Published 18 April 2019 – ID G00346593 – 58 min read
DevSecOps, modern web application design and high-profile breaches are expanding the scope of the AST market. Security and risk management leaders will need to meet tighter deadlines and test more complex applications by accelerating efforts to integrate and automate AST in the software life cycle.
By 2022, 10% of coding vulnerabilities identified by static application security testing (SAST) will be remediated automatically with code suggestions applied from automated solutions, up from less than 1% today.
Gartner defines the application security testing (AST) market as the sellers of products and services designed to analyze and test applications for security vulnerabilities.Gartner identifies three main styles of AST:
AST can be delivered as a tool or as a subscription service. Many vendors offer both options to reflect enterprise requirements.The 2019 Magic Quadrant will focus on a vendor’s SAST, DAST and IAST offerings, maturity and features as tools or as a service. Gartner has observed that the major driver in the evolution of the AST market is the need to support enterprise DevOps initiatives. In a DevOps environment, customers require offerings that provide a higher degree of automation, correlation of findings and integration with DevOps pipeline tools. In general, clients desire solutions that focus on high-assurance, high-value findings with fast turnaround times. Buyers expect offerings to fit earlier in the development process with testing often driven by developers rather than security specialists, and tightly integrated as part of the build and release process. As a result, this market evaluation focuses more heavily on the buyer’s needs when it comes to supporting rapid and accurate testing that is capable of being integrated in an increasingly automated fashion throughout the software development life cycle (SDLC).AST vendors innovating, partnering and offering runtime application self-protection (RASP; a technology for allowing applications to protect themselves from vulnerability exploitation at runtime) were weighted more heavily. Those offering software composition analysis (SCA; a technology used to identify open-source and third-party components in use in an application and their known security vulnerabilities) were also weighted more heavily. These solutions help organizations to deliver security throughout the SDLC and to further automate identifying and mitigating risks.Business-critical application security platforms, which incorporate AST for ERP platforms, are not the focus of this Magic Quadrant. Although we weigh coverage of these platforms from broader AST solutions, specific solutions in the business-critical application security space typically focus on a single platform. They go beyond code analysis by incorporating modules such as configuration checks, vulnerability management and intrusion monitoring, which are all out of scope for this research.AST for mobile applications is also not a major focus of this Magic Quadrant. Although Gartner has observed that enterprises today employ AST techniques represented in this research for the mobile app analysis use case, it is not a major driver of client requirements. They often obtain these capabilities from specialized mobile-centric vendors as well as from vendors evaluated in this research. The three styles of AST, as well as techniques for behavioral analysis, are often employed to analyze source, byte or binary or code. In addition, they observe the behavior of mobile apps to identify coding, design, packaging, deployment and runtime conditions that introduce security vulnerabilities.
Figure 1. Magic Quadrant for Application Security Testing
Source: Gartner (April 2019)
Based in the U.S. and France, CAST is a software intelligence vendor that focuses on reliability, efficiency and security. CAST provides enterprise SAST with the CAST Application Intelligence Platform (AIP). CAST also provides a desktop SAST solution, as well as CAST Highlight, which is an offering that provides SAST pattern analysis and SCA. The CAST Security Dashboard enables application security professionals to plan and resolve application security vulnerabilities.During the past 12 months, the vendor acquired Antelink and integrated its SCA capabilities into CAST Highlight. CAST also improved automation by adding the ability to deliver new rules into the CAST platform between releases, without requiring an upgrade from the end user. The vendor also improved data flow capabilities and the analysis engine to improve performance in identifying security violations in very large applications. CAST also made improvements to its dashboard and management functionality.CAST will appeal to large enterprises that require a solution that combines security testing with quality testing, particularly for those that already leverage CAST AIP in the development process.
Based in Israel, Checkmarx has a strong reputation for its SAST solution, has a significant presence in North America and Europe, and also serves the APAC region. Checkmarx provides CxSAST, which is a SAST product with broad language coverage that provides a variety of options to customize it for specific applications (such as by writing custom tests). Checkmarx also provides Checkmarx Open Source Analysis (CxOSA) with its partner, WhiteSource, for SCA. The vendor incorporates its CxCodebashing solution in the offering, which is a developer education platform that delivers short, gamified modules for secure coding training. Checkmarx’s managed service, AppSec Accelerator, offers SAST and DAST services (leveraging third-party DAST tools), an IAST solution called CxIAST, as well as program support to help development organizations integrate AST into their SDLCs.During the past 12 months, the vendor has largely focused on extending the capabilities of the unified management and orchestration layer in the Checkmarx Software Exposure Platform. The vendor added unified policy management, cross-product correlation and intelligent remediation, as well as Kotlin language support. Checkmarx’s products will appeal to application development and security organizations that are seeking a comprehensive set of AST products and services with a strong set of enterprise-class SAST capabilities and program support services.
