Best DevSecOps Tools in China - Page 3
View:
Compare the Top DevSecOps Tools in China as of August 2026 - Page 3
Sort By:
-
1
OWASP ZAP
OWASP
OWASP ZAP (Zed Attack Proxy) is a free, open-source penetration testing tool being maintained under the umbrella of the Open Web Application Security Project (OWASP). ZAP is designed specifically for testing web applications and is both flexible and extensible. At its core, ZAP is what is known as a “man-in-the-middle proxy.” It stands between the tester’s browser and the web application so that it can intercept and inspect messages sent between browser and web application, modify the contents if needed, and then forward those packets on to the destination. It can be used as a stand-alone application, and as a daemon process. ZAP provides functionality for a range of skill levels – from developers, to testers new to security testing, to security testing specialists. ZAP has versions for each major OS and Docker, so you are not tied to a single OS. Additional functionality is freely available from a variety of add-ons in the ZAP Marketplace, accessible from within the ZAP client. -
2
Wiz
Wiz
Wiz is a new approach to cloud security that finds the most critical risks and infiltration vectors with complete coverage across the full stack of multi-cloud environments. Find all lateral movement risks such as private keys used to access both development and production environments. Scan for vulnerable and unpatched operating systems, installed software, and code libraries in your workloads prioritized by risk. Get a complete and up-to-date inventory of all services and software in your cloud environments including the version and package. Identify all keys located on your workloads cross referenced with the privileges they have in your cloud environment. See which resources are publicly exposed to the internet based on a full analysis of your cloud network, even those behind multiple hops. Assess the configuration of cloud infrastructure, Kubernetes, and VM operating systems against your baselines and industry best practices. -
3
Oxeye
Oxeye
Oxeye is designed to expose vulnerable flows in distributed cloud native application code. We incorporate next-generation SAST, DAST, IAST, and SCA capabilities to ensure verification of risks in both Dev and Runtime environments. Built for developers and AppSec teams, Oxeye helps to shift-left security while accelerating development cycles, reducing friction, and eliminating vulnerabilities. We deliver reliable results with high accuracy. Oxeye analyzes code vulnerabilities across microservices delivering contextualized risk assessment enriched with infrastructure configuration data. With Oxeye developers can easily track and resolve vulnerabilities. We deliver the vulnerability visibility flow, steps to reproduce, and the exact line of code. Oxeye offers a seamless integration as Daemonset with a single deployment that doesn’t require performing changes in the code. We deliver frictionless security to your cloud-native apps. -
4
Anitian FedRAMP Comprehensive
Anitian
Anitian’s FedRAMP Comprehensive solution combines best-of-breed web security technologies, compliant-by-design integrations, and guidance from FedRAMP experts to help SaaS providers Navigate, Accelerate, and Automate their FedRAMP program. Rely on Anitian’s proven expertise to guide you through every step of the FedRAMP process. Obtain FedRAMP authorization in half the time and at half the cost using Anitian’s unique combination of automation and in-person assistance. Use Anitian’s pre-built security stack and automation tools to eliminate much of the manual, complex work typically required for FedRAMP authorization. Depend on Anitian’s compliance team to keep both your internal and external stakeholders fully appraised of project status, required actions and critical path dependencies. -
5
CrowdStrike Container Security
CrowdStrike
Protect cloud-native applications and reduce the attack surface by detecting vulnerabilities, hidden malware, secrets/keys, compliance violations and more — from build to runtime — ensuring only compliant containers run in production.Integrate frictionless security early into the continuous integration/continuous delivery (CI/CD) pipeline, and automate protection that empowers DevSecOps to deliver production-ready applications without impacting build cycles.Build and run applications knowing they are protected. Get access to automated discovery, runtime protection, continuous threat detection and response for cloud workloads and containers, and managed cloud threat hunting in a single platform. Find hidden malware, embedded secrets, configuration issues and more in your images to help reduce the attack surface. -
6
Waratek
Waratek
