Best IT Security Software for GitHub - Page 6
View:
Compare the Top IT Security Software that integrates with GitHub as of November 2025 - Page 6
Sort By:
This a list of IT Security software that integrates with GitHub. Use the filters on the left to add additional filters for products that have integrations with GitHub. View the products that work with GitHub in the table below.
-
1
TruffleHog
Truffle Security
TruffleHog runs behind the scenes to scan your environment for secrets like private keys and credentials, so you can protect your data before a breach occurs. Secrets can be found anywhere, so TruffleHog scans more than just code repositories, including SaaS and internally hosted software. With support for custom integrations and new integrations added all the time, you can secure your secrets across your entire environment. TruffleHog is developed by a team entirely comprised of career security experts. Security is our passion and primary concern, and all features are developed with best practices in mind. TruffleHog enables you to track and manage secrets within our intuitive management interface, including links to exactly where secrets have been found. Authenticate with secure OAuth workflows for users and never worry about username and password breaches. -
2
Access Auditor
Security Compliance Corp
Access Auditor automates user entitlement reviews and user access reviews. Access Auditor also alerts on changes in user access rights, and watches for separation of duties violations, and shows who has access to what. Users can be imported from any AD/LDAP, Database, or any REST API. Enterprise roles (RBAC) can be modeled and defined, allowing full RBAC reviews and provisioning. Access Manager leverages the same ease-of-use to automate the provisioning and management of user access rights. Any system with a database, LDAP, or REST API can be automatically managed via role based access controls. SCC’s powerful and simple approach to Identity Management enables a very rapid success at a low overall cost. With a 100% customer success rate, Access Auditor is the fastest and simplest solution available and can automate your user access reviews in under a week. -
3
Legit Security
Legit Security
Legit Security protects software supply chains from attack by automatically discovering and securing the pipelines, infrastructure, code and people so that businesses can stay safe while releasing software fast. Automatically discover security issues, remediate threats and ensure the integrity and compliance of software releases. Comprehensive, visual SDLC inventory that's continually updated. Reveal unknown, misconfigured and vulnerable SDLC systems and infrastructure. Centralized visibility over location, coverage and configuration of your existing security tools and scanners. Catch insecure build actions before they can embed vulnerabilities downstream. Centralized, early prevention of sensitive data leaks, secrets and PII, before being pushed into the SDLC. Track security trends across teams and product lines to improve security posture and incentivize behavior. Get security posture at-a-glance with Legit Security Scores, Integrate your own alert and ticketing tools or use ours. -
4
Asgardeo
WSO2
Asgardeo helps developers implement secure authentication flows to applications in a few simple steps. Easily integrate single page, regular web, and mobile applications. SDKs that enable working with various technology stacks. Enable social sign-in with Google, Facebook, and GitHub using pre-defined templates (with more to follow). Configure external identity providers that can connect with open standards like OpenID Connect and SAML to your application. Manage your customers, employees, and partners with (default) supported onboarding and management workflows. Use Asgardeo provided directory or plug in your own LDAP or Active Directory via an agent. Choose from a variety of methods such as Email OTP, SMS OTP, and TOTP for 2FA. Define multiple steps and configure options according to user requirements. Unlock the full application experience by focusing on the business logic and enable login and secure access to end-users. -
5
oak9
oak9
Visualize your IaC architecture and fix security design gaps before deployment. oak9 easily identifies security design gaps by reading Infrastructure as Code (e.g., Terraform) to understand what should be, then monitors for drift and offers actionable advice to quickly remediate. Build security into your application and avoid costly design gaps. Automatically catch and fix design gaps before deployment. Continuously and dynamically monitor infrastructure as code. oak9 lets you tailor security standards to your needs and intelligently learns the more you build, so you aren’t slowed by hundreds of false positives or non-relevant exceptions. You can focus on the functional capabilities of your application while oak9 assesses every change to your application architecture against your customized security blueprint to notify you in real-time of any risks. Seamlessly integrate into your CI/CD pipeline with real-time notifications and integrations with all the tools you already use. -
6
Sprinto
Sprinto
