SAST Tools Compared: DerScanner, PT Application Inspector, Solar appScreener, Checkmarx, Semgrep

There is no universal winner among SAST tools. Semgrep stands out for its lightness and open engine, Checkmarx is an international platform, PT Application Inspector and Solar appScreener combine static and dynamic analysis with localised support, and DerScanner offers a broad set of methods in an on-premise delivery. The choice depends on your stack, your requirements for where code is hosted, and what a test on your own code shows.

Below is a neutral comparison of five solutions based on publicly available sources. We are a DerScanner partner and state this openly. Information about the other products comes from vendor websites, documentation and reviews; where data is unavailable, we write “check with the vendor”. The criteria we compare against are explained in the article “How to Choose a SAST Analyser”.

Summary: who each tool is for

• DerScanner — a platform with SAST, DAST, SCA, mobile and binary analysis in one interface; suits organisations that need a single on-premise setup for several analysis types.
• PT Application Inspector — SAST, DAST, IAST and SCA with an emphasis on confirming vulnerabilities; a natural choice for organisations within the Positive Technologies ecosystem.
• Solar appScreener — SAST, DAST and software composition analysis in one interface, with support for a broad list of languages.
• Checkmarx — an international platform with SAST, SCA, IaC and other modules, with its main focus on the cloud.
• Semgrep — a lightweight analyser with an open engine and custom rules; good for a quick start and for teams ready to write their own rules.

DerScanner

DerScanner combines static (SAST), dynamic (DAST) and software composition analysis (SCA) in one interface. It can analyse both source and binary code, as well as mobile applications. This matters if part of your software comes from contractors without source code. The product is delivered for deployment in your own environment, which removes the question of sending code outside.

• Strengths: several analysis methods on one platform, binary analysis, local deployment.
• Limitations: the current list of languages and modules for your edition, and the cost, are clarified with the vendor; there is no public price list.

More about the product is on the DerScanner page. AST Cyber Lab is the vendor’s partner in the region.

PT Application Inspector

According to the vendor’s description and the Anti-Malware.ru review, the product combines SAST, DAST, IAST and SCA. It partially executes code to check whether a discovered path can be exploited, generates test HTTP requests to confirm findings, and can produce virtual patching rules for PT Application Firewall. The languages listed in the review of version 4.0 include Java, PHP, C#, JavaScript, Python, Kotlin, Go, C/C++, Swift and others; the languages available depend on the licence. There are integrations with Jenkins, TeamCity, GitLab CI and Jira, and reports against OWASP, PCI DSS and NIST 800-53.

• Strengths: confirming vulnerabilities reduces noise; works together with the same vendor’s WAF product.
• Limitations: price on request; the greatest benefit comes when used alongside other Positive Technologies products; for companies in Central Asia, check the possibility of delivery and local support in advance.

Solar appScreener

According to the vendor’s materials, the analyser supports 36 programming languages and combines SAST, DAST and third-party component analysis in one interface. Descriptions of recent releases mention proprietary detection rules, the ability to limit analysis depth, and FSTEC certification with inclusion in the registry of Russian software. Correlating SAST and DAST findings helps with prioritisation: a vulnerability in the code is confirmed by a scenario run against the live service.

• Strengths: broad language support, a combination of SAST and DAST, the ability to write rules.
• Limitations: a Russian vendor; price on request; check delivery and support terms for your country.

Checkmarx

Checkmarx One is a cloud platform that combines SAST, SCA, container scanning and detection of malicious packages, IaC, secrets and API security. The product page also mentions on-premise SAST, but the main emphasis is on the cloud platform. The vendor claims a hybrid engine that combines deterministic rules with AI. The full list of supported languages is given in the Checkmarx documentation.

• Strengths: a broad international platform, many modules, a developed ecosystem.
• Limitations: a cloud model may not suit organisations that do not send code outside; prices on request; availability and delivery terms for countries in the region need to be clarified separately.

Semgrep

The Semgrep engine is distributed under the LGPL-2.1 licence, and the Semgrep platform supports more than 30 languages in Semgrep Code. The Community Edition analyses code only within a function or file and suits quick ad hoc checks where false positives are acceptable. The paid Semgrep Code edition adds cross-file analysis, which according to the documentation yields fewer false and more true positives but runs more slowly. Semgrep rules are written declaratively, in a form close to the code itself, which is convenient for checking internal coding conventions.

• Strengths: fast start, transparent rules, flexibility, a good option for CI.
• Limitations: the free edition is less thorough; extended rule sets and cross-file analysis are tied to paid editions; support maturity differs by language.

Comparison by key criteria

• Analysis methods: DerScanner — SAST, DAST, SCA, mobile and binary; PT Application Inspector — SAST, DAST, IAST, SCA; Solar appScreener — SAST, DAST, SCA; Checkmarx — SAST, SCA, IaC, containers and more; Semgrep — SAST (plus a separate module for dependencies).
• Main deployment model: DerScanner — your own environment; PT AI — a server on Linux or in Docker; Solar appScreener — an installable solution; Checkmarx — mainly cloud; Semgrep — a local CLI and a cloud platform.
• Pricing: DerScanner, PT AI, Solar appScreener and Checkmarx have no public price list, and pricing is on request; Semgrep has a free edition, and paid plan terms are on the vendor’s website.
• Custom rules: possible in PT AI, Solar appScreener and Semgrep; for other products, check with the vendor.
• Vulnerability confirmation: most pronounced in PT AI, and in the SAST+DAST combination of Solar appScreener.

When each solution fits

• A bank or telecom where code does not leave the perimeter and binary analysis is needed — include DerScanner and local installations of other vendors in the pilot.
• You need a single Positive Technologies stack — PT Application Inspector.
• You need the maximum number of languages and SAST combined with DAST — Solar appScreener.
• An international company where the cloud is acceptable — Checkmarx.
• A small team, a quick start and readiness to write rules — Semgrep.

In practice, the most important step is to test 2–3 candidates on the same repositories. The testing sequence is described in the article “Running a SAST and SCA Pilot in 30 Days”. For a look at how open-source and commercial solutions differ in cost, read “Open-Source or Commercial AppSec Tools”.

What to look at in a practical comparison

Any comparison table goes out of date quickly: vendors release new versions, extend their language lists and change licensing models. Use this review as a starting point for a shortlist, not as the final decision. For each candidate, request from the vendor an up-to-date matrix of supported languages and frameworks, a description of the deployment architecture, a list of integrations, and support terms for your country.

Also check the questions that rarely appear in reviews: how the product behaves on very large repositories, how scan results are stored and encrypted, whether access to findings can be restricted by role, and how the solution updates its rules in an isolated network. These details most often determine whether the tool will work in production at a bank or a telecom operator.

Frequently asked questions

Sources

• Anti-Malware.ru: review of PT Application Inspector 4.0
• Habr: Solar appScreener news
• Checkmarx One: platform overview
• Semgrep Docs: Semgrep Code overview
• Semgrep on GitHub
• SecurityLab: review of Russian SAST and DAST systems (personal blog)