Make smarter decisions on the application security market

Application security is hot right now, and the big AI labs have just walked in.

We've found a lot of interesting signals. For example, OpenAI unveiled Aardvark in October 2025, an AI agent that reads code, finds vulnerabilities and proposes fixes. In February 2026, Anthropic launched Claude Code Security, and cybersecurity stocks fell the same day. Two months later, its Project Glasswing gave about fifty companies and open-source groups an unreleased model that had found thousands of serious flaws, including one that had sat in OpenBSD for 27 years. Finding bugs in code is becoming something AI does at scale, and the biggest AI companies want a piece of it.

Here, we explain why AI changes both sides of the fight, what it means for scanner vendors when an AI lab offers bug hunting of its own, and where that leaves the startups in between.

Developers write code faster than security teams can review it, and most scanners answer with a wall of alerts.

We compare six kinds of application security companies, from code scanners and open-source checks to API protection and tools that guard the running app. Their buyers range from developers and security teams to platform engineers. Then we rank what each needs most: fewer false alarms, a fix that comes with the alert, and a clear view of which flaws an attacker can really reach.

This shows which problems teams will pay to fix this year, and which ones keep getting pushed to the next sprint.

Per-developer seats, per-app or per-scan pricing, platform bundles, usage fees for AI fixes, and free open-source tools with a paid enterprise layer: application security companies charge in many ways.

We compare who pays and what each model costs to run. Per-developer pricing grows with the engineering team, but buyers push back when headcount shrinks. AI fixes cost money in model calls on every scan. Open-source tools spread fast, but only a small share of users ever pay. And platform bundles win big deals, often at a steep discount.

You'll see which models still make money when AI labs offer bug hunting cheaply, and which ones rely on customers never comparing prices.

Growth numbers say little without the reasons behind them. Here, we explain what pushes this market forward.

Some drivers are plain to see: more code, more open-source packages, and more attacks on the software supply chain. Others feed each other. Rules like Europe's Cyber Resilience Act make software makers answer for flaws in their products. AI coding tools create more code to check. And the better AI gets at finding bugs, the more pressure there is to fix them quickly.

Before building or investing, you should know what makes a security tool part of how developers ship code, rather than one more report they ignore.

Checkmarx and Veracode are the names security teams have known for years, but the application security market goes far beyond them.

A lot of the interesting work happens in narrow corners. Some only check open-source packages for malware before they reach a build. Others test APIs for broken access rules, catch passwords and keys left in code, or rebuild common software images so they ship with no known flaws.

They're hard to compare because every vendor says it finds more bugs. One counts every theoretical issue, another only the ones an attacker can reach, and few publish results you can check. Many also sell through code platforms or cloud marketplaces, so buyers see the platform's name, not theirs.

Below, you'll find the market grids and ecosystem maps we've built to show who protects which part of the software, and where newcomers are finding room.

Semgrep, Chainguard, Aikido… a few application security companies are growing fast with paying customers. None has yet shown it can replace the incumbents across a whole company.

Semgrep started with an open-source scanner developers could tune themselves, then sold it to security teams. Chainguard sells software images that start with no known flaws, so teams spend less time chasing them. Aikido bundles many scanners into one simple product for smaller teams. Each began with a problem developers already felt, not a compliance checkbox.

We'll show how these teams got developers to keep their tools switched on, and how they turned that daily use into contracts with security teams.