Replace the slow, laborious and error-prone way of obtaining SOC 2, ISO 27001, HIPAA, GDPR & PCI DSS compliance with a swift, hassle-free, and tech-enabled experience. Unlike generic compliance programs, Sprinto is specifically designed for cloud-hosted companies. SOC 2, ISO 27001, HIPAA, GDPR & PCI DSS have different implications for different types of companies. This is why generic compliance programs end up giving you more compliance debt and less security. Sprinto is specifically built to suit your needs as a cloud-hosted company. Sprinto is more than just a SaaS tool, it comes baked in with security and compliance expertise. Compliance experts handhold you in live sessions. Custom designed for your needs. No compliance cruft. 14 session, well-structured implementation program. Sense of clarity & control for the head of engineering. 100% compliance coverage. No evidence is shared outside Sprinto. Compliance automation for policies, integrations and all other requirements. -
7
Phylum
Phylum
Phylum defends applications at the perimeter of the open-source ecosystem and the tools used to build software. Its automated analysis engine scans third-party code as soon as it’s published into the open-source ecosystem to vet software packages, identify risks, inform users and block attacks. Think of Phylum like a firewall for open-source code. Phylum’s database of open-source software supply chain risks is the most comprehensive and scalable offering available, and can be deployed throughout the development lifecycle depending on an organization’s infrastructure and appsec program maturity: in front of artifact repository managers, directly with package managers or in CI/CD pipelines. The Phylum policy library allows users to toggle on the blocking of critical vulnerabilities, attacks like typosquats, obfuscated code and dependency confusion, copyleft licenses, and more. Users can also leverage OPA to create custom policies. -
8
securityprogram.io
Jemurai
Excellent security for small companies. Easily build a standard and audit-ready cybersecurity program. We want to make excellent security accessible to smaller organizations, and help them build legitimate security programs so they can win deals. Perfect for startups, you're already sprinting. Leverage a tool and a team that can keep pace with you. Document templates and built-in training allow you to make pragmatic improvements that improve security and demonstrate alignment to standards that customers trust. Your security program begins with reviewing and adopting security policies. We built the simplest possible policies that adhere to NIST 800-53 standards. We mapped the standards so that you'll know you're covered. We cross-reference our program activities to other standards including SOC 2, ISO 27001, NIST CSF, CIS 20, and CMMC to make sure you get credit for the work you do with customers and your management team.Starting Price: $99 one-time payment -
9
Prancer
Prancer
Large-scale cyber assaults occur regularly, and most security systems are reactive to eliminate intrusions. Prancer’s patented attack automation solution aggressively validates your zero-trust cloud security measures against real-world critical attacks to harden your cloud ecosystem continuously. It automates the discovery of cloud APIs across an organization. It offers automated cloud pentesting, enabling businesses to quickly identify potential security risks and vulnerabilities related to their APIs and minimize false positives with correlated risk scoring. Prancer auto-discovers enterprise resources in the cloud and find out all the attack surfaces at the Infrastructure and Application layers. Prancer engine reviews the security configuration of the resources and correlates data from different sources. It immediately reports back all the security misconfigurations and provides auto-remediation. -
10
Trustle
Trustle
Conventional cloud data security applications don’t scale. But with Trustle, you can automatically grant and rescind access to multiple data sources on a user-by-user basis while offering a holistic overview of all your connected systems—all from an easy-to-use SaaS product. Trustle allows every employee access where and when it’s needed, only for as long as it’s needed. Positive team dynamics are a crucial component of every employer's value proposition. Strengthen your employer brand while building strong team cohesion business-wide. Developers, citizen developers, teams and organizations will experience a significant change in their daily lives. Trustle is a unique SaaS offering, allowing you to start managing access-at-risk within minutes, while providing new structure to your business’s holistic data strategy within days.Starting Price: $10 per user per month -
11
Veza
Veza
Data is being reconstructed for the cloud. Identity has taken a new definition beyond just humans, extending to service accounts and principals. Authorization is the truest form of identity. The multi-cloud world requires a novel, dynamic approach to secure enterprise data. Only Veza can give you a comprehensive view of authorization across your identity-to-data relationships. Veza is a cloud-native, agentless platform, and introduces no risk to your data or its availability. We make it easy for you to manage authorization across your entire cloud ecosystem so you can empower your users to share data securely. Veza supports the most common critical systems from day one — unstructured data systems, structured data systems, data lakes, cloud IAM, and apps — and makes it possible for you to bring your own custom apps by leveraging Veza’s Open Authorization API. -
12
Infisical
Infisical
Compare secrets across environments and see what's different or missing. Set personal values for secrets – either during local development or for sensitive secrets. Easily inherit other secrets to establish a single source of truth. Automatically identify and prevent secret leaks to git using Infisical's continuous monitoring and pre-commit checks – support over 140 secret types.Starting Price: $6 per month -
13
Rootly
Rootly
Rootly is an AI-native incident management platform built to help modern teams prevent and resolve incidents faster. It streamlines on-call scheduling, incident response, retrospectives, and status updates through intelligent automation and deep integrations with Slack, Teams, Jira, and Zoom. Powered by Rootly AI, the system automates root cause analysis, provides suggested fixes, and compiles incident data into clear summaries for faster recovery. Teams can manage incidents directly within their communication tools, reducing context switching and human error. With automated retrospectives and actionable insights, Rootly enables continuous improvement and reliability across engineering organizations. Trusted by global brands like Figma, Canva, Nvidia, and Webflow, it helps companies maintain uptime, minimize disruption, and create a culture of proactive resilience. -
14
Boman.ai
Boman.ai
Boman.ai can be integrated in your CI/CD pipeline with few commands and minimum configuration. No planning or expertise is needed. Boman.ai brings SAST, DAST, SCA, and secret scans all packaged in one integration. It can support multiple development languages. Boman.ai minimizes your application security expenses by utilizing open-source scanners. You don’t need to buy expensive application security tools. Boman.ai is powered by AI/ML that removes false positives and correlates results to help you in prioritization and fixes. The SaaS platform presents a dashboard for all your scan results in one place. Correlate the results and get insights for better application security. Manage vulnerabilities reported by the scanner. The platform helps to prioritize, triage, and remediate vulnerabilities. -
15
Kondukto
Kondukto
The Kondukto platform’s flexible design allows you to create custom workflows for responding to risks quickly and efficiently. Take advantage of more than 25 built-in open-source tools ready to run SAST, DAST, SCA, and Container Image scans within minutes without a need for installation, maintenance, or updates. Protect your corporate memory from changes in employees, scanners, or DevOps tools. All security data, statistics, and activities in one place for you to own. Avoid vendor lock or loss of historical data when you need to change an AppSec tool. Verify fixes automatically to ensure better collaboration and less distraction. Boost efficiency by eliminating redundant conversations between AppSec and development teams.Starting Price: $12,000 per annually -
16
Plurilock AI Cloud DLP
Plurilock Security
Plurilock AI Cloud DLP is a cloud-native yet endpoint-capable data loss prevention (DLP) solution that also provides passwordless SSO and CASB. It is designed specifically for cloud-centric companies relying on an army of SaaS applications to succeed. With Plurilock AI Cloud DLP, companies without the resources to configure and manage (much less pay for) the "default" incumbent DLP solutions can still gain the benefits of full-featured DLP, but at a level of simplicity and cost-effectiveness that makes DLP accessible to companies that don't specialize in IT. Plurilock AI Cloud DLP is part of the Plurilock AI platform, which grows as companies do, with an expansion path to true continuous, real-time authentication and user/entity behavior analytics (UEBA) for real-time biometric identity threat detection and response (ITDR). Plurilock AI is rated top in the industry in customer satisfaction by Info-Tech, based on the feedback of actual customers.Starting Price: $36/user/year -
17
PHP Secure
PHP Secure
PHP Secure is a FREE code scanner that analyzes your PHP code for critical security vulnerabilities. Free online scanner: - Quickly and qualitatively finds web app vulnerabilities - Gives explicit reports and recommendations to fix vulnerabilities - Easy to use and requires no specialized knowledge - Reduces risk, saves budget, and boosts productivity PHP Secure Scanner is suitable for analyzing sites on Php, framework Laravel, and CMS Wordpress, Drupal and Joomla. PHP Secure detects the most common and dangerous types: -SQL injection vulnerabilities -Command Injection -Cross-Site Scripting (XSS) Vulnerabilities -PHP Serialize Injections -Remote Code Executions -Double Escaping -Directory Traversal -Regular Expression Denial of Service (ReDos) -
18
Conviso Platform
Conviso Platform
Gain a complete view of your application security. Increase security maturity in your secure development process, and reduce the risks associated with your products. Application Security Posture Management (ASPM) solutions play a crucial role in the ongoing management of application risks, addressing security issues from the development phase to deployment. Efficiently managing an AppSec program, dealing with a growing number of products, and lacking a comprehensive view of vulnerabilities are typically significant challenges for the development team. We enhance the evolution of maturity by supporting the implementation of AppSec programs, monitoring established and executed actions, KPIs, and much more. We enable security to be incorporated into the early stages of development by defining requirements, processes, and policies and optimizing resources and time invested in additional testing or validations.Starting Price: $20.99 per asset -
