Every European application security platforms (SAST, SCA, ASPM) tool reviewed
Valladolid, Spain
Free tier covering 5 contributors, up to 10 repos and 200 scans each month; Team and Business plans are priced by contributor count and daily scans, with the figures rendered client-side
Best for: Teams wanting protection for the build pipeline and for malicious packages alongside conventional code scanning
Xygeni treats the build system as something to scan, not only the code that goes into it. Its product list runs from SAST, SCA and secrets with auto-revocation through infrastructure as code and container images to CI/CD security, and a Shield feature stops malicious packages before they execute. An ASPM view gathers the results in one inventory, and an IDE plugin gives feedback before code is pushed.
The provider is XYGENI SECURITY, S.L. in Valladolid, and the platform terms apply Spanish law with disputes going to the courts of Madrid. The free plan covers 5 contributors, up to 10 repositories and 200 scans a month. Paid prices are drawn client-side, so a quote is the only way to budget. The pages reviewed state no data region and no self-hosting, and the vendor is smaller than Black Duck, with fewer public references.
What Xygeni does well
- Contracts under Spanish law with a Spanish company
- The free tier already includes SAST, SCA and secrets scanning
- Looks at CI/CD pipelines and malicious packages, not just code
- An ASPM view over the whole inventory
- An IDE plugin that reports issues early
Where Xygeni falls short
- No data region on the pages reviewed
- Prices for paid plans render client-side
- A smaller vendor with fewer public references
- Self-hosting is not stated
Standout feature. Xygeni is the only entry here that lists blocking malicious packages and build integrity checks as core features.
Ghent, Belgium
Founded 2022
Free tier for two users; Basic and Pro monthly fees on the pricing page (currency chosen by a client-side selector, so no symbol is claimed)
Free tier, no card needed
Best for: Small developer teams wanting code, container and cloud scanning from one Belgian vendor
Aikido Security brings dependency, secret, source code, infrastructure-as-code and container checks, plus AI AutoFix, into one dashboard, so a team reads a single findings list instead of juggling scanners. A free plan for two users removes the demo step, which suits a developer who wants to try it on a side project before anyone talks to procurement.
The contracting company is Aikido Security BV in Ghent, founded in 2022. The site also shows offices in the United States and the United Kingdom, which is worth a question in procurement. The pricing page lists Basic and Pro monthly fees per ten users, yet the currency comes from a client-side selector, so no symbol is claimed here. No data region was seen on the pages we read.
What Aikido Security does well
- Belgian BV named as the contracting company
- The free plan takes two users, no card needed
- Code, packages, containers and cloud findings arrive together
- AI AutoFix proposes corrections for issues it finds
Where Aikido Security falls short
- Company founded in 2022, so a short history
- US and UK offices appear next to the Belgian one
- Paid fee currency is not readable without the selector
- No data region seen on the reviewed pages
Standout feature. Aikido Security is the one tool here that unites scanners for code, containers and cloud with a free plan and no sales call.
Lisbon, Portugal
Founded 2012
Developer plan free for individuals; Team plan from $18 per developer each month with annual billing or $21 monthly, capped at 30 developers; Business plan quoted case by case; open-source projects free forever
Best for: Teams reviewing code in pull requests who want security gates to appear there
Codacy puts its checks in the pull request, where a reviewer already looks. The platform began as code-quality tooling and now adds SAST, SCA and secrets checks, an AI Reviewer that comments on changes, and Guardrails that fix AI-written code before merge. It can also generate unit tests for files with low coverage.
The operating company is Qamine Portugal S.A. in Lisbon, active since 2012, and the vendor states SOC 2, ISO 27001 and GDPR compliance. Individuals use the Developer plan free, open-source projects pay nothing, and the Team plan costs $18 per developer a month on annual billing or $21 monthly, up to 30 developers. Larger buyers move to a quote, and no on-premise option is published.
What Codacy does well
- AI Reviewer posts comments on the pull request itself
- Guardrails repairs AI-written code before it merges
- Unit tests are drafted for under-covered files
- No charge for individuals or open-source projects
- Portuguese company stating SOC 2, ISO 27001 and GDPR
Where Codacy falls short
- Checks code but writes none, so a generator must sit beside it
- Business pricing is by quote only
- No on-premise deployment is published
- The Team plan stops at 30 developers
Standout feature. Codacy puts security findings and AI-generated code fixes inside the pull request review instead of a separate console.