Integrate seamless security into the software delivery lifecycle to improve efficiency and agility. Ensure security policies are flexible, human readable, and not impacted by technical debt. Deploy applications securely across on-premises, hybrid, or cloud infrastructures. Automate systems' adherence to desired security behavior to minimize delays & fire drills. Execute the security of your apps in the runtime with a performance impact of less than 3% in production. We see agent-less solutions as a major disadvantage for highly regulated organizations that have tight security requirements. This is why Waratek leverages an agent to ensure its autonomous behavior that can secure unknown threats for themselves unlike agent-less models. Virtually upgrade apps and dependencies like Log4j without code changes, vendor patches, or downtime. -
7
GaraSign
Garantir
There are many excellent enterprise security tools to choose from. Some are managed on-premise, others are consumed as a service, and others still use a hybrid model. The challenge enterprises face is not a lack of tools or solutions, but rather a lack of seamless interconnectivity between these privileged access management tools and a single place to manage and audit them. GaraSign is a platform that allows enterprises to securely and efficiently integrate their security systems in a way that does not disrupt existing business processes. By factoring out what’s common, GaraSign is able to centralize and simplify the management of your enterprise’s most sensitive areas, including privileged access management (PAM), privileged identity management, secure software development, code signing, data security, PKI & HSM solutions, DevSecOps, and more. Enterprise security leaders must attend to data security, privileged access management (PAM), privileged identity management, etc. -
8
ArmorCode
ArmorCode
Centralize all AppSec findings (SAST, DAST, SCA, etc) and correlate with infrastructure and cloud security vulnerabilities to get a 360o view of you application security posture. Normalize, de-dup and correlate findings to improve risk mitigation efficiency and prioritize the findings that impact the business. A single source of truth for findings and remediations from across tools, teams and applications. AppSecOps is the process of identifying, prioritizing, remediating and preventing Security breaches, vulnerabilities and risks - fully integrated with existing DevSecOps workflows, teams and tools An AppSecOps platform enables security teams to scale their ability to successfully identify, remediate and prevent high-priority application level security, vulnerability, and compliance issues, as well as identify and eliminate coverage gaps. -
9
Maverix
Maverix
Maverix blends itself into the existing DevOps process, brings all required integrations with software engineering and application security tools, and manages the application security testing process end to end. AI-based automation for security issues management including detection, grouping, prioritization, filtration, synchronization, control of fixes, and support of mitigation rules. Best-in-class DevSecOps data warehouse for full visibility into application security improvements over time and team efficiency. Security issues can be easily tracked, triaged, and prioritized – all from a single user interface for the security team, with integrations to third-party products. Gain full visibility into application production readiness and application security improvements over time. -
10
OpenContext
OpenContext
OpenContext eliminates drift and provides the insight DevOps folks need to reduce toil. OpenContext unites all aspects of the socio-technical stack, connecting your code to artifacts in the cloud into a graph-based view. Our always-growing integration ecosystem tells the whole story of your tech stack. OpenContext discovers your socio-technical graph in real time, tracking the data lineage and best practices that ensure your team is audit-ready. We’ll show you exactly who has the relevant knowledge to address the problem, finding your fixer without all the extra effort. That means fewer interruptions, fewer contributors pulled off their regular work, and a much better use of your time and money. OpenContext auto-discovers your technical stack. You can’t afford to let those liabilities stay hidden. It leads to a real scramble to find the key people, your fixers, who know exactly how everything is put together. -
11
Operant
Operant AI
Operant AI shields every layer of modern applications, from Infra to APIs. Within minutes of a single-step deployment, Operant provides full-stack security visibility and runtime controls, blocking a wide range of common and critical attacks including data exfiltration, data poisoning, zero day vulns, lateral movement, cryptomining, prompt injection, and more. All with zero instrumentation, zero drift, and zero friction between Dev, Sec, and Ops. Operant's in-line runtime protection of all data-in-use, across every interaction from infra to APIs, brings a new level of defense to your cloud-native apps with zero instrumentation, zero application code changes and zero integrations. -
12
Symbiotic Security
Symbiotic Security