19
ScalePad ControlMap
ScalePad
There are thousands of steps between you and your cybersecurity compliance goals. With the right cybersecurity compliance management software, you’ll hit the ground running. Start with customizable, expert-verified templates, and cross-mapping finds the overlap between common standards to get you cruising through compliance tasks. Managing evidence and policies keeps everything at hand. Keep tabs on risks and vendors too, no more spreadsheets and scattered documents, everyone on the team needs to contribute to compliance. In this personalized portal, they can access policies and handle any tasks they need to do.Starting Price: $200 per month -
20
elba
elba
elba is the ultimate experience to secure your team in their daily work. Scan, monitor, and resolve your vulnerabilities at scale. Your company’s security is super-powered by our collaborative approach. Detect all the sensitive data shared externally, and reduce your risks of data loss. Automatically remediate your potential alerts with the power of employees' context. Get a full visibility of all SaaS apps ever used in your company. Clean unused, non-compliant, and risky apps. Reduce phishing risks by 99% and nudge your employees to activate MFA across all SaaS apps. Educate your collaborators from day one with a delightful experience. At every step of your collaborators' journey, elba ensures that your team is aware and trained in your latest internal policy requirements. Security guidelines, GDPR, SOC2, and more, we got you covered. We dramatically reduce phishing risk, with our automated, hyper-customized phishing. Track their improvement as weeks go by and measure their progress. -
21
Q-mast
Quokka
Q-mast is Quokka’s automated mobile application security testing solution built for teams that need deep visibility, operational speed, and strong compliance across both in-house and/or third-party mobile apps. Q-mast performs full-spectrum testing across the mobile software development lifecycle—from design to deployment—covering static, dynamic, and interactive analysis, even in obfuscated or binary-only builds. The solution generates a complete, version-specific software bill of materials (SBOM), including embedded libraries, to surface vulnerable components and dependencies with pinpoint accuracy. Designed to fit into modern pipelines, Q-mast automates mobile app testing within CI/CD workflows like GitHub, GitLab, and Jenkins. -
22
Abstract Security
Abstract Security
Put your team’s focus back on catching attackers and let Abstract handle the heavy lifting of security data management. Our real-time streaming approach gives the breathing room to prioritize their security effectiveness instead. No Noise – Remove unnecessary noise from your data in flight before routing it to your destination No lock-in – With our real-time normalization of data to OCSF format, route to any destination without worrying No Hassle – No need to learn complex query languages with our easy to use ‘no-code-required' model for policy creation. Additionally, let our AI SME help build your policies via natural language requests. No Alert Fatigue – Our AI SME can help summarize insights and prioritize alerts based on MITRE ATT&CK Framework. -
23
Escape
Escape
Discover your API attack surface in minutes, find business logic flaws, and protect your applications against even sophisticated attacks. No agents or infrastructure changes are required. Fastest return on investment. Gain a comprehensive overview of your API security posture within just 15 minutes. Powered by in-depth API security intelligence developed by our in-house research team. Supports all APIs and all environments. Escape offers a unique approach to API security through agentless scanning. You can gain a complete view of all your exposed APIs in minutes, along with their context. Get key data about your APIs, including endpoint URLs, methods, response codes, and metadata, and identify potential security risks, sensitive data exposure, and attack paths. Achieve thorough security coverage with 104+ security tests, including OWASP, business logic, and access control. Integrate Escape seamlessly into your CI/CD systems like Github Actions or Gitlab CI for automated scanning. -
24
Noma
Noma Security
Noma Security is the complete enterprise AI security platform designed to deliver confidence in agentic AI at scale. Noma Security was named a Gartner Cool Vendors in AI Security, 2025 for delivering deep visibility and AI discovery, agentic risk mapping, security posture management, automated AI red teaming, and AI runtime protection all in one platform. With seamless integration to your AI stack and workflows, and alignment with regulatory compliance frameworks, Noma Security helps teams embrace AI innovation while addressing the unique threats posed by rapid enterprise AI adoption. -
25
AgentAuth
Composio
