Buying static application security testing is supposed to mean a scanner reads the code you wrote and tells you where first-party flaws sit, before the build runs. What shows up in the quote is often three purchases on one line: open-source dependencies, a posture dashboard, and a nightly PDF. Those are not the same buy.
SAST looks at source, or a binary, without executing the app. SCA looks at libraries you imported. DAST hits a running URL. Mix those up and you can spend SAST money on a dependency feed while the pull request still has no comment. OWASP’s source code analysis page treats SAST as a white-box review of the code you ship. NIST SP 800-218 (SSDF) puts static analysis in the produce-well-secured-software practice, not in a market ranking. The method we used is on How we review tools.
We compared seven tools on that split: whether a first-party page names a living SAST SKU, whether the scan sits in the IDE or the pull request, whether any meter is public, and whether languages or CWE mapping are printed. Semgrep Code, Snyk Code, GitHub Code Security, and SonarQube Cloud print a contributor or LOC rate and talk to the developer loop. Wiz SAST is quote-only, but the finding sits on the same graph as the cloud. Checkmarx One and Veracode Static Analysis are the committee platforms: required SAST in a bundle, or source plus binary plus hybrid, both behind a sales quote.
Problems and Solutions
Most SAST quotes fail for the same few reasons. The fix is operational, not a new acronym.
| Problem | Solution |
|---|---|
| The quote is SCA, ASPM, or DAST labeled as SAST | Require a first-party page that names a living SAST SKU and scans first-party code, not only libraries or a running URL |
| Findings arrive as a weekly PDF the author never opens | Require IDE or pull-request comments on the product page, not only a platform export |
| Finance is surprised by the seat count after onboarding | Read whether the meter is 90-day contributors, private LOC, or applications, and whether bots or coding agents count |
| The languages you ship are missing from the scan | Print the language and framework list from the vendor page before the demo, then match it to the default branch |
How we evaluated SAST tools
The filter was four first-party checks: a living SAST SKU on a product page, a scan in the IDE or the pull request, a public meter versus quote-only, and languages or CWE / OWASP mapping printed before a sales call. Market labels like “AI AppSec” did not move a ranking. GitLab Advanced SAST, OpenText Fortify SAST, and Black Duck Coverity sit in What we left out because they failed a named check. Some pages still say GHAS as one bundle. The living GitHub products are Code Security and Secret Protection, so Code Security is the SAST row.
TL;DR: The Seven Compared
| Tool | Best For | Pricing Model | Highlights |
|---|---|---|---|
| Semgrep Code | Teams that want a printed SAST meter and custom rules | Free Code $0 / contributor, 10 contributors. Teams Code $30 / contributor / month | Pro engine, 35+ languages, 90-day private-repo contributor |
| Snyk Code | Developers who want SAST in the IDE and the pull request | Team from $25 / contributing developer / month. Ignite from $1,260 / year | Snyk Code is a separately purchased product on the same plan |
| GitHub Code Security | Orgs already on GitHub Team or Enterprise | $30 / active committer / month. Free on public repos | CodeQL plus code scanning. Not Secret Protection |
| SonarQube Cloud | Teams that bill quality and SAST on private LOC | Team from $34 / month for 100k LOC. Free to 50k LOC | SAST on Team. SCA sits in the Advanced Security add-on |
| Wiz SAST | Cloud teams that want code findings on the Wiz graph | Quote-only | Rule-based plus agentic SAST. IDE in Lovable, JetBrains, VS Code |
| Checkmarx One | AppSec programs that must buy SAST as the bundle foundation | Custom quote on developers, apps, and usage | SAST required. Contributing developer can be a person, bot, or AI agent |
| Veracode Static Analysis | Portfolios that need source, binary, and hybrid scans | Quote-only | Build-free source scan plus binary when source is missing |
Semgrep Code
Semgrep Code is the SAST module on Semgrep’s AppSec platform. Free Edition prints Code at $0 per contributor for a maximum of 10 contributors and 10 private repositories. Teams prints Code at $30 per contributor per month, with Supply Chain at $30 and Secrets at $15 if you add them. Enterprise is custom. First-party semgrep.dev/pricing.
A contributor is someone who made at least one commit to a private repository Semgrep scanned in the past 90 days. The compare table lists a Pro engine, Pro rules, 35+ languages, and cross-function taint analysis on every paid Code plan. Teams caps private repositories at 500. Enterprise removes that cap and adds on-prem source-code management plus custom CI. AI credits are 60 on Free, 20 per developer per month on Teams, and 50 on Enterprise.
Best for: Teams that want a printed SAST meter, custom rules, and a 90-day contributor definition they can audit.