Based in the U.S. and present in North America, Contrast Security is an AST vendor that also sells in the European and APAC regions. Contrast Security’s IAST (Contrast Assess) incorporates SCA. Contrast also offers RASP with its Contrast Protect product, which can be licensed independently or jointly with Assess. Contrast also offers a central management console, the Contrast TeamServer, which can be delivered as a service or on-premises. The testing approach, known as self-testing or passive IAST, does not require an external scanning component to generate attack patterns to identify vulnerabilities; rather, it is driven by application test activity, such as QA, executed automatically or manually.During the past 12 months, Contrast Security has released new bug-tracking integrations, a new feature to get real-time visibility into testing coverage by showing what code paths were tested, and expanded platform as a service (PaaS) by adding support for Azure Web Service.Contrast is a good fit for organizations pursuing a DevOps methodology and looking for approaches to insert automated, continuous security testing that’s transparent to developers and testers.
Based in the U.S., IBM is a global vendor of IT services and products. In December 2018, HCL announced the acquisition of several IBM products, including the AppScan IBM AST suite. The acquisition is to be completed in 2019. HCL has been solely responsible for development and support for the past two years, and is directly engaged with clients.The AppScan portfolio includes AppScan Source and AppScan Standard for desktop SAST and DAST, respectively. It also provides AppScan Enterprise, which is an AST enterprise platform. IBM also provides AST as SaaS with IBM Security Application Security on Cloud (ASoC). The offerings within the portfolio can be used separately or in combination; for example, they can share scan configurations and settings across offerings. IBM’s IAST technology, called glass box, is included as part of the DAST offerings. IBM also offers Open Source Analyzer (OSA) for SCA, which licenses the vulnerability and remediation database from a partner.During the past 12 months, IBM added action-based crawling (ABC) to facilitate DAST, enabling a browser to interact with the crawled application and execute its components. It also added an AppScan Issue Management Gateway to synchronize ASoC with issue management tools, such as Jira Software from Atlassian. IBM has expanded its API-based automation capabilities for dynamic scanning with AppScan Enterprise, enhanced its IDE and CI plug-ins, and added predefined and custom policies for easier compliance. IBM also added capabilities to leverage Swagger to automate DAST scanning of REST APIs and added SAST language support for Python and Angular.AppScan will appeal to enterprises seeking a single provider of AST technologies with a focus on risk-based management and enterprise-class capabilities.
Based in the U.K., Micro Focus is a global provider of AST products and services under the well-known Fortify brand. Micro Focus sales have a global reach, with a strong presence in North America, as well as the European and APAC markets. Fortify offers Static Code Analyzer (SAST), WebInspect (DAST and IAST), Software Security Center (its console) and Application Defender (monitoring and RASP). Fortify provides its AST as a product, as well as in the cloud, with Fortify on Demand (FoD). Mobile AST is delivered via FoD. Fortify’s SAST can leverage real-time, in-line vulnerability detection via a spell-checker (called Security Assistant) in the Eclipse and Visual Studio IDE. Security Assistant highlights vulnerable code as the developer programs.During the past year, Fortify has come out with Visual Studio support for Security Assistant, expanded its SCA partnerships to include Black Duck, Sonatype and Synk and made turnaround time improvements to FoD DAST. Micro Focus Fortify’s AST offerings should be considered by enterprises looking for a comprehensive set of AST capabilities, either as a product or service, or both combined, with enterprise-class reporting and integration capabilities.
