverse industries. Its comprehensive security services and data protection features make it particularly suitable for highly regulated sectors such as finance and healthcare. For DevOps and DevSecOps teams, Qualys offers automation capabilities and integrations that enable seamless adoption into existing development workflows, facilitating the integration of security testing into CI/CD pipelines for early and continuous vulnerability detection. Additionally, its scalability and automation make Qualys an ideal choice for large enterprises with numerous applications and development teams, ensuring robust security across their operations.

ReversingLabs: Spectra Assure

Solution Overview
Founded in 2009, ReversingLabs is a trusted vendor in file and software security, providing an on-premises, hybrid, and cloud-based cybersecurity platform to verify and deliver safe binaries. ReversingLabs provides that final exam to determine whether a single file or full software binary presents a risk to the organization or its customers.

ReversingLabs Spectra Assure identifies and stops software supply chain attacks with binary analysis to identify malware, tampering, suspicious behaviors, exposed secrets, vulnerabilities, and weak mitigations. The company provides the most comprehensive SBOM and risk assessment of any application before release or deployment. This is a complete analysis of the entire software package, including proprietary, commercial, and open source components plus all artifacts added as part of the build process. Moreover, it is the only solution capable of handling large and complex software packages that are gigabytes in size, deconstructing, and reporting on issues in as little as minutes or hours—without the need for source code.

ReversingLabs has a unique approach to software supply chain security and will continue to build on the new features introduced into its product this year as well as developing and expanding the functionality into new areas.

ReversingLabs is a Challenger and Outperformer positioned in the Innovation/Feature Play quadrant of the Radar chart.

Strengths
ReversingLabs scored high on a number of decision criteria, including:

• Risk scoring and analysis: Using proprietary analysis engines enhanced with AI models and further enriched using YARA rules, Spectra Assure provides findings in five levels. Customers can either use predefined policies or create their own to customize risk levels specific to business requirements. Organizations can also require that packages meet a certain level before they are considered acceptable to release or deploy.
• Software exposure analysis: Spectra Assure examines binaries to discover embedded secrets, including keys, certifications, tokens, and other types of credentials. These findings are then assessed against policies for prioritization to ensure bad actors can’t leverage this information for abuse. The solution can also detect build tampering by comparing compiled software across build environments, and it compares new software versions against the prior version for suspicious behavior changes or groups of changes that are also indicators of compromised software.
• Customization of security policies: The platform offers robust policy customization, leveraging policy as code capabilities to provide the maximum flexibility in the way policies are defined and enforced. The ReversingLabs engine will quickly block nonconforming software from deployment.

ReversingLabs is deemed an Outperformer in this report because it swiftly evolves its platform and introduces a stream of new capabilities while sharpening focus on key features to meet emerging security threats.

Challenges
ReversingLabs has room for improvement in a few areas, including:

• Automated security testing: Spectra Assure is not a traditional automated code security testing tool. Rather than analyze code during composition (SAST) or while the application is running (DAST), the tool employs binary analysis to identify threats and risks in software between where traditional SAST and DAST capabilities exist. While one benefit of this approach is that it does not require source code for analysis, the platform lacks capabilities for dynamic testing or API security.
• Supply chain mapping and visualization: While Spectra Assure does provide a hierarchical view of software components in a project that identifies risks and vulnerabilities, it does not include a graphical representation of risks throughout the SDLC, as the solution is targeted to secure organizations after coding is finished and before it is introduced into applications and runtimes.
• Automated remediation: The solution does not include this capability.

Purchase Considerations
ReversingLabs employs a pricing model based on each usage—that is, the number of gigabytes of data scanned. Organizations can therefore scale up as they implement the solution into their SDLC processes. The platform’s extensive features and scalability make it a valuable investment for larger enterprises, but smaller organizations may need to prioritize other toolsets addressing risks earlier in the SDLC while their offerings mature.

Spectra Assure can be deployed in a SaaS, hybrid, or on-premises model. Each option can be tailored to meet business needs, but regulated companies should consider the hybrid or on-premises options, depending on regulatory requirements.