Geneva, Switzerland
Founded 2008
Free tier for private code up to 50,000 lines; Team plan from roughly $34 a month for 100k lines; Gitar AI Code Review from $20 per seat each month with annual billing; Enterprise quoted case by case; public OSI-licensed repositories free forever
Best for: Teams wanting static analysis on their own servers across many languages, at published prices
SonarQube has analysed code since 2008, and its Community Edition is open source under LGPLv3, published on GitHub, so the core engine can run on your hardware without sending code to a vendor cloud. SonarQube Server covers on-premise commercial use and SonarQube Cloud the hosted one. The Team plan covers SAST, SCA and secrets detection across 30-plus languages, with Gitar for AI pull-request review and AI CodeFix suggestions.
SonarSource Sàrl sits in Geneva, and Switzerland is outside the EEA, relying on an adequacy decision. Prices are concrete: free up to 50,000 lines of private code, a Team plan from about $34 a month for 100k lines, Gitar from $20 per user a month on annual billing, and a 14-day trial with no card. The vendor says more than 7 million developers use it. AI features route through third-party models.
What SonarQube does well
- Community Edition is LGPLv3 open source and runs on your own servers
- Gitar reviews pull requests with AI, and CodeFix suggests repairs
- SAST, SCA and secrets across more than 30 languages
- Public prices plus a 14-day trial
- Eighteen years of operation by one Swiss company
Where SonarQube falls short
- The free tier stops at 50,000 lines of private code
- AI review and CodeFix pass through third-party language models
- It analyses and reviews, it does not write code
- The full enterprise feature set needs a paid plan
Standout feature. SonarQube lets you run an open-source analysis engine on your own servers, an option none of the other entries offers.
Israel, Israel
No public price list found; buying starts with a demo
Best for: Security teams wanting a single risk map across repositories, pipelines and AI coding tools
Legit Security begins with posture rather than scanning: a combined picture of repositories, build systems and deployments, with native scanners for SAST, SCA and secrets added on top, and reachability analysis to reduce alert volume. VibeGuard is described as endpoint security for AI-generated code, and remediation guidance flows into Cursor, Claude Code and GitHub Copilot.
Legit Security Ltd. is named in the website terms, which apply Israeli law. Those terms are the only legal text we read, so the entity on an order form remains unconfirmed. No price, no data region and no founding year appear on the pages reviewed, and onboarding is aimed at enterprises. The company publishes Legitify as open source, allowing engineers to inspect its approach before booking a demo.
What Legit Security does well
- A posture view across repositories, pipelines and deployments
- Reachability analysis intended to cut alert noise
- Guardrails aimed at AI coding tools
- Legitify is published as an open-source project
Where Legit Security falls short
- Whether the order-form entity is the same company is unconfirmed
- No public pricing
- No data region is stated
- Onboarding is enterprise-shaped
Standout feature. Legit Security is the entry that applies guardrails to AI coding agents such as Cursor and GitHub Copilot.
Givatayim, Israel
Upper bounds only: Mend AppSec up to $1000 per developer per year, Mend AI up to $300, Renovate Enterprise up to $250
Best for: Companies with a large open-source footprint wanting dependency risk and automatic updates from one vendor
Mend.io centres on dependencies. Its SCA prioritises with reachability, EPSS and CVSS 4.0, SAST and container scanning share the AppSec product, and Mend Renovate opens the dependency updates that fix what is found. Mend AI, sold separately, adds an AI bill of materials and shadow AI discovery. Integrations cover GitHub, GitLab, Bitbucket and Azure DevOps.
Customers outside the United States and Canada contract with White Source Ltd. in Givatayim under English law, while US and Canadian entities contract with WhiteSource Software, Inc. The privacy policy says hosting is in the US or the EU and that data may be processed in the US, Israel and the UK. Prices appear as ceilings only: up to $1000 per developer per year for AppSec, $300 for Mend AI and $250 for Renovate Enterprise.
What Mend.io does well
- Dependency scanning is joined by Renovate update automation
- Findings ranked by reachability
- Customers choose US or EU hosting
- Customers outside North America sign with an Israeli company
- Works with GitHub, GitLab, Bitbucket and Azure DevOps
Where Mend.io falls short
- Prices are given only as maximums
- US and Canadian buyers sign with a US subsidiary
- Processing can take place in several countries
- The AI product is priced separately
Standout feature. Mend.io pairs a dependency scanner with Renovate, so the same vendor that reports a vulnerable package also proposes the update.
Israel, Israel
Quoted individually
Best for: Application security teams wanting code-side risk context, kept separate from cloud posture tooling
Cycode links results from SAST, SCA, secrets, infrastructure-as-code, container and CI/CD scanning through a context graph that points to code owners, and it generates SBOM and AI-BOM documents. AI agents analyse exploitability and open pull requests with fixes, and the product governs AI coding tools and MCP servers. Faster fixes and fewer false positives are vendor results.
