The Appsec Testing Tools category includes tools which identify software defects using different techniques.

Static code analysis tools, such as SAST, SCA, and IaC Security identify defects in the code or in the composition recipes of software. Dynamic security testing tools - DAST and IAST which interact with running software to identify software defects and security misconfiguration. Included in these tools are those which combine different techniques and offer additional tests in a specific domain such as MAST. With AST, teams can automate security testing, and identify defects.

Through ASPM, the reports created by these tools are prioritized based on the context of the asset, and then integrated into the remediation backlog. The reports are also used to analyze and visualize present security posture.

Application Protection Tools are tools that detect application level intrusion attempts and protect against application level attacks in real time.

The category includes WAF and WaaP solutions which provide perimeter level protection, and RASP which offers advanced detection and protection by being integrated directly into the application. Bot mitigation solutions address a problem of a different nature, and can run in the perimeter or be integrated into the application. CI/CD Security means to detect issues in CI/CD and the processes running in these environments, and protect them from malware in upstream software supply chain.

Protection tools offer centralized improvement of security posture. With ASPM, matrices collected from protection tools are used for asset discovery and classification, as well as to assess the coverage of protection. In many cases, activating protection features can be a quick temporary fix that improves protection - until the software defect is resolved.

AppSec services offer advanced security testing with Penetration Testing services and Bug Bounty platforms and programs. Some Vendors strive to add protection from the source by educating and training developers to produce software with less security defects.

Human led activities serve an important part of ASPM, as they produce output that can often be easily translated to prioritized tasks, and serve as a benchmark for automated security tests.