What you get:
- Semgrep Code (SAST) as its own SKU, not only SCA
- Free Code for up to 10 contributors. Teams Code $30 / contributor / month
- Pro engine, Pro rules, 35+ languages, IDE plugins for VS Code and JetBrains
Why we like it: The pricing page separates Code from Supply Chain and Secrets, so the PO can say SAST without buying the rest.
Limits:
- Free and Teams cap private repositories (10 and 500)
- On-prem SCM and custom CI sit on Enterprise, which is quote-only
Price: Free Code $0 / contributor (10 contributors). Teams Code $30 / contributor / month. Enterprise custom. semgrep.dev/pricing.
Ask before you sign
If you also turn on Supply Chain and Secrets, the Teams line becomes $30 + $30 + $15 per contributor. Confirm which modules are on the order form.
Snyk Code
Snyk Code is Snyk’s SAST product. It scans first-party source in the IDE, on the pull request, and as a CI gate, without a compile step. The plans page starts Free at $0 per contributing developer, Team at $25 per contributing developer per month, Ignite at $1,260 per contributing developer per year for organizations with fewer than 50 developers, and Enterprise as contact sales. First-party snyk.io/plans.
Snyk’s products are sold separately and must sit on the same plan. The page says plan price varies per product, so the $25 Team figure is the published start, not a promise that Snyk Code is $25 in every cart. A contributing developer is someone who committed to a private repository Snyk monitors in the last 90 days. Public repositories do not count. Agent Fix is the named remediation add on the Code page.
Best for: Developer teams that want SAST in the IDE and the pull request, and can live with Snyk’s contributing-developer meter.
What you get:
- Build-free SAST in the IDE, pull request, and CI
- Team from $25 / contributing developer / month. Ignite from $1,260 / year
- Snyk Code as a separately purchased product on the chosen plan
Why we like it: The product page is SAST, not a dependency feed, and the scan is written for the pull request.
Limits:
- The published Team and Ignite dollars are plan starts. Confirm the Code line at checkout
- Enterprise, SSO, and richer reporting sit behind contact sales
Price: Team from $25 / contributing developer / month. Ignite from $1,260 / year / contributing developer. Enterprise quote-only. snyk.io/plans.
Ask before you sign
Ask whether the cart is Snyk Code alone or Code plus Open Source, IaC, and Container on the same plan. The footnote says you cannot mix plan tiers across products.
GitHub Code Security
GitHub Code Security is the living 2026 name for CodeQL and code scanning on private and internal repositories. GitHub’s changelog priced it at $30 per month per active committer when the Advanced Security bundle split, and repeated that rate when Team organizations got the SKU. Secret scanning on public repositories stays free. Private and internal repos need Code Security on GitHub Team or Enterprise. First-party GitHub changelog, 4 March 2025.
An active committer is a unique user who pushed a commit to an enabled repository in the last 90 days. Code Security is not Secret Protection. Secret Protection is a separate $19 per committer SKU for leaked credentials. The docs list CodeQL, Copilot Autofix, security campaigns, dependency review, and SARIF upload for third-party scanners. You still pay for GitHub Team or Enterprise under the add-on.
Best for: Organizations already on GitHub Team or Enterprise that want CodeQL in the pull request they already open.
What you get:
- CodeQL code scanning, Copilot Autofix, and security campaigns
- $30 / active committer / month on private and internal repos. Free on public repos
- SARIF upload so other scanners can land in the same alert inbox
Why we like it: It is the only row whose SAST engine is the pull request you already use, with a printed private-repo rate.
Limits:
- GitHub-perimeter only. It is not a multi-VCS SAST SaaS
- CodeQL Actions minutes still bill as Actions. Confirm that meter next to the committer license
Price: $30 / active committer / month for Code Security. Confirm the live add-on tile on github.com/pricing. Changelog: 1 April 2025.
Ask before you sign
Write “GitHub Code Security,” not “GHAS,” on the PO. Secret Protection does not include CodeQL.
SonarQube Cloud
SonarQube Cloud is Sonar’s hosted static analysis, with SAST listed on the Team plan next to quality gates, taint analysis, secrets, and IaC scanning. The pricing FAQ prints Team at $34 monthly for analysis of up to 100k lines of code, a free tier up to 50k private LOC, and Enterprise as custom annual. First-party SonarQube Cloud plans.
Only private-project LOC counts, and Sonar uses the largest branch of each project, not how often you scan. SCA, malicious-package detection, and Advanced SAST sit in the Advanced Security add-on, which is custom-priced. If you want self-hosted analysis, SonarQube Server is a separate per-instance, per-year LOC product. This row is the Cloud SKU.