Based in Foster City, California, Qualys is a provider of cloud-based security services, with an emphasis on vulnerability assessment/vulnerability management (VA/VM). It has a strong presence in North America and the APAC region, as well as a presence in the European market. Qualys offers Web Application Scanning (WAS), which is a DAST service that is completely automated and integrates with the other Qualys security services in the Qualys Cloud Platform. Qualys provides WAS at an affordable per-year subscription in different small or midsize business (SMB) and enterprise packages, as well as pay-per-scan licensing.During the past year, Qualys released Version 6 of WAS, which introduced support for testing of Swagger-based REST APIs, added a Jenkins CI plug-in, and made available a Chrome extension to record browser activity for replay in WAS.Qualys is a visible DAST as a cloud service with sizable market share. Organizations looking for a lower-cost, automated DAST service that provides malware scanning or those looking for a DAST capability as an extension to their VA/VM program should consider Qualys.Qualys did not respond to requests for supplemental information, although it did provide final factual review. Therefore, Gartner analysis is based on other credible and accepted public sources.
Based in Boston, Massachusetts, Rapid7 is a provider of security, data, analytics software and IT services. In the AST space, Rapid7 provides DAST as a product and a service. Its offering consists of a desktop web app scanner called AppSpider Pro, an on-premises enterprise DAST tool called AppSpider Enterprise and DAST as a service, under the name InsightAppSec. In addition, Rapid7 provides Managed AppSec services, which offer the same DAST service in a completely outsourced fashion and also includes vulnerability validation services.During the past 12 months, Rapid7 introduced the ability to scan using uploaded Swagger and WSDL files, incremental scanning and validation scanning, which allows users to confirm that a vulnerability remediation was effective. Rapid7 also added an InsightAppSec public API to allow use of the tool without passing through the user interface. Also, Rapid7 introduced a system in the InsightAppSec offering that manages, shares and encrypts authentication session recordings. Rapid7 has built a scan activity feed that shows details of scans in progress, completed or failed, also in the InsightAppSec offering. In October 2018, Rapid7 acquired RASP vendor tCell.In addition to a granular and customizable DAST solution, Rapid7 and its Insight cloud includes DAST (InsightAppSec), vulnerability management (InsightVM), security information and event management (InsightDR), security orchestration automation and response (InsightConnect), and log storing and analytics (InsightOps). This can be a good fit for organizations looking for a SecOps enabler.
Based in Mountain View, California, Synopsys is a global company with offerings in the software and semiconductor areas. Synopsys has been executing a strategy to expand its AST portfolio during the past few years, adding Cigital (App Sec Services), Quotium’s Seeker IAST, Codenomicon (SCA), Protecode (SCA), Coverity (SAST) and Black Duck (SCA). This merger and acquisition (M&A) push has provided it with good coverage of the secure SDLC market, through products and services that it has been attempting to integrate into a complete, seamless offering.During the past 12 months, the vendor has introduced a new platform, Polaris, which is intended to be the central management console for all Synopsys AST products. The SAST solution was the first to be fully integrated into Polaris, and the vendor intends to integrate the rest of the platform throughout 2019. The vendor also introduced a new lightweight IDE plug-in (initially for the IntelliJ IDE with support for Eclipse and Visual Studio IDEs introduced in February 2019), Code Sight, meant to run full SAST analysis by continuously scanning in the background while a developer is coding. Synopsys should be considered by organizations looking for a complete AST offering that want variety in AST technologies, assessment depth, deployment options and licensing.
Headquartered in the U.S., Veracode is an AST provider with a strong presence in the North American market, as well as a presence in the European market. The Veracode offering includes a family of products that provide SAST, DAST and SCA services. Veracode also provides mobile AST and a vendor security testing attestation program known as Veracode VAST.During this evaluation, CA Technologies (which had previously acquired Veracode) was acquired by Broadcom, with the deal closing in November 2018. In the same month, it was announced that Veracode would be acquired from Broadcom by private equity firm Thoma Bravo. During the past 12 months, Veracode acquired an SCA company, SourceClear, which it has started to integrate into the Veracode platform. The vendor expanded SAST language coverage, upgraded its DAST engine for increased performance and accuracy, and consolidated previously segmented components into a single DAST offering.Veracode will meet the requirements of organizations looking for a complete portfolio of AST services, with broad language and framework coverage and ease of implementation and use.