Symbiotic Security puts code security in your flow, not in your way, with AI-powered, developer-centric solutions. By embedding real-time vulnerability detection, contextual remediation, and just-in-time training directly into the IDE teams accelerate development cycles and increase code security - no matter where the code comes from. Its continuous learning loop, where developers train the AI and the AI coaches developers, drives smarter, faster, and more secure development at scale. With Symbiotic, enterprises don’t just reduce security risk, they eliminate security debt and empower their teams to grow into security-savvy engineers. -
13
Olympix
Olympix
Olympix is a pioneering DevSecOps tool that empowers developers to proactively secure their Web3 code from the outset. By integrating seamlessly into existing workflows, it continuously scans for vulnerabilities as developers write code, offering one-click quick-fix security suggestions to mitigate risks and enhance productivity. Olympix has built a first-of-its-kind security intelligence database by analyzing the entire blockchain since its inception, enabling it to uncover and prioritize smart contract vulnerabilities in real time. This proactive approach allows developers to implement best practices from the beginning, fostering a security-first mindset throughout the development process. By owning security from the start, developers become the first line of defense, avoiding costly smart contract rewrites and enabling faster safer deployment. Olympix's intuitive design ensures that focusing on security becomes an integral part of coding. -
14
Threat Stack
Threat Stack
Threat Stack is the leader in cloud security & compliance for infrastructure and applications, helping companies securely leverage the business benefits of the cloud with proactive risk identification and real-time threat detection across cloud workloads. The Threat Stack Cloud Security Platform® delivers full stack security observability across the cloud management console, host, container, orchestration, managed containers, and serverless layers. Threat Stack provides the flexibility to consume telemetry within existing security workflows — or manages it with you through the Threat Stack Cloud SecOps ProgramSM so you can respond to security incidents and improve your organization’s cloud security posture over time.Starting Price: $9.00/month -
15
Qualys TruRisk Platform
Qualys
Qualys TruRisk Platform (formerly Qualys Cloud Platform). The revolutionary architecture that powers Qualys’ IT, security, and compliance cloud apps. Qualys TruRisk Platform gives you a continuous, always-on assessment of your global IT, security, and compliance posture, with 2-second visibility across all your IT assets, wherever they reside. And with automated, built-in threat prioritization, patching and other response capabilities, it’s a complete, end-to-end security solution. On premises, at endpoints, on mobile, in containers or in the cloud, Qualys TruRisk Platform sensors are always on, giving you continuous 2-second visibility of all your IT assets. Remotely deployable, centrally managed and self-updating, the sensors come as physical or virtual appliances, or lightweight agents. Qualys TruRisk Platform provides an end-to-end solution, allowing you to avoid the cost and complexities that come with managing multiple security vendors.Starting Price: $500.00/month -
16
Tripwire
Fortra
Cybersecurity for Enterprise and Industrial Organizations. Protect against cyberattacks with the industry’s best foundational security controls. Detect threats, identify vulnerabilities and harden configurations in real time with Tripwire. Thousands of organizations trust Tripwire Enterprise to serve as the core of their cybersecurity programs. Join them and regain complete control over your IT environment with sophisticated FIM and SCM. Shortens the time it takes to catch and limit damage from threats, anomalies, and suspicious changes. Gives you deep, unparalleled visibility into your security system state and know your security posture at all times. Closes the gap between IT and security by integrating with both teams' existing toolsets. Out-of-the-box platforms and policies enforce regulatory compliance standards. -
17
Trend Micro Deep Security
Trend Micro
Get streamlined with a complete set of workload security capabilities and protect your cloud-native applications, platforms, and data in any environment with a single agent. Thanks to our strong API integration with Azure and AWS, Deep Security works seamlessly in the cloud. Protect your sensitive enterprise workloads without the need to set up and maintain your own security infrastructure. Accelerate and maintain compliance for your hybrid and multi-cloud environments. Although AWS and Azure have many compliance certifications, you are still responsible for securing the workloads you put in the cloud. Secure servers across the data center and cloud with a single security product. Remove the need to worry about product updates, hosting, or database management. Quick Start AWS CloudFormation templates available for NIST and AWS Marketplace. Host-based security controls that can be deployed automatically, even while auto-scaling. -
18
Checkmarx
Checkmarx
