Application security testing vendors

OpenText provides software and services for managing information across an organisation.

Qualys provides an enterprise cyber risk and security platform.

Creators of OSCP, Kali Linux, and Exploit-DB, offering penetration testing services from the team that trains the world's ethical hackers.

Poland's longest-running independent pen testing firm with 50+ consultants. Specialises in application security, cloud testing, and red teaming.

Elite security research firm specializing in source code review, blockchain auditing, and building industry-standard open-source security tools.

Mexico-based cybersecurity firm delivering pen testing services across Latin America with international standards alignment.

Australian senior-led boutique pen testing firm with consultants in Sydney, Melbourne, and Brisbane. CREST CRT, OSCP, and OSCE certified testers.

Cloud security penetration testing specialists known for the Pacu AWS exploitation framework and deep expertise across AWS, Azure, and GCP environments.

Singapore CREST-accredited and CSA-licensed offensive security boutique. Manual, senior-led testing with strong MAS TRM and PDPA expertise.

Berlin-based web, browser, and cryptography auditors founded by Dr. Mario Heiderich, trusted by ExpressVPN, NordVPN, 1Password, and Bitwarden.

Boutique UK penetration testing consultancy in Milton Keynes specialising in manual, expert-led security assessments across web applications, APIs, cloud, and mobile platforms.

AISafe Labs provides AI-powered penetration testing services for applications.

AISLE provides AI-native vulnerability management that finds, fixes, and verifies software vulnerabilities.

Appdome provides a no-code platform for building security and anti-fraud defenses into mobile apps.

Data Theorem provides application security for mobile, API, cloud, and AI-driven applications.

Enoki Labs makes Enoki, a platform that attacks AI agents to find security and safety weaknesses.

Fuzzes compiled ECU and embedded firmware in emulation, finding memory bugs without needing the physical hardware.

Guardsquare provides mobile app security through code hardening, testing, and threat monitoring.

Hexens audits smart contracts and provides offensive security for blockchain and Web3 projects.

Intrudify sells an AI-driven penetration testing platform for web applications and APIs.

Software supply chain security and artifact management platform that blocks risky open source packages, scans for exploitable vulnerabilities and governs releases and AI models.

Lasso Security provides a platform to secure AI agents and applications at enterprise scale.

NowSecure provides mobile app security and AI governance.

O3 Security sells a platform for software supply chain security.

Pune security firm testing in-vehicle systems, telematics and EV charging, with a hands-on car hacking course.

Penetrify provides automated penetration testing for web applications.

Reversec provides cybersecurity consulting services, including penetration testing and resilience development.

ReversingLabs provides software supply chain security and threat intelligence to verify and secure enterprise software.

Safeguard is a software supply chain security platform.

ScanTitan provides website security scanning, malware removal, and external attack surface management for businesses.

Soken is a Web3 services firm based in London.

Sonatype provides tools to manage and secure open source components and AI models in software development.

Provides an AI security engineer that finds and fixes software risks using coding agents.

Vulert monitors open-source dependencies for vulnerabilities and license compliance without accessing source code.

Zimperium provides mobile security for devices and applications.

42Crunch provides security governance for MCP servers and APIs used by AI agents.

HackenProof runs a bug bounty and crowdsourced audit platform for blockchain and crypto projects.

Monarc provides a unified security platform that scans websites for vulnerabilities and explains fixes in plain language.

Exposure management platform with vulnerability management, external attack surface management, application security testing, pen testing as a service and digital risk protection.