The website terms name Cycode Ltd., an Israeli company. A separate EU login at app.eu.cycode.com answers part of the data-region question, though no region is otherwise stated. The public pages show no cloud account scanning or runtime sensor, pricing is by quote, and the analyst rankings on the home page were not checked. Each repository system must be connected during rollout.
What Cycode does well
- Scanning spans code, packages, secrets and pipelines
- A context graph maps findings to owners
- Agents propose fixes as pull requests
- Governance for AI coding tools
- The website terms name an Israeli entity
Where Cycode falls short
- No cloud posture module
- Pricing is not public
- Rankings are quoted from the vendor
- Repository integrations take time to set up
Standout feature. Cycode runs a separate EU tenant, giving buyers a stated answer to the data-region question.
Paris, France
Founded 2017
Free tier for small teams; Business plan billed per active developer seat; Enterprise quoted case by case
Best for: Teams whose main worry is credentials leaking through git history, CI logs and chat
GitGuardian specialises in one signal, leaked secrets. It scans git history, CI logs and chat tools, and its Non-Human Identity governance covers long-lived API keys and tokens. It works with any forge rather than one platform, and it reports what has leaked without storing or managing the working secrets, so a secrets manager is still needed.
GitGuardian SAS in Paris has operated since 2017. A free plan exists for small teams, the Business plan bills per active developer seat (someone who committed in the last 90 days) and Enterprise is quoted. The Growth plan lists US and EU hosting, and Enterprise can be self-managed. A US affiliate, GitGuardian Inc., acts as joint controller for American customers, and the Business price is not published.
What GitGuardian does well
- Looks for secrets across git history, CI output and chat tools
- Small teams can run on the free plan
- Seat count follows developers with a commit in the last 90 days
- Governs non-human identities such as long-lived keys and tokens
- Not tied to any one code host
Where GitGuardian falls short
- Reports leaks only, it keeps no secrets for you
- The Business tier shows "per seat" and no amount
- For US customers a US affiliate is joint controller
- A further subscription next to the code host
Standout feature. GitGuardian bills a seat only for developers who committed in the last 90 days, so dormant accounts cost nothing.
France
No amounts on the pricing page; every route ends in a demo booking
Best for: API-centred organisations where business-logic flaws matter more than known CVEs
Escape tests running applications rather than source code. Its AI engine looks for broken authorisation and other business-logic flaws in APIs, the class of bug that no CVE list describes, and the company has extended it into AI pentesting with a retest step and attack surface management. We claim no SAST or SCA for it.
Escape Technologies SAS is a French company, and its privacy policy names France though the street address given is incomplete, so procurement should ask for the full registered office. The pricing page shows no amounts and each route ends in a demo booking. Internal networks are out of scope, which fits cloud-native stacks built around APIs better than a legacy estate.
What Escape does well
- Dynamic tests that understand business logic
- Scans begin from the API definition
- External pentests with a retest step
- French company under EU law
Where Escape falls short
- No amounts on the pricing page
- The privacy policy address is partial
- Internal networks are not scanned
- Buying starts with a demo booking
Standout feature. Escape aims its tests at business-logic flaws in APIs, where signature-based scanners find nothing.
Stockholm, Sweden
Founded 2013
Per year: Starter free (5 users, 100 assets), Standard €2,500, Professional €5,000, Enterprise €15,000
Best for: Security teams wanting ongoing external testing of web applications, APIs and exposed assets
Detectify scans web applications, REST and GraphQL APIs (from the Standard tier up) and the external attack surface, using payloads sourced from more than 400 ethical hackers. CI/CD integration begins at Professional, so scanning can run inside a deployment pipeline. It reports vulnerabilities; it is neither a WAF nor a CDN, and it does not read source code.
Detectify AB in Stockholm has operated since 2013 and states ISO 27001 and GDPR compliance. Prices per year are public: Starter is free for 5 users and 100 assets, Standard costs €2,500 with a cap of 750 assets and 10 users, Professional €5,000, and Enterprise €15,000 for unlimited users and assets. The jump to Enterprise is steep, and paid tiers get tailored trials.
What Detectify does well
- Attack surface monitoring and application scanning in one product
- Test payloads contributed by 400+ ethical hackers
- Scans REST and GraphQL interfaces
- A public yearly price list that starts free and ends at €15,000
- Stockholm company, so Swedish and EU law
Where Detectify falls short
- Reports weaknesses but blocks nothing, so it replaces no WAF or CDN
- The Standard plan allows 750 assets and 10 users at most
- Pipeline integration needs Professional or higher
- Enterprise costs €15,000 a year, a big jump
Standout feature. Detectify publishes a flat yearly price at every tier, which almost no application security vendor does.
