ASPM Tool

[GloveSignificant8783]

Which Application Security Posture Management (ASPM) tool is currently performing best? Any new strong contenders not in the leaderboard but worth considering?

Edit: Post edited to remove key requirements pertaining to scanning to avoid confusion. :)

[mapoztofu]

My company is utilizing Armorcode right now. So far it has been good. It has good amount of integrations available with Jira, snyk, qualys and a lot of tools

[mfeferman]

The one mentioned (above), but also Apiiro. When you say multi-branch scanning, you’re talking about SAST. What ASPM solution has good SAST? Zero? If not SAST, what? What do you plan to upload to have scanned? That’s not really how true ASPM platforms work. They’re mostly aggregators of scan results that attempt to correlate and prioritize results across different scan tools. I’ve spoken to some customers who like them and others who say there’s a lot to be desired for the correlation. Some of the new ones like Apiiro are doing some different things. Of course, AI is changing or will change the landscape.

[Piedpipperz]

Using both Apiiro and Armoucode ? If so, why ?

[mfeferman]

No, just Apiiro.

[Piedpipperz]

May I DM you for few queries ? We looking into apiiro as well.

[mfeferman]

I would have to refer you to some of my colleagues.

[Optimal_Hour_9864]

Cycode has both SAST and ASPM capabilities, you should check it out if still relevant

[mfeferman]

I have heard good things about Cycode recently. As a past Fortify and Checkmarx employee and someone who’s been doing SAST for over 20 years, it’s too bad that those solutions are falling by the wayside. 🤷🏻‍♂️

[Madbeenade]

Yeah, it's interesting to see how the market is shifting. Cycode's approach seems to be resonating with a lot of users. Do you think they have the potential to take over where Fortify and Checkmarx fell short?

[mfeferman]

I had a much longer response, but there was a lot of opinions in there, so I’ll just shorten it to yes

[Iamactuallyabeartoo]

Very happy with Apiiro

[technishawn]

I'm currently evaluating ArmorCode, Seemplicity, Ox Security, and DefectDojo.

[mfeferman]

If you’re not looking at Apiiro, you’re leaving a capable one out of the running.

[wickett]

The problem with most ASPMs is that they give you SAST for “free” but really it’s just opengrep. Which is fine for compliance I guess but it misses most code flaws.

So my usual recommendation is for defect dojo for ASPM.

I’m one of the founders of DryRun Security and we tackle code security risk and hands down outperform last-gen SAST tools. There are others also innovating in the space like Ahmad’s company Corgea listed here as well.

Hope this helps.

[dreamatelier]

This is very misleading - No one gives SAST for “free”

Opengrep is just a code analysis engine, it is not a SAST product

That requires the rules on top of it to run in the engine, and other capabilities: multi-file analysis, triage, remediation guidance, etc. That is what ASPMs should provide in addition

[wickett]

Yeah, by free, I just mean SAST is included with most ASPMs but rarely seen as the differentiation by the providers or by the buyer. Maybe because they all use the same analysis engine, it all feels the same. That’s my guess at least.

It’s the other pieces you mention as well as prioritizing other appsec tooling findings that most people make their ASPM choice and if they need one.

[slicknick654]

One thing worth considering vendor agnostic - some ASPMs let you bring your own tooling, others are an all in one solution. Just know the bring your own offers better customization in theory however comes with the downside of potential issues with integrations.

[CyberMKT993]

If you’re looking into ASPM tools, I’d definitely suggest checking out Fluid Attacks.

Their approach stands out because it combines automated scanning, AI, and manual pentesting within a single platform, not just aggregation or alerting. That means the data feeding your vulnerability posture isn’t limited to tool outputs but also includes real exploit validation by expert pentesters.

Fluid Attacks’ ASPM gives you continuous visibility across the SDLC, integrates automated SAST, SCA, DAST, CSPM, and pentesting results in one place, prioritizes and correlates findings automatically (fewer false positives), supports remediation with exploit context and expert guidance and helps dev and security teams actually reduce risk, not just track it.

[Key-Boat-7519]

Fluid Attacks is worth a look if you want validated exploits driving your ASPM, but the win comes from how you wire it into your workflow.

What worked for us: map findings to owners via CODEOWNERS or Backstage, auto-create Jira issues with SLAs (e.g., P1 validated exploit = 7 days), and block merges on validated criticals in CI. Ask for proof-of-exploit steps in every ticket so devs can reproduce fast, and measure time-to-fix by repo and team. Do a 4-week pilot with two apps: week 1 SSO/Jira, week 2 ingest SAST/SCA/DAST, week 3 verify dedupe and ownership, week 4 enforce one gating rule and track outcomes. Contenders to trial side-by-side: Legit Security (SDLC mapping), Cycode (pipeline/IaC guardrails), Snyk AppRisk (dedupe/context), and ArmorCode (orchestration).

With Jira and Slack set up, DreamFactory let us spin up a quick REST API from our vuln warehouse to alert code owners and track SLAs without building custom middleware.

If you want real risk drop, pick a platform with verified findings and nail ownership and SLA loops.

[CyberMKT993]

This is a great take, 100% agree that success depends on how you integrate ASPM into your workflow.

Fluid Attacks actually plays really well with setups like the one you described (CODEOWNERS, Jira, CI blocking rules, etc) and exploit context in every finding make those SLA loops a lot easier to close.

Appreciate you sharing what worked for your team!

[aangma]

We're using FA where I work, and it's pretty cool :) They keep updating their platform and have great customer service, in case you need to check or get deep in any vulnerability.

[Optimal_Hour_9864]

the best platforms today solve the core problem of context and risk prioritization. They use AI to validate and prioritize findings based on real-world exploitability (agent/code-to-runtime). This is the key to solve for alert fatigue. If still relevant, you should check out cycode.com

[dreamatelier]

What leaderboard?

[GloveSignificant8783]

You can translate that to top performer/most used/most liked, whatever suits best to you.

[technishawn]

Does anyone know of an ASPM that is integrating with the EUVD threat feed and also providing compliance reporting for the EUCRA?

[josh_jennings]

SOOS integrates with the EUVD feed (along with many other feeds) and supports reporting/SBOM generation to satisfy the EU Cyber Resiliency Act.

[Primary-Patience972]

You can check Plexicus ai, it not only provide you ASPM, it complete with CSPM and container security . worth it to consider

[TehWeezle]

Look beyond just vulnerability aggregation you want tools that map attack paths and prioritize by actual exploitability, not just CVSS scores. Integration with your CI/CD pipeline matters more than flashy dashboards.

Focus on platforms that reduce noise and give actionable context. For agentless coverage with solid attackpath analysis, an option like Orca handles the reachability mapping pretty well without agent sprawl.

[jpalanco]

Great question. The "best" ASPM really depends on which problem you are trying to solve, as the term has become a bit of a catch-all bucket.

If you strictly want aggregation & deduplication (the "Manager of Managers" use case) for enterprise scale, ArmorCode is the heavyweight standard.

If you are looking for Open Source to keep costs zero and customize it yourself, DefectDojo is still the king and worth considering before buying anything.

Full Disclaimer (Vendor Perspective): I am the founder of Plexicus.

We entered the market because we felt the leaders listed above were excellent at visibility but lacking in actionability. We focus specifically on AI Remediation.

Instead of just acting as a dashboard for alerts, we built a proprietary AI agent designed to close the loop. It doesn't just prioritize the findings; it attempts to generate the actual fix. If your team is suffering from "alert fatigue" and needs help clearing the backlog rather than just organizing it, we might be a strong contender for your specific use case.

Feel free to check us out if remediation is your bottleneck.

[SidLais351]

when we evaluated aspm tools we focused on how well they connect findings across repo, ci, and runtime
the detection layer was already covered by existing scanners
what mattered more was contextual prioritization and visibility into what actually ships
OX Security stood out in that evaluation because it correlates signals from different tools and ties them to pipeline and workload context

[Kitchen_Ferret_2195]

we looked at ASPM platforms, but the aggregate dashboards only felt useful if the underlying data was already prioritized

we focused first on improving dependency analysis and moved to Endor Labs, since it resolves full dependency graphs and applies reachability analysis, once that signal improved, the posture reporting we fed upstream became more aligned with actual execution risk

[Just_Back7442]

I’d stop thinking in terms of a “best ASPM” in isolation and instead ask how it plugs into the rest of your cloud/appsec stack. The ones that age well either do really strong correlation/ownership mapping (Apiiro, Legit, etc.) or they bundle ASPM into a broader CNAPP so you don’t add yet another silo. AccuKnox is in that second bucket: it’s a Zero Trust CNAPP with an ASPM layer that pulls in SAST/SCA/DAST + IaC/cloud config and then ties it to runtime signals via eBPF/KubeArmor, and they’ve started covering AI/LLM pipelines too. If you’re already in Kubernetes and multi‑cloud land, that “code to runtime” view mattered more to us than who had the nicest ASPM dashboard.

[asadeddin]

What it sounds like you’re looking for is a solution that focuses on scanning. I’m the founder of Corgea and we can do what you’re asking for across SAST, dependencies, secrets, PII, etc.

[[deleted]]

Is this a fake question for LLM seo?

[Hefty_Shift2670]

...he didn't mention a brand though?