Based in the U.S., WhiteHat Security is a global provider of AST as a service. WhiteHat Sentinel provides SAST, SCA and DAST, with specific versions for development, build and operation phases. Sentinel SAST can scan both binaries and source code. WhiteHat Security also provides mobile testing in partnership with NowSecure. The results of all WhiteHat DAST, SCA, mobile AST and SAST scans can be reviewed upon request by an expert in WhiteHat’s Threat Research Center before delivery to the customer. When on-premises scanning is a requirement, WhiteHat Security uses a virtual machine that keeps some of the analysis local and sends limited, nonsensitive data to the SaaS back end.During the past 12 months, WhiteHat Security enhanced its API security testing solution, introduced automated machine-learning-based vulnerability verification, and improved DAST testing of single-page applications. Also, WhiteHat introduced stand-alone SCA and has started to segment its SAST and SCA offerings with varying levels of depth and automation for different phases of the SDLC.WhiteHat Security should be considered for buyers seeking an AST SaaS platform and, especially, DAST services. This is largely handled by an expert, cloud-service-testing provider with a scalable solution.
We review and adjust our inclusion criteria for Magic Quadrants as markets change. As a result of these adjustments, the mix of vendors in any Magic Quadrant may change over time. A vendor’s appearance in a Magic Quadrant one year and not the next does not necessarily indicate that we have changed our opinion of that vendor. It may be a reflection of a change in the market and, therefore, changed evaluation criteria, or of a change of focus by that vendor.
CAST and Acunetix were added.
Positive Technologies, SiteLock and Trustwave were dropped based on our inclusion and exclusion criteria.
To qualify for inclusion, vendors need to meet the following criteria as of 1 October 2018:
We will not include vendors in this research that:
Magic Quadrants are used to evaluate the commercial offering, sales execution, vision, marketing and support of products in the market. This excludes the evaluation of open-source software (OSS) or vendor products that rely heavily on and bundle open-source tools.
Several vendors that are not evaluated in this Magic Quadrant are present in the AST space or in markets that overlap with AST. These vendors do not currently meet our inclusion criteria; however, they either provide AST features or address specific AST requirements and use cases. These providers range from consultancies and professional services to related solution categories, including:
Gartner tracks and can discuss in inquiry specific additional AST vendors, including: edgescan, Fasoo, GitLab, GrammaTech, ImmuniWeb, Kiuwan, Netsparker, NSFOCUS, N-Stalker, Onapsis (Virtual Forge), PortSwigger, Positive Technologies, SiteLock, SonarQube, Trustwave and Wallarm, as well as embedded functionality from major public cloud providers. In addition, we track and can discuss vendors in the listed adjacent markets (see “Hype Cycle for Application Security, 2018”).
Product or Service: This refers to core goods and services that compete in and/or serve the defined market. It includes current product and service capabilities, quality, feature sets and skills, among others. This can be offered natively or through OEM agreements/partnerships as defined in the market definition and detailed in the subcriteria.This criterion specifically evaluates current core AST product/service capabilities, quality and accuracy and feature sets. Also, the efficacy and quality of ancillary capabilities and integration into the software development life cycle are valued.Overall Viability: Viability includes an assessment of the organization’s overall financial health as well as the financial and practical success of the business unit. It views the likelihood of the organization to continue to offer and invest in the product as well as the product position in the current portfolio.Specifically, we look at the vendor’s focus on AST, its growth and estimated AST market share, as well as its customer base.Sales Execution/Pricing: This criterion refers tothe organization’s capabilities in all presales activities and the structure that supports them. This includes deal management, pricing and negotiation, presales support and the overall effectiveness of the sales channel.We are specifically looking for capabilities such as how the vendor supports proofs of concept or pricing options for both simple and complex use cases. The evaluation will also include feedback received from clients on experiences with vendor sales support, pricing and negotiations.Market Responsiveness/Record: This is theability of the vendor to respond, change direction, be flexible and achieve competitive success as opportunities develop, competitors act, customer needs evolve, and market dynamics change. This criterion also considers the vendor’s history of responsiveness to changing market demands.We evaluate how the vendor’s broader application security capabilities match with enterprises’ functional requirements, and the vendor’s track record in delivering innovative features when the market demands them. We also account for vendors’ appeal with security technologies complementary to AST.Marketing Execution: This criterion describesthe clarity, quality, creativity and efficacy of programs designed to deliver the organization’s message in order to influence the market, promote the brand, increase awareness of products and establish a positive identification in the minds of customers. This “mind share” can be driven by a combination of publicity, promotional, thought leadership, social media, referrals and sales activities.We evaluate elements such as the vendor’s reputation and credibility among security specialists.Customer Experience: This refers toproducts and services and/or programs that enable customers to achieve anticipated results with the products evaluated. Specifically, this includes quality supplier/buyer interactions, technical support, or account support. This may also include ancillary tools, customer support programs, availability of user groups, service-level agreements, and others.We evaluate elements such as the ease of use of the tool as perceived by end users and customers.