The Checkmarx Software Security Platform provides a centralized foundation for operating your suite of software security solutions for Static Application Security Testing (SAST), Interactive Application Security Testing (IAST), Software Composition Analysis (SCA), and application security training and skills development. Built to address every organization’s needs, the Checkmarx Software Security Platform provides the full scope of options: including private cloud and on-premises solutions. Allowing a range of implementation options ensures customers can start securing their code immediately, rather than going through long processes of adapting their infrastructure to a single implementation method. The Checkmarx Software Security Platform transforms the standard for secure application development, providing one powerful resource with industry-leading capabilities. -
19
Contrast Assess
Contrast Security
A new kind of security designed for the way software is created. Resolve security issues minutes after installation by integrating security into your toolchain. Because Contrast agents monitor code and report from inside the application, developers can finally find and fix vulnerabilities without requiring security experts. That frees up security teams to focus on providing governance. Contrast Assess deploys an intelligent agent that instruments the application with smart sensors. The code is analyzed in real time from within the application. Instrumentation minimizes the false positives that slow down developers and security teams. Resolve security issues minutes after installation by integrating security into your toolchain. Contrast Assess integrates seamlessly into the software life cycle and into the tool sets that development and operations teams are already using, including native integration with ChatOps, ticketing systems and CI/CD tools, and a RESTful API. -
20
CodeSonar
CodeSecure
CodeSonar employs a unified dataflow and symbolic execution analysis that examines the computation of the complete application. By not relying on pattern matching or similar approximations, CodeSonar's static analysis engine is extraordinarily deep, finding 3-5 times more defects on average than other static analysis tools. Unlike many software development tools, such as testing tools, compilers, configuration management, etc., SAST tools can be integrated into a team's development process at any time with ease. SAST technologies like CodeSonar simply attach to your existing build environments to add analysis information to your verification process. Like a compiler, CodeSonar does a build of your code using your existing build environment, but instead of creating object code, CodeSonar creates an abstract model of your entire program. From the derived model, CodeSonar’s symbolic execution engine explores program paths, reasoning about program variables and how they relate. -
21
BoostSecurity
BoostSecurity
BoostSecurity® enables early detection and remediation of security vulnerabilities at DevOps velocity while ensuring the continuous integrity of the software supply chain at every step from keyboard to production. Get visibility into the security vulnerabilities in code, cloud and CI/CD pipeline misconfigurations in your software supply chain in minutes. Fix security vulnerabilities in code, cloud and CI/CD pipeline misconfigurations as you code, in pull requests, before they sneak into production. Create & govern policies consistently and continuously across code, cloud and CI/CD organizationally to prevent classes of vulnerabilities from re-occurring. Consolidate tool and dashboard sprawl through a single control plane for trusted visibility into the risks of your software supply chain. Build and amplify trust between developers & security for scalable DevSecOps through high fidelity, zero friction SaaS automation. -
22
Veracode
Veracode
Veracode offers a holistic, scalable way to manage security risk across your entire application portfolio. We are the only solution that can provide visibility into application status across all testing types, including SAST, DAST, SCA, and manual penetration testing, in one centralized view. -
23
CyberArk Conjur
CyberArk
A seamless open source interface to securely authenticate, control and audit non-human access across tools, applications, containers and cloud environments via robust secrets management. Secrets grant access to applications, tools, critical infrastructure and other sensitive data. Conjur secures this access by tightly controlling secrets with granular Role-Based Access Control (RBAC). When an application requests access to a resource, Conjur authenticates the application, performs an authorization check against the security policy and then securely distributes the secret. Security policy as code is the foundation of Conjur. Security rules are written in .yml files, checked into source control, and loaded onto the Conjur server. Security policy is treated like any other source control asset, adding transparency and collaboration to the organization’s security requirements.