The binary analysis and risk visibility offered by Spectra Assure provide invaluable insights, but organizations need to consider whether additional security tools shifted left or right of Spectra Assure may be required to properly secure the coding or deployment processes. Combining it with other threat detection or vulnerability management platforms would provide a more comprehensive cybersecurity posture, enhancing an organization’s ability to identify and mitigate potential threats across the entire attack surface.

Use Cases
ReversingLabs caters to a specific range of use cases across various industries. Its comprehensive security services and data protection features make it particularly suitable for highly regulated sectors such as finance, healthcare, and government. Additionally, its scalability and automation are well-suited for large enterprises with numerous applications and development teams. ReversingLabs focuses on several specific use cases, including binary analysis, to evaluate entire software binaries and identify malware before they are released, acquired, or deployed. It also provides SBOMs for all software, including proprietary, commercial, open source, and build artifacts. Furthermore, ReversingLabs specializes in identifying novel threats, such as malware, tampering, exposed secrets, and suspicious behavior changes, enhancing overall security posture.

Scribe Security

Solution Overview
Founded in 2021, Scribe Security is a platform that enables organizations to develop, distribute, and maintain code produced within the organization while also verifying code components’ integrity, provenance, authenticity, and reputation, thereby protecting against vulnerabilities, tampering, and open source risks. Scribe Security provides organizations with visibility into and assurance of the entire software development lifecycle, from early design stages to final deployment.

The Scribe Security Platform comprises several key components designed to enhance software security throughout the development lifecycle. It features a centralized SBOM management platform that generates SBOMs at every stage, using Scribe’s SCA or ingesting third-party SBOMs. The platform includes application security posture management, which gathers output from integrated application security testing (AST) scanners, development tools, configuration files, identities, and actions. Its vulnerability management component provides intelligence on software vulnerabilities, exploitations, reputation, and licenses to facilitate risk analysis, triage, and incident response.

Additionally, Scribe implements automated guardrails to verify and gate the software development and deployment process. The solution also offers code signing, integrity, and provenance checks to ensure authenticity and detect unlawful interventions. It also provides organizations with blueprints for compliance with various secure development frameworks, such as SLSA and SSDF, or the flexibility for organizations to customize their own policies.

Scribe Security is an Challenger and Fast Mover positioned in the Innovation/Feature Play quadrant of the Radar chart.

Strengths
Scribe Security scored high on a number of decision criteria, including:

• Customization of security policies: The Scribe platform offers robust policy customization that leverages policy-as-code capabilities, allowing organizations maximum flexibility in the way policies are defined and enforced.
• Dependencies management: Using SCA and SBOM management, dependencies in code both direct and transitive are identified, with the platform evaluating the risks associated with security findings.
• Software exposure analysis: The platform can assess the potential downstream and interconnected impact of vulnerabilities and potential security issues across an organization’s entire software supply chain. This allows security teams to quickly understand the reach and business impact of a potential security incident and create prioritized remediation plans.

Challenges
Scribe has room for improvement in a few areas, including:

• Automated remediation: While the solution can surface patches published by open source contributors, there is no capability to suggest code fixes to developers using LLM models.
• Automated security testing: The Scribe platform does not include any native SAST, DAST or IAST capabilities, however, it integrates with other vendors bringing those findings into the platform and allowing customers to apply Scribe security policies to deployments, ensuring that developed software maintains security standards.
• IaC security scanning: The Scribe platform does not provide native IaC scanning capabilities, but can integrate with other vendors and utilize those security findings.

Purchase Considerations
Scribe’s pricing structure includes a free tier, which allows the creation of proofs of concept and lets individuals and open source projects get started without a financial commitment. The two paid licensing tiers are Business, for small and medium businesses, and Enterprise, custom solutions that cater to larger or highly regulated organizations.

Organizations looking to secure their entire pipeline, meet regulatory compliance, and pass audits should consider the features of this platform but will need to look at other platforms for code security testing that goes beyond vulnerabilities or to leverage AI for automated remediation and code security guidance. This platform is a good fit for medium to large enterprises for whom lack of visibility into the software factory creates significant business risk. Scribe’s discovery capabilities can help close this transparency gap, which can impact security, compliance, and operational efficiency.

The solution provides a lot of detail and can be complex. Customers will need to understand the skills required in their teams to use the solution. This could drive higher adoption and training costs. Scribe Security offers three deployment models, allowing organizations to deploy in the vendor’s cloud infrastructure, or in a hybrid or on-premises model, which can determine how regulated companies consume the product.

Use Cases
Scribe Security caters to a specific range of use cases across various industries that make it particularly suitable for highly regulated sectors such as finance, healthcare, and government. Additionally, its scalability and automation make it ideal for large enterprises with numerous applications and development teams. Scribe Security focuses on several specific use cases, including discovery and guardrails and centralized SBOM management, which enhances the security and compliance of software development processes.

Snyk*

Solution Overview
Founded in 2015, Snyk is a cloud-native software security company with a core focus of empowering developers to build secure software by providing them with the tools and insights needed to address vulnerabilities early in the development process. Snyk has actively expanded its offerings through acquisitions, such as the recent one of DeepCode, an AI-powered code analysis platform, further solidifying its commitment to developer-centric security solutions. In January of 2024, Snyk acquired Helios, a solution that specializes in capturing runtime data, allowing the Snyk platform to gain visibility into risks.

Snyk is a developer-first security platform that focuses on identifying and remediating vulnerabilities in open source dependencies, container images, and IaC. It provides a comprehensive solution for addressing security risks throughout the SDLC, seamlessly integrating into existing development workflows and tools.

Snyk’s platform comprises several integrated products designed to enhance software security comprehensively:

• Snyk Open Source identifies and fixes vulnerabilities in open source dependencies across various programming languages and package managers.
• Snyk Container scans and monitors container images for vulnerabilities and misconfigurations and provides actionable base image fix advice.
• Snyk IaC analyzes IaC templates for security issues before deployment.
• Snyk Code offers SAST capabilities to identify vulnerabilities in proprietary code.
• Snyk AppRisk focuses on reducing application risk at scale, providing complete application discovery, tailored security controls, identification of gaps in scanning, and risk-based prioritization to ensure a robust security posture throughout the software development lifecycle.

Synk is a Leader and Forward Mover positioned in the Mature/Platform Play quadrant. The company’s continuous innovation and steady growth in the SSCS space are evident in its comprehensive and expanding feature set.

Strengths
Snyk scored high on a number of decision criteria, including:

• Dependencies management: Snyk identifies dependencies and provides features for automated updates, patching, and other code fixes, enabling developers to prioritize top risks and fix exposures quickly.
• IaC security scanning: in addition to scanning for vulnerabilities and misconfigurations of IaC files, the IaC tool integrates directly with public cloud providers, monitoring IaC code in real time and making code suggestions during the build process.
• Container image security scanning: The core platform continuously monitors containers for vulnerabilities and misconfigurations. Snyk also provides base image recommendations, allowing teams to start from a more secure base image, with support for both public base images and curated image models, thus avoiding additional image maintenance.

Challenges
Snyk has room for improvement in a few areas, including:

• Supply chain mapping and visualization: The solution does not offer any visualizations to show a complete dependency tree.
• Risk scoring and analysis: Snyk offers risk assessments and scoring with enrichment of business impact, but it would be more valuable if the scoring model had additional options related to how the assigned values impact the risk scoring.
• Customization of security policies: While Snyk offers customization of policies, it could also offer a policy-as-code option for highly regulated organizations.

Purchase Considerations
Snyk’s easy-to-understand pricing structure includes a free tier and various paid plans based on usage and features. It offers flexibility for organizations of varying sizes and needs, but potential customers should carefully evaluate the costs associated with scaling their usage and accessing advanced features.

Organizations looking to meet regulatory compliance and pass audits should consider the features of this platform but will need to look at other platforms if they need security testing that goes beyond vulnerabilities.

The solution provides a lot of detail and can be complex. Customers will need to understand the skills required in their teams to use this solution. This could drive higher adoption and training costs.

Use Cases
Snyk caters to a wide range of use cases across diverse industries, making it especially valuable for highly regulated sectors such as finance and healthcare, for which comprehensive security services and data protection features are essential. For DevOps and DevSecOps teams, Snyk offers automation capabilities and integrations that facilitate seamless adoption into existing development workflows, enabling the integration of security testing into CI/CD pipelines for early and continuous vulnerability detection. Additionally, its scalability and automation make Snyk an excellent fit for large enterprises, supporting their complex application environments and development teams effectively.

Veracode

Solution Overview
Founded in 2006, Veracode offers a comprehensive suite of cloud-based SSCS tools and services designed to address security risks throughout the SDLC. It combines these into a unified platform, providing holistic visibility and control, enabling organizations to identify and fix vulnerabilities early in the development process. The company has consistently been an innovator and has a reputation for accuracy and comprehensive coverage. In April of 2024, Veracode acquired Longbow, which enables companies to identify actions to reduce risk in applications and cloud environments.

The Veracode Application Risk Management Platform is a comprehensive solution that includes several key components:

• Veracode Static Analysis for early identification of security vulnerabilities in source code.
• Veracode Dynamic Analysis for real-time vulnerability detection in running applications.
• Veracode Software Composition Analysis for assessing open source component vulnerabilities, license compliance, and generating SBOMs.

The platform also incorporates Veracode Risk Manager, which provides application security posture management to efficiently reduce risk, and Veracode Fix, which offers AI-generated code fixes based on curated data and expert solutions. Additionally, it includes Veracode Container Security for container and IaC scanning with SBOM generation capabilities, as well as Veracode Security Labs and eLearning to educate developers on secure coding practices through hands-on modules and recorded lessons in their preferred programming language.

Veracode is a Leader and Fast Mover positioned in the Maturity/Platform Play quadrant. The company’s continuous, steady innovation and growth in the SSCS space are evident from its comprehensive and expanding feature set.

Strengths
Veracode scored high on a number of decision criteria, including:

• Automated security testing: The platform includes automated security testing tools—SAST and DAST—giving developers and security teams a broad range of testing capabilities.
• Container image security scanning: Veracode combines three open source scanners for a complete solution that it enriches with secrets detection, misconfiguration identification, and prioritization.
• Risk scoring and analysis: Veracode includes cross-risk analytics, vulnerability and legal risk results, peer benchmarking, and auditable mitigation workflows, which allow organizations to evaluate spots where the largest risks exist and prioritize resolving issues that will have the largest impact.

Challenges
Veracode scored low on only one of the key features in the report: Supply chain mapping and visualization. While Veracode does provide a dependency view for projects, there is no graphical representation of the entire SLDC. Among business criteria, Veracode was not highly scored on cost, as the platform can be expensive, especially for smaller organizations with limited security budgets.

Purchase Considerations
Veracode employs a subscription-based model, and depending on product, there is either a per-contributing developer cost or a per-product cost, tiered into different usage amounts: per application or project. The core options, SAST, SCA, Container Security, and Risk Manager, are all priced per contributing developer. Other tools are priced differently, with DAST priced per URL, and Security Labs and eLearning either per user or per contributing developer, based on preference. The platform’s extensive features and scalability make it a valuable investment for larger enterprises, but smaller organizations may need to prioritize specific components based on their needs.

Veracode should be licensed as a complete solution, and organizations should consider displacement of incumbent solutions in order to take full advantage of the synergy across the platform.

Use Cases
Veracode caters to a wide range of use cases across diverse industries, making it especially valuable for highly regulated sectors such as finance and healthcare, for which comprehensive security services and data protection features are essential. For DevOps and DevSecOps teams, Veracode provides automation capabilities and integrations that facilitate seamless adoption into existing development workflows, allowing the integration of security testing into CI/CD pipelines to ensure early and continuous vulnerability detection. Furthermore, its scalability and automation make Veracode an ideal solution for large enterprises with numerous applications and development teams, helping to maintain robust software security across their operations.

Xygeni

Solution Overview
Founded in 2021, Xygeni specializes in enhancing software development security and efficiency. The platform offers complete control over application risks and a unified security view from code to cloud, and it eliminates noise to prioritize risks effectively. The platform includes malware detection and an early warning system, and reachability and exploitability prioritization, ensuring rapid and secure software delivery.

Xygeni automatically detects malicious code in real time upon new and updated components publication, immediately notifying customers and quarantining affected components to prevent potential breaches.

Xygeni comprises several key components that work together to enhance application security comprehensively:

• The Application Security Posture Management (ASPM) serves as the primary platform, visualizing, prioritizing, and remediating risks while delivering real-time visibility and contextualization to simplify security and ensure applications are protected from development through deployment.
• The Open Source Security feature minimizes risks and protects applications from malicious packages through malware detection and real-time monitoring of dependencies.
• The Software Supply Chain Security component is integrated within CI/CD pipelines and infrastructure, deploying robust security measures that protect software workflows from start to finish, ensuring compliance and securing software artifacts against tampering to facilitate faster and more secure software delivery.
• The Secrets Security solution scans, detects, revokes, and blocks the publication of sensitive information such as passwords, API keys, and tokens in real time.
• The IaC Security component scans for vulnerabilities in the security and integrity of IaC templates.

Xygeni is a Challenger and Fast Mover positioned in the Innovation/Platform Play quadrant of the Radar chart for Software Supply Chain Security.

Strengths
Xygeni scored high on a number of decision criteria, including:

• Risk scoring and analysis: Xygeni incorporates vulnerability information and abnormal behavior indicators to deliver a detailed risk scoring analysis weighted across multiple potential attack vectors. In addition, organizations can enrich the scoring according to the sensitivity of the data to clearly identify where the largest risks exist.
• Supply chain mapping and visualization: The automated asset discovery tools catalog every asset along the supply chain from code repositories, dependencies, and pipelines to cloud resources and deployments, and displays them in a filterable graphic based on security issues.
• IaC security scanning: The proprietary IaC tool integrates into the CI/CD pipelines, with continuous scanning of all major vendor frameworks, and it provides guidelines for remediating security issues according to best practices.

Challenges
Xygeni has room for improvement in a few areas, including:

• ML-based detection and response: The platform does not offer these capabilities.
• Automated security testing: The solution focuses primarily on detection of vulnerabilities in code using SAST capabilities but could improve this score by adding DAST and API security functionality.
• Automated remediation: While the solution can surface patches published by open source contributors, there is no capability to suggest code fixes to developers using LLM models.

Purchase Considerations
Xygeni offers flexible subscription-based pricing with options for on-premises, hybrid, or cloud deployments. Pricing is based on the number of products purchased and the number of contributing developers who use each product, allowing organizations to scale their investment as their needs grow. The platform’s extensive features and scalability make it a valuable investment for larger enterprises, but smaller organizations may need to weigh the cost against their specific needs. Smaller organizations will find the Open Source Security and Application Security products to be the most effective on limited budgets. The pricing model is tiered so that the cost per license and product becomes discounted as licenses and collaborators increase.

Organizations will get the most value from licensing the entire platform. This will give them deeper visibility and insights into the development lifecycle, which reduces noise from false positives, and Xygeni also provides additional anomaly detection and malicious code and behavior detection that can be adopted into cybersecurity team workflows.

Use Cases
Xygeni caters to a wide range of use cases across diverse industries, including those with heightened compliance requirements. Its comprehensive security services and data protection features make it particularly suitable for highly regulated sectors such as finance and healthcare. For DevOps and DevSecOps teams, Xygeni provides automation capabilities and integrations that enable seamless adoption into existing development workflows, facilitating the integration of security testing into CI/CD pipelines for early and continuous vulnerability detection. Additionally, its scalability and automation make Xygeni an excellent fit for large enterprises with numerous applications and development teams, ensuring robust security across complex environments.

6. Analyst’s Outlook

The SSCS market is experiencing a period of rapid growth and development, primarily driven by the escalating sophistication of cyberattacks and the resulting broad impacts on companies and their customers. To effectively manage these risks and challenges, organizations must adopt a proactive and comprehensive approach to security testing along the entire software development lifecycle.

