Contrast expands SAST coverage to 30 new languages

Contrast Security now supports Static Application Security Testing (SAST) coverage for 30 languages and frameworks, enabling code scanning for modern development pipelines with industry-leading speed and accuracy. 

Why does this matter? 

SAST is a critical part of any DevSecOps program. But for too long, businesses have been stuck with clunky, outdated SAST tools that are slow and inaccurate. These tools produce thousands of false positives, which can overwhelm developers and lead to missed vulnerabilities. It can take hours or even days to scan an application, which can slow down the development process. Many SAST tools are incomplete and can't find all of the vulnerabilities in your code, leaving your organization vulnerable to attack. Implementing a SAST tool with incomplete language coverage can lead to higher development costs, incomplete vulnerability detection and reputational damage. 

Contrast’s SAST solution now provides coverage for a more robust range of programming languages and frameworks. This allows organizations to cover their code bases, accurately detect vulnerabilities and confidently deploy in pipelines with fast and accurate scanning. Development teams will have coverage for frameworks and languages such as C, C++, Swift, Advanced Business Application Programming (ABAP), GO, COBOL and many more. Support for additional programming languages enables organizations to identify and remediate security vulnerabilities at the right time and place in the Software Development Life Cycle (SDLC) and comply with industry standards and regulations.

Organizations can now add SAST into their Application Security (AppSec) programs to complement existing Interactive Application Security Testing (IAST) instrumentation. 

Contrast’s SAST solution complements IAST for complete secure application life-cycle management by: 

• Analyzing the legacy apps that can be a critical part of an organization's application portfolio 
• Analyzing client-side apps that currently can’t be instrumented
• Shifting smart to analyze code earlier in the SDLC, before the application is instrumented 
• Meeting compliance requirements

By integrating Contrast’s SAST solution with existing IAST instrumentations, organizations can gain even more comprehensive security coverage. 

After all, IAST tools may not catch all vulnerabilities found in application code, while SAST tools may not catch all vulnerabilities that can be found during runtime. But combining both tools can provide a complete picture of an application’s security posture.  

Click here for a Live Demo on Contrast Scan’s new programming languages and frameworks. 

Read more:

• Product page: Contrast Scan
• Contrast Scan Data Sheet: Pipeline-Native Static Application Security Testing 
• White Paper: Modern Application Security Scanning
• Blog: SAST, DAST, and IAST Security Testing