Your new code, checked before and after it ships

New code is scanned before it ships, the running app is tested, and every finding goes into one list.

1Code scanning ↓Reading the code, the open-sourcecode it uses and the package itships in, before release.Black DuckCheckmarxSonatypeReveneraEndor LabsRapidFortJFrog2Testing runningapps ↓Attacking the running app and itsAPIs the way an attacker would.Astra SecurityQodexZimperium3Combining thefindings ↓Collecting the findings of everytool into one short list.ArmorCode Inc.1Code scanning ↓Reading the code, the open-source code ituses and the package it ships in, beforerelease.Black DuckCheckmarxSonatypeReveneraEndor LabsRapidFortJFrog2Testing running apps ↓Attacking the running app and its APIs theway an attacker would.Astra SecurityQodexZimperium3Combining the findings ↓Collecting the findings of every tool intoone short list.ArmorCode Inc.

Box 1 reads the code before it ships. Box 2 attacks the running app the way an attacker would. Box 3 collects the findings of every tool into one short list. Tap a title in the diagram to jump to its companies.

1

Code scanning 7 companies

An app is the company's own code plus many pieces of free, open-source code that someone else wrote. These tools read the company's code for mistakes, check the open-source pieces against lists of known flaws, and inspect the package that the app ships in.

Scanning your own code

Reading the company's own code for security mistakes.

Black Duck logoBlack DuckBlack Duck is the largest company on this page. Synopsys, the chip-design company, built it by buying companies, and in 2024 sold it off as a company of its own under this name.BengaluruHired recently
Checkmarx logoCheckmarxCheckmarx, from Israel, is the other established name in scanning a company's own code. It has engineers in Pune.

Checking open-source code

Checking the free, open-source code that an app uses.

Sonatype logoSonatypeSonatype runs the online store from which most Java developers download open-source code, and checks that code using the store's history. Its India centre is in Hyderabad.HyderabadHired recently
Revenera logoReveneraRevenera, in Bengaluru, checks open-source code from the legal side: whether its licence allows the way a product uses it.Bengaluru
Endor Labs logoEndor LabsEndor Labs checks which of the flagged open-source pieces the code actually uses, so teams fix ten things instead of a thousand. It now also checks code that AI assistants write.

Checking the packaged software

Checking the package in which the software is shipped.

RapidFort logoRapidFortRapidFort removes the unused parts from the package that software ships in, and the security flaws in those parts go with them.
JFrog logoJFrogJFrog sells the store where companies keep their finished software, ready to install. Its Xray product checks the open-source code inside that software, where it is stored.See alsoDevOps and CI/CD tools
The tech, explainedStatic application security testing (SAST)Software composition analysis (SCA) and SBOMContainer image scanningAI code governanceArtifact registry↗ DevOps
2

Testing running apps 3 companies

Once the app is running, testers attack it the way an attacker would, especially through its API: the interface through which other software talks to the app, and the place most attacks now aim at. This is called penetration testing.

Astra Security logoAstra SecurityAstra Security sells penetration testing as a service, with its own scanner. It has engineers in Bengaluru.
Qodex logoQodexQodex started in Bengaluru and now has an office in San Francisco. It is a young company that tests APIs for security flaws.
Zimperium logoZimperiumZimperium is here for its tools that protect a company's own phone app against tampering, and against being taken apart to see how it works.See alsoEndpoint security and device management
The tech, explainedOffensive security testing↗ Vulnerability and exposure managementAPI securityMobile app shielding
3

Combining the findings 1 company

Every scanner and test produces its own list of findings, with many repeats. This software removes the repeats, ranks each finding by how much it matters, and gives the developer one short list.

ArmorCode Inc. logoArmorCode Inc.ArmorCode collects the findings of every security tool into one list, removes the repeats and ranks each finding by how much it matters to the business. It has engineers in Delhi NCR.
The tech, explainedApplication security posture management (ASPM)
How it all worksEnterprise cybersecurityEverything an attacker can aim at in one company.
See how it works →

What's changing

AI now writes much of the code.

AI assistants now write a large share of new code. That code can contain the same security flaws as code written by people, and more of it is written faster. Scanning companies are adding checks aimed at code that AI wrote, and at the open-source pieces that AI suggests.

Read moreAI code governance
← Previous in CybersecurityCloud and SaaS securityNext in Cybersecurity →Data security and privacy
Elsewhere in Cybersecurity:Email security and anti-phishingIdentity and access management (IAM)KYC, identity verification and fraud preventionEndpoint security and device managementNetwork security, firewalls and SASESIEM and security operations (SOC)Managed security services (MDR and MSSP)Vulnerability management and penetration testingThreat intelligence and attack surface managementAI securityGovernance, risk and compliance (GRC)Physical security, surveillance and trust and safety

Companies: ingrid's company map. Hiring signals: postings feed of 5 Nov 2026.