|Product or Service||High|
Source: Gartner (March 2019)
Market Understanding: We weight a vendor’sability to understand customer needs and translate them into products and services. This refers to vendors that show a clear vision of their market — listen, understand customer demands, and can shape or enhance market changes with their added vision.It includes the vendor’s ability to understand buyers’ needs and translate them into effective and usable AST (SAST, DAST and IAST) products and services.In addition to examining a vendor’s key competencies in this market, we assess its awareness of the importance of:
Marketing Strategy: This refers to aclear, differentiated messaging consistently communicated internally, externalized through social media, advertising, customer programs, and positioning statements.The visibility and credibility of the vendor’s security research labs is also a consideration. We will also consider how well that messaging informs the suitability of the vendor’s solution for evolving client needs.Sales Strategy: This criterion describesa sound strategy for selling that uses the appropriate networks including: direct and indirect sales, marketing, service, and communication. It also include whether the vendor has partners that extend the scope and depth of market reach, expertise, technologies, services and their customer base.Specifically, we look at how a vendor reaches the market with its solution and sells it — for example, leveraging partners and resellers, security reports or web channels.Offering (Product) Strategy: This refers toan approach to product development and delivery that emphasizes market differentiation, functionality, methodology, and features as they map to current and future requirements.Specifically, we are looking at the product and service AST offering, and how its extent and modularity can meet different customer requirements and testing program maturity levels.We evaluate the vendor’s development and delivery of a solution that is differentiated from the competition in a way that uniquely addresses critical customer requirements.We also look at how offerings can integrate relevant non-AST functionality that can enhance the security of applications overall.Innovation: Direct, related, complementary, and synergistic layouts of resources, expertise or capital for investment, consolidation, defensive or pre-emptive purposes are considered.Specifically, we look at how vendors are innovating to support evolving client requirements to support testing for DevOps initiatives as well as API security testing, serverless and microservices architecture. We also evaluate developing methods to make security testing more accurate. We value innovations in IAST, but also in areas such as SCA, RASP and behavioral testing.We also value innovation in DAST to support modern web and infrastructural requirements such as rich internet application (RIA) and cloud platforms.Geographic Strategy: This criterion evaluates the vendor’s strategy to direct resources, skills and offerings to meet the specific needs of geographies outside the “home” or native geography, either directly or through partners, channels and subsidiaries, as appropriate for that geography and market. We evaluate the worldwide availability and support for the offering, including local language support for tools, consoles and customer service.
|Offering (Product) Strategy||High|
|Business Model||Not Rated|
|Vertical/Industry Strategy||Not Rated|
Source: Gartner (March 2019)
Leaders in the AST market demonstrate breadth and depth of AST products and services. Leaders typically provide mature, reputable SAST and DAST, and demonstrate vison through development of IAST or other emerging AST techniques in their solutions. Leaders also should provide organizations with AST-as-a-service delivery models for testing, or with a choice of a tool and AST as a service, as well as an enterprise-class reporting framework supporting multiple users, groups and roles, ideally via a single management console. Leaders should be able to support the testing of mobile applications and should exhibit strong execution in the core AST technologies they offer. While they may excel in specific AST categories, Leaders should offer a complete platform with strong market presence, growth and client retention.
Challengers in this Magic Quadrant are vendors that have executed consistently, often with strength in a particular technology (for example, SAST or DAST) or by focusing on a single delivery model (for example, on AST as a service only). In addition, they have demonstrated substantial competitive capabilities against the Leaders in their particular focus area and have demonstrated momentum in their customer base in terms of overall size and growth.
Visionaries in this Magic Quadrant are vendors that are particularly innovative in AST with a strong vision that addresses the evolving needs of the market. It includes vendors that provide innovative capabilities to accommodate DevOps, to integrate in the SDLC, or to identify vulnerabilities with alternative technologies to established SAST and DAST, such as IAST. Visionaries may not execute as consistently as Leaders or Challengers and may not have comprehensive offerings in terms of SAST, DAST and IAST.