State of the Market
The SSCS market is characterized by a growing emphasis on DevSecOps, or the integration of security into the development lifecycle. This shift-left approach aims to identify and address vulnerabilities early in the development process, reducing the cost and impact of remediation later on. Organizations are increasingly investing in automated testing tools that can be seamlessly integrated into their CI/CD pipelines, enabling continuous security testing and faster feedback to developers. This need is also being driven by the highly publicized attacks over the past few years that have brought attention to the risks and consequences of ignoring security best practices.

For decision-makers weighing SSCS adoption, it’s crucial to start by conducting a thorough assessment of their current code security tooling and regulatory requirements while working to identify gaps that a SSCS solution could address.

Emerging Trends
In the coming year, software supply chain security is poised for significant evolution, with several key trends shaping the landscape. We can expect to see a growing consolidation of security features into comprehensive, single-platform solutions, offering organizations more integrated and streamlined approaches to manage their software supply chains.

Simultaneously, the industry will likely witness an increased emphasis on both shift-left practices, integrating security earlier in the development process, and shift-right strategies, extending security measures into production and runtime environments. Furthermore, the rapid advancement of AI and machine learning technologies, including the rise of LLMs, will not only introduce new security challenges but also offer powerful tools for enhancing threat detection, automated response, and predictive analysis in software supply chain security.

Advice and Next Best Action
Organizations should prioritize several key actions in their buying journey to enhance their security posture. First, they should embrace DevSecOps by integrating security testing into every stage of the SDLC to identify and address vulnerabilities early in the development process. Additionally, investing in automation is crucial for improving efficiency, reducing manual effort, and enabling continuous security assessment. Leveraging artificial intelligence and machine learning can further enhance vulnerability detection, prioritization, governance, policy adherence, and automated remediation efforts. Finally, organizations should consider consolidating their tools or investing in platforms that offer robust integration capabilities to streamline their security processes and improve overall effectiveness.

Forward View

As the pace of automation increases, it will be important to nurture and improve the collaboration among security, development, and operations teams to create a truly integrated approach to software supply chain security.

The SSCS market is dynamic and constantly evolving. To stay ahead of the curve, organizations must continuously evaluate their security testing strategies and adopt new technologies as they become available. By doing so, they can ensure their applications remain secure and resilient in the face of ever-changing threats.

To learn about related topics in this space, check out the following GigaOm Radar reports:

• GigaOm Radar for Cloud-Native Application Protection Platforms (CNAPPs) v1.0
• GigaOm Radar for Application Security Testing (AST) v2.0
• GigaOm Radar for Continuous Vulnerability Management (CVM) v4.0

7. Methodology

*Vendors marked with an asterisk did not participate in our research process for the Radar report, and their capsules and scoring were compiled via desk research.

For more information about our research process for Key Criteria and Radar reports, please visit our Methodology.

8. About Seth Byrnes

Seth Byrnes has extensive experience in developing strategic roadmaps, implementing robust technology solutions, and leading cross-functional teams to drive operational excellence.

9. About GigaOm

GigaOm provides technical, operational, and business advice for IT’s strategic digital enterprise and business initiatives. Enterprise business leaders, CIOs, and technology organizations partner with GigaOm for practical, actionable, strategic, and visionary advice for modernizing and transforming their business. GigaOm’s advice empowers enterprises to successfully compete in an increasingly complicated business atmosphere that requires a solid understanding of constantly changing customer demands.

GigaOm works directly with enterprises both inside and outside of the IT organization to apply proven research and methodologies designed to avoid pitfalls and roadblocks while balancing risk and innovation. Research methodologies include but are not limited to adoption and benchmarking surveys, use cases, interviews, ROI/TCO, market landscapes, strategic trends, and technical benchmarks. Our analysts possess 20+ years of experience advising a spectrum of clients from early adopters to mainstream enterprises.

GigaOm’s perspective is that of the unbiased enterprise practitioner. Through this perspective, GigaOm connects with engaged and loyal subscribers on a deep and meaningful level.

10. Copyright

© Knowingly, Inc. 2024 "GigaOm Radar for Software Supply Chain Security" is a trademark of Knowingly, Inc. For permission to reproduce this report, please contact sales@gigaom.com.