Best for: Teams that already think in quality gates and want SAST billed on private LOC instead of headcount.
What you get:
- SAST, taint analysis, secrets, and IaC on Team
- Team from $34 / month for 100k LOC. Free to 50k private LOC
- Pull-request analysis and 30+ languages on Team (40+ on Enterprise)
Why we like it: The meter is LOC, so a small team with a large repo can see the bill before a sales call.
Limits:
- SCA is not in the $34 Team tile. It is the Advanced Security add-on
- Enterprise reports, SSO, and COBOL / ABAP / Apex sit behind custom annual pricing
Price: Team from $34 / month for 100k LOC. Free to 50k LOC. Enterprise custom. sonarsource.com/plans-and-pricing/sonarcloud.
Wiz SAST
Wiz SAST is the static analysis page in Wiz’s top menu. The product combines rule-based and agentic SAST, then validates findings with cloud, identity, and runtime context on the Wiz Security Graph. Google completed the Wiz acquisition on 11 March 2026. Wiz kept the brand and remains the name on the SKU. There is no public list rate on the SAST page.
First-party language is reachable and exploitable risk, not a raw finding count. IDE scanning is named for Lovable, JetBrains, and VS Code, with remediation agents opening pull requests for supported findings. Coverage includes OWASP Top 10 for LLM and agentic applications. If you do not already run Wiz Cloud or Wiz Code, this is a platform conversation, not a $30 checkout.
Best for: Cloud security teams that already run Wiz and want first-party code findings on the same graph.
What you get:
- Rule-based plus agentic SAST with cloud and runtime context
- IDE scanning in Lovable, JetBrains, and VS Code
- Quote-only. No public SAST list rate
Why we like it: It is the only row that first-party-ties a SAST finding to an attack path in the cloud you already mapped.
Limits:
- No public dollar. You cannot start from a printed contributor rate
- The value depends on Wiz context. It is a weak first SAST if you have no Wiz graph
- The SAST page support bar names GitHub, GitLab, Bitbucket, Azure DevOps and Python, JavaScript, C#, Java, Go, and PHP. Confirm anything else before you assume 35-language coverage
Price: Quote-only on wiz.io/solutions/sast.
Ask before you sign
Ask whether SAST is in the Wiz Code SKU you already own or an add-on, and which languages the remediation agent will open a pull request for.
Checkmarx One
Checkmarx One sells SAST as the required engine on every bundle. The pricing builder labels SAST required and everything else (secrets, IaC, SCA, DAST, agents) as add-ons. The quote is custom and, on the same page, based on developers, apps, and usage. There is no public per-contributor dollar.
The license page dated 16 March 2026 defines a contributing developer as any contributor who committed to a private repository scanned in the last 90 days. A contributor is an AI agent, a bot, or an individual. The same page sets an account usage limit of 15 million lines of code scanned in the last 90 days, multiplied by the contributing-developer licenses you bought. Fusion, the multi-model add-on, is usage-based credits, not the core SAST license.
Best for: AppSec programs that need SAST as the foundation of a Checkmarx One bundle and can live with a sales quote.
What you get:
- SAST required on every Checkmarx One bundle
- Custom quote on developers, apps, and usage
- 90-day contributing developer, including bots and AI agents, plus a 15 million LOC / license usage cap
Why we like it: The builder is honest that SAST is the foundation, and the legal page prints how bots and agents count.
Limits:
- No public list rate
- Secrets, SCA, DAST, and Assist agents are add-ons. The first tile is not the whole program
Price: Custom quote. checkmarx.com/pricing. License math: Checkmarx One license types.
Ask before you sign
Ask how many of last quarter’s Git users were bots or coding agents. Those seats count on this contract.
Veracode Static Analysis
Veracode Static Analysis is Veracode’s SAST product. The page offers a build-free source scan for immediate feedback, plus source, binary, and hybrid scanning when third-party or proprietary code has no source. There is no public list rate. Contact sales is the path.
First-party language is an adaptable scanning service: IDE, CI/CD, CLI, CWE-aligned findings, and full-program analysis the page says can take applications up to 5 GB. The product page claims 100+ languages and frameworks and cites The Forrester Wave for SAST. Community threads about application profiles and static components are not a rate card. Do not treat them as a price.
Best for: Portfolios that still ship binaries, vendor libraries without source, or a mix of both, and need one SAST vendor for that mix.
What you get:
- Source, binary, and hybrid SAST
- IDE, pipeline, and CLI entry points
- Quote-only. No public list rate
Why we like it: It is the only row whose first-party page still treats a missing source tree as a normal scan, not an edge case.