Niche Players offer viable, dependable solutions that meet the needs of specific buyers. Niche Players are less likely to appear on shortlists, but fare well when considered for buyers looking for “best of breed” or “best fit” to address a particular business and technical use case that matches the vendor’s focus. Niche Players may address subsets of the overall market, and often can do so more efficiently than the Leaders. Enterprises tend to pick Niche Players when the focus is on a few important functions, or on specific vendor expertise or when they have an established relationship with the vendor. Niche Players typically focus on a specific type of AST technology or delivery model, or a specific geographic region.
Through 2022, the AST market is projected to have a 10% compound annual growth rate (CAGR). This continues to be a fast-growing segment in the information security space, which itself is expected to grow at a five-year CAGR of 9%. The AST market size is estimated to reach $1.15 billion by the end of 2019.A trend of acquisitions and shake-ups to major players in the AST market continued in 2018, though the development of new solutions to counteract long-standing challenges with AST was somewhat muted. In November of 2018, Broadcom finalized the planned acquisition of CA Technologies, at the same time selling off the Veracode business unit for $950 million to Thoma Bravo.1 The same private equity firm had agreed to acquire Imperva, a leader in the web application firewall market (see “Magic Quadrant for Web Application Firewall”) only a month earlier.2 After entering into an IP partnership with HCL Technologies, IBM announced it would sell its AppScan software to HCL in December of 2018.3 Buyers should enter long-term contracts cautiously, given the volatility exhibited in the market.In addition, the market exhibits signs of increasing consolidation and commoditization, at least with respect to SAST and DAST for traditional web applications. Most major workflows and requirements have been worked out, and fewer development teams today are starting secure SDLC practices from scratch, instead relying on widely practiced architectures that they have solidified over the past few years. In 2018, the number of Gartner end-user client conversations on the fundamentals of secure application development decreased by around 45% from the year prior, marking more standardization around secure SDLC practices.4 The continued maturation of programs has led to some homogenization around core practices and the AST features required to support them. Innovations that seemed novel only a few years prior, such as the use of ML to reduce false positives, are now increasingly must-have features. Gartner believes this will continue for some years, which is good news for customers. As vendor capabilities and the programs they support converge, it becomes easier for clients to get the features they want at competitive prices. However, newer trends in application development such as DevSecOps, containers, serverless and edge computing have not fit well with the traditional toolsets, and Gartner predicts a second wave of innovation to address these challenges. End-user client inquiries around emerging topics such as DevSecOps (34% year over year), container security (55% year over year) and API security (77% year over year) increased.4Vendor portfolios remained largely unchanged in the face of ongoing and anticipated shifts, with few of the new offerings or innovative developments witnessed in years prior and with most innovation coming from smaller vendors. This forces many clients to pursue point solutions to address emerging use cases, such as vulnerability identification in APIs, and other facets of modern application development such as serverless applications. The continued acquisitions, coupled with the stagnation in new development, point to a mature market coalescing around a well-defined use case — the identification of self-inflicted vulnerabilities in custom-code web applications. This likely comes as a disappointment to many AST clients who still struggle to embed AST into their software development life cycle while meeting the challenges of modern development paradigms. Gartner clients expect AST players to advance their offerings to meet these related challenges by, for example, improving their capabilities to analyze APIs and inspect containers. However, this will need to be matched by increasing maturity in organizational application security disciplines and DevOps practices. Many clients have sought out point solutions from innovative startups to address challenges such as those in testing APIs. This is a potential missed opportunity for AST vendors if they fail to capture this use case. Yet there appears to be no shortage of business from existing solutions, and client inquiry indicates that much of the average organization’s web or enterprise IT application portfolio still needs to be tested.SCA solutions have become critical components of application security programs as more of the codebase incorporates open-source components. SCA products analyze application composition to detect components known to have security and/or functionality vulnerabilities or that require proper licensing. It helps ensure that the enterprise software supply chain includes only components that have undergone security testing and, therefore, supports secure application development and assembly. Gartner clients have long sought these capabilities from AST vendors. As such, vendors in this Magic Quadrant deliver SCA through homegrown solutions or partnerships with leading SCA vendors to supply analysis and governance capabilities to their clients.A distinct category exists in application security for solutions that are