AgentAuth is a specialized authentication platform designed to facilitate secure and seamless access for AI agents to over 250 third-party applications and services. It offers comprehensive support for various authentication protocols, ensuring reliable connections with automatic token refresh. The platform integrates seamlessly with leading agentic frameworks such as LangChain, CrewAI, and LlamaIndex, enhancing the capabilities of AI agents. AgentAuth provides a unified dashboard for complete visibility into user-connected accounts, enabling efficient monitoring and issue resolution. It also offers white-labeling options, allowing customization of the authentication process to align with product branding and OAuth developer applications. Committed to high-security standards, AgentAuth complies with SOC 2 Type II and GDPR, employing strong encryption for data protection.Starting Price: $99 per month -
26
TrustCloud
TrustCloud Corporation
Don’t struggle with 1000s of vulnerability smoke signals from your security tools. Aggregate feeds from your cloud, on-premises, and bespoke apps, and combine them with feeds from your security tools, to continuously measure the control effectiveness and operational status of your entire IT environment. Map control assurance to business impact to assess which gaps to prioritize and remediate. Use AI and API-driven automation to accelerate and simplify first-party, third-party, and nth-party risk assessments. Automate document analysis and receive contextual, reliable information. Run frequent, programmatic risk assessments on all your internal and third-party applications to eradicate the risk of one-time or point-in-time evaluations. Take your risk register from manual spreadsheets to programmatic, predictive risk assessments. Monitor and forecast your risks in real-time, enable IT risk quantification to prove financial impact to the board, and prevent risk instead of managing it. -
27
QuarkLink
Crypto Quantique
QuarkLink is a comprehensive IoT device security platform developed by Crypto Quantique, designed to simplify and accelerate the implementation of security-by-design principles across embedded systems. It provides a Software-as-a-Service (SaaS) solution that integrates seamlessly into existing software development workflows, including CI/CD pipelines, to manage device identities, secure boot processes, over-the-air firmware updates, and key and certificate lifecycle management. QuarkLink supports a wide range of hardware platforms, from microcontrollers running bare metal to industrial PCs operating Linux, and is compatible with major semiconductor manufacturers. QuarkLink's modular architecture allows for independent use of its components, including provisioning and secure boot, OTA updates and service onboarding, and fleet and certificate management. -
28
Pixee
Pixee
Pixee is an AI-powered automated product security engineer that integrates seamlessly into your development workflow, monitoring repositories and pull requests to provide high-quality fixes instantly. It triages scanner alerts from tools like Sonar, Snyk, and Semgrep, delivering code fixes and unlocking the velocity of GenAI-driven development. Pixee operates like a trusted specialist teammate, fitting into your workflow and current tooling without being a distraction, supporting languages such as Java, Python, JavaScript, Node.js, .NET/C#, and Go. It provides expert security context on each finding to filter out false positives, elevate true positives, and recommend actions, freeing your team from endless manual review. Pixee turns findings into actionable pull requests that developers can review and merge, enabling auto-remediation at scale without the grind.Starting Price: $29 per month -
29
OpenBAS
Filigran
OpenBAS is an open source breach and attack simulation (BAS) platform developed by Filigran, designed to help organizations plan, schedule, and conduct cyber adversary simulation campaigns and tests. It enables the creation of dynamic attack scenarios, ensuring accurate, timely, and effective responses during real-world incidents. With over 800 GitHub stars and more than 10 injectors, OpenBAS allows for customizable simulations tailored to various industry needs, evaluating both technical and human aspects of security posture. It integrates threat intelligence from OpenCTI, enabling dynamic customization based on the latest cyber threat insights, used techniques, and relevant adversary behaviors. OpenBAS facilitates team and technology evaluations regarding actual cyber threats and collaborative feedback on scenarios within the platform, enabling detailed analysis for a comprehensive review process. -
30
Zelt
Zelt
Zelt is a comprehensive, all‑in‑one human capital management (HCM) platform designed to manage the full employee lifecycle within a single, unified system. It centralizes employee data and automates workflows across HR, payroll, benefits, time‑off, performance, engagement, device provisioning, app access, and contractor management. With Zelt, teams can centralize onboarding, document storage, custom approval processes, reminders, and regulatory compliance; automate payroll processing, benefits enrolment and reconciliation, and global contractor payments; manage time‑off requests (including holiday, sick, WFH, parental leave) tightly integrated with payroll; oversee IT ops by provisioning and securing apps and devices, spotting inactive access, and remotely managing hardware; and facilitate people development through engagement surveys, performance reviews with anonymity features and automated timelines, and goal‑setting tools aligned to key results.Starting Price: $5 per month