Limits:
- No public dollar, so you cannot compare a contributor rate before the demo
- License math (application profiles, components) is CSM-only. Get it in writing
Price: Quote-only on veracode.com/products/binary-static-analysis-sast.
Ask before you sign
Ask whether the quote is source-only, binary, or hybrid, and how many application profiles that license includes.
If the next job is a running app rather than source, start with our DAST list. If you already have three scanners and need one queue, use ASPM.
Where the scan sits, and whether the meter is public
This grid plots two questions. Across is how you pay: a public contributor or LOC rate on the left, a sales quote on the right. Up is where the scan is supposed to land: the IDE or pull request at the top, a platform or audit workflow at the bottom.
Cloud-graph SAST, no list rate
Bundle or binary scan, sales quote
Placement is from first-party SKU language: a printed contributor or LOC rate versus contact-sales, and whether the page names an IDE or pull-request scan. Placement is a SKU map, not a ranking.
How the meter bills, side by side
| Tool | Meter | What to write on the PO |
|---|---|---|
| Semgrep Code | 90-day private-repo contributor | Code SKU. Teams is $30 / contributor / month |
| Snyk Code | 90-day contributing developer on private repos | Snyk Code on Team, Ignite, or Enterprise. Not Open Source alone |
| GitHub Code Security | 90-day active committer | Code Security at $30 / committer / month. Not Secret Protection |
| SonarQube Cloud | Private LOC, largest branch | Team LOC band starting at $34 / month for 100k |
| Wiz SAST | Quote-only | Wiz SAST / Wiz Code, not only Wiz Cloud |
| Checkmarx One | 90-day contributing developer (person, bot, or AI agent), plus apps and usage | Checkmarx One with SAST required. List add-on engines separately |
| Veracode Static Analysis | Quote-only (application profiles are CSM-only) | Static Analysis, and whether the scan is source, binary, or hybrid |
What we left out
These are real products. Each one failed a named check, not a popularity contest.
- GitLab Advanced SAST is living inside GitLab Ultimate, with Duo remediation on later releases. Someone already on Ultimate should use it. It failed the SAST-first check: you buy the DevOps suite, not a SAST SKU with a public SAST meter.
- OpenText Fortify SAST 26.3 is a living July 2026 engine (the old Fortify Static Code Analyzer). Teams that already run Fortify on Demand should stay. It failed the public-meter check, and the 2026 rename splits the PO across OpenText SAST, Core Application Security, and Fortify on Demand.
- Black Duck Coverity 2026.6.0 is living, with a July 2026 release and a first-party story on C/C++ and functional-safety standards. That is the right buy for MISRA or ISO 26262 work. It failed the job check for this page: safety-critical and embedded analysis, not the web and cloud SAST shortlist.
Questions before you sign a SAST
If a quote cannot answer these three, you are still buying the wrong SKU.
- Which languages on our default branch are on the first-party list, and which are “contact us”?
- Is the meter 90-day contributors, private LOC, or applications, and do bots or coding agents count?
- Does a finding open in the IDE or the pull request, or only in a weekly export?
Which SAST tool should you pick
If you want a printed contributor or LOC rate and a comment in the pull request, start with Semgrep Code, Snyk Code, GitHub Code Security, or SonarQube Cloud. If you already run Wiz, open the SAST page on that graph before you add a second platform. If the estate still ships binaries or needs a committee audit pack, the quote is Veracode Static Analysis or Checkmarx One. Write the SKU, the meter, and the languages on the PO. The logo on the slide is not the purchase.
Frequently asked questions
Is SAST the same as SCA?
No. SAST reads first-party source or a binary. SCA reads the libraries you imported. Semgrep, Snyk, Checkmarx, and Sonar sell both, on separate lines. A quote that only lists open-source vulnerabilities is not a SAST buy. OWASP keeps those jobs on different pages for that reason.
Do I need GitHub Enterprise to buy CodeQL?
No. GitHub’s docs say Code Security and Secret Protection need GitHub Team or Enterprise. Public repositories still get code scanning at no committer charge. Private and internal repos are the $30 Code Security add-on. You also still pay for the Team or Enterprise plan under it.
Why are Wiz, Checkmarx, and Veracode quote-only?
Those pages sell a platform or a hybrid scan, not a self-serve contributor tile. Wiz prices SAST with the rest of the graph. Checkmarx prices developers, apps, and usage, and counts bots. Veracode prices application scope and source versus binary. That is a sales quote. It is not a missing price. Confirm the SKU in writing.