aimed at supporting security testing and vulnerability assessment for mission-critical, proprietary, commercial, off-the-shelf (COTS) applications. Business-critical application security is the set of processes and technologies that focuses on the security, risk and compliance of business-critical applications, most notably ERP; but it can also be extended to human resources and other business-critical applications.CSSTPs represent a significant deviation from traditional application and security penetration testing services, but have the potential to disrupt the traditional model and offer significant but often supplementary benefits. CSSTPs leverage a large pool of crowdsourced security testing practitioners to identify vulnerabilities through penetration testing and other techniques. CSSTPs also offer bug bounty program administration services, which often include options for vetting bounty seekers and payment processing, as well as options for full public or smaller private/invite-only bounty programs. CSSTP services enable organizations to leverage a diverse range of skills that might otherwise be difficult to replicate with traditional consulting services or AST. Thus, CSSTPs can augment an organization’s application security expertise. Gartner has already observed partnerships between AST and CSSTP vendors.Four main market observations are worthy of note:
Gartner used the following input to develop this Magic Quadrant:
1“Thoma Bravo to Buy Software Security Firm Veracode for $950 Million.” Reuters.2“Buyout Firm Thoma Bravo Adds Imperva to Cyber Portfolio.” Reuters.3“HCL Technologies to Acquire Select IBM Software Products for $1.8B.” Canada News Wire.4 Conclusions are based on end-user client inquiry data collected for calendar year 2018.
Product/Service: Core goods and services offered by the vendor for the defined market. This includes current product/service capabilities, quality, feature sets, skills and so on, whether offered natively or through OEM agreements/partnerships as defined in the market definition and detailed in the subcriteria.Overall Viability: Viability includes an assessment of the overall organization’s financial health, the financial and practical success of the business unit, and the likelihood that the individual business unit will continue investing in the product, will continue offering the product and will advance the state of the art within the organization’s portfolio of products.Sales Execution/Pricing: The vendor’s capabilities in all presales activities and the structure that supports them. This includes deal management, pricing and negotiation, presales support, and the overall effectiveness of the sales channel.Market Responsiveness/Record: Ability to respond, change direction, be flexible and achieve competitive success as opportunities develop, competitors act, customer needs evolve and market dynamics change. This criterion also considers the vendor’s history of responsiveness.Marketing Execution: The clarity, quality, creativity and efficacy of programs designed to deliver the organization’s message to influence the market, promote the brand and business, increase awareness of the products, and establish a positive identification with the product/brand and organization in the minds of buyers. This “mind share” can be driven by a combination of publicity, promotional initiatives, thought leadership, word of mouth and sales activities.Customer Experience: Relationships, products and services/programs that enable clients to be successful with the products evaluated. Specifically, this includes the ways customers receive technical support or account support. This can also include ancillary tools, customer support programs (and the quality thereof), availability of user groups, service-level agreements and so on.Operations: The ability of the organization to meet its goals and commitments. Factors include the quality of the organizational structure, including skills, experiences, programs, systems and other vehicles that enable the organization to operate effectively and efficiently on an ongoing basis.
Market Understanding: Ability of the vendor to understand buyers’ wants and needs and to translate those into products and services. Vendors that show the highest degree of vision listen to and understand buyers’ wants and needs, and can shape or enhance those with their added vision.Marketing Strategy: A clear, differentiated set of messages consistently communicated throughout the organization and externalized through the website, advertising, customer programs and positioning statements.Sales Strategy: The strategy for selling products that uses the appropriate network of direct and indirect sales, marketing, service, and communication affiliates that extend the scope and depth of market reach, skills, expertise, technologies, services and the customer base.Offering (Product) Strategy: The vendor’s approach to product development and delivery that emphasizes differentiation, functionality, methodology and feature sets as they map to current and future requirements.Business Model: The soundness and logic of the vendor’s underlying business proposition.Vertical/Industry Strategy: The vendor’s strategy to direct resources, skills and offerings to meet the specific needs of individual market segments, including vertical markets.Innovation: Direct, related, complementary and synergistic layouts of resources, expertise or capital for investment, consolidation, defensive or pre-emptive purposes.Geographic Strategy: The vendor’s strategy to direct resources, skills and offerings to meet the specific needs of geographies outside the “home” or native geography, either directly or through partners, channels and subsidiaries as appropriate for that geography and market.