Best Enterprise Software Composition Analysis Tools

How Many Software Composition Analysis Tools Products Does G2 Track?

Total Products under this Category: 79

Category Stats (Nov 2026)

  • Average Rating: 4.48/5 (↓0.01 vs Oct 2026) The average rating of products in this category, based on all submitted ratings
  • Top Trending Product: DigiCert ONE (+0.99%) - Among all products in this category, DigiCert ONE recorded the largest rating increase compared to last month

Last updated: November 02, 2026

How Does G2 Rank Software Composition Analysis Tools Products?

Why You Can Trust G2's Software Rankings:

  • 30 Analysts and Data Experts
  • 6,900+ Authentic Reviews
  • 79+ Products
  • Unbiased Rankings

G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.

G2 Grid® for Software Composition Analysis Tools

G2 Grid® for Software Composition Analysis Tools plotting products by satisfaction and market presence

Highlighted products: HCL AppScan, Wiz, Mend.io, JFrog, Semgrep, Cortex Cloud, Snyk, and GitHub.

Underlying data: [Grid® JSON](https://www.g2.com/categories/software-composition-analysis/grids.json?focus%5B%5D=hcl-appscan&focus%5B%5D=wiz-wiz&focus%5B%5D=mend-io&focus%5B%5D=jfrog-2024-03-28&focus%5B%5D=semgrep&focus%5B%5D=cortex-cloud&focus%5B%5D=snyk&focus%5B%5D=github&segment=enterprise)

HCL AppScan

HCL AppScan is a comprehensive suite of market-leading application security testing solutions (SAST, DAST, IAST, SCA, API), available on-premises and on-cloud. These powerful DevSecOps tools pinpoint application vulnerabilities, allowing for quick remediation in every phase of the software development lifecycle. Fast and Accurate Scanning for Secure DevOps Developers and DevOps teams can quickly and accurately scan code, applications, and APIs for security vulnerabilities while applications are being developed. This allows companies to fix issues at the earliest stages of the software development lifecycle, when it is least costly to the business. Focus on the Fix Continuous monitoring with IAST, along with auto issue correlation with DAST and SAST scan results allows DevOps teams to group and prioritize findings for faster, more streamlined remediation. Enterprise Management for Security Teams Centralized, easy-to-use dashboards provide visibility and oversight of all security scanning and remediation, and allow users to set scan parameters and compliance policies.

Average Rating: 4.2/5.0

Total Reviews: 125

How Do G2 Users Rate HCL AppScan?

  • Quality of Support: 8.5/10 (Category avg: 9.0/10)
  • Language Support: 9.2/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 8.9/10 (Category avg: 8.8/10)
  • Integration: 9.2/10 (Category avg: 8.8/10)

Who Is the Company Behind HCL AppScan?

  • Seller: HCL Technologies
  • Company Website:
  • Year Founded: 1999
  • HQ Location: Noida, Uttar Pradesh
  • LinkedIn® Page: www.linkedin.com
    258,955 employees on LinkedIn®
  • Ownership: NSE - National Stock Exchange of India

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer & Network Security
  • Company Size: 51% Large, 25% Medium

What Are Recent G2 Reviews of HCL AppScan?

What Are G2 Users Discussing About HCL AppScan?

Wiz

Wiz transforms cloud security for customers – including more than 50% of the Fortune 100 – by enabling a new operating model. With Wiz, organizations can democratize security across the development lifecycle, empowering them to build fast and securely. Its Cloud Native Application Protection Platform (CNAPP) consolidates CSPM, KSPM, CWPP, Vulnerability management, IaC scanning, CIEM, DSPM into a single platform. Wiz drives visibility, risk prioritization, and business agility. Protecting Your Cloud Environments Requires a Unified, Cloud Native Platform. Wiz connects to every cloud environment, scans every layer, and covers every aspect of your cloud security - including elements that normally require installing agents. Its comprehensive approach has all of these cloud security solutions built in. Hundreds of organizations worldwide, including 50 percent of the Fortune 100, to rapidly identify and remove critical risks in cloud environments. Its customers include Salesforce, Slack, Mars, BMW, Avery Dennison, Priceline, Cushman & Wakefield, DocuSign, Plaid, and Agoda, among others. Wiz is backed by Sequoia, Index Ventures, Insight Partners, Salesforce, Blackstone, Advent, Greenoaks, Lightspeed and Aglaé. Visit https://www.wiz.io for more information.

Average Rating: 4.7/5.0

Total Reviews: 928

How Do G2 Users Rate Wiz?

  • Quality of Support: 9.2/10 (Category avg: 9.0/10)
  • Language Support: 8.8/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 9.2/10 (Category avg: 8.8/10)
  • Integration: 9.3/10 (Category avg: 8.8/10)

Who Is the Company Behind Wiz?

  • Seller: Google
  • Company Website:
  • Year Founded: 1998
  • HQ Location: Mountain View, CA
  • LinkedIn® Page: www.linkedin.com
    301,144 employees on LinkedIn®
  • Ownership: NASDAQ:GOOG

Who Uses This Product?

  • Who Uses This: Security Engineer, CISO
  • Top Industries: Financial Services, Computer Software
  • Company Size: 54% Large, 37% Medium

What Do G2 Reviewers Say About Wiz?

AI-generated summary from verified user reviews

Pros
  • Users praise the user-friendly capabilities of Wiz, highlighting excellent service and reporting improvements.
  • Users value the enhanced security features of Wiz, benefiting from improved visibility and innovation in cloud security.
  • Users find Wiz to be incredibly easy to use, with a friendly interface and great support enhancing the experience.
  • Users value the enhanced visibility from Wiz, enabling efficient data security management and quick access to essential resources.
  • Users find the setup of Wiz to be easy and fast, enhancing their overall experience with its intuitive interface.
Cons
  • Users indicate that improvement is needed in reporting, alert tuning, and AI-related features for Wiz.
  • Users desire more features and consistency in Wiz to improve experience and enhance AI-related security capabilities.
  • Users find the learning curve steep, struggling with navigation and overwhelming popups in Wiz's interface.
  • Users highlight the need for improvements in reporting and additional capabilities in AI security and alert tuning.
  • Users find the complexity of the platform can be overwhelming, requiring significant effort to navigate and manage effectively.

What Are Recent G2 Reviews of Wiz?

Mend.io

Modern risk doesn't live in one layer, it lives between them. Mend.io is built for every risk, across AI and AppSec, securing the code layer, the AI layer, and the interactions between them. From discovery and red teaming to guardrails and runtime protection, Mend.io delivers continuous protection across the entire AI application lifecycle. Mend.io solutions include: 1. Mend AI secures the layer where modern risk actually lives—the interaction between code and AI. It continuously discovers AI components (agents, prompts, models), tests real behavioral risk through automated red teaming, and enforces in-app runtime guardrails for one continuous control system for the AI lifecycle. 2. Mend AppSec secures the modern code layer by continuously discovering and prioritizing risk across code, libraries, containers, and dependencies, giving teams the clarity they need to reduce exposure and ship secure software faster. 3. Mend Renovate secures the foundation of every codebase by automatically updating dependencies, rating the likelihood each update will succeed without breaking changes, and grouping them by confidence level so teams can resolve them faster.

Average Rating: 4.3/5.0

Total Reviews: 117

How Do G2 Users Rate Mend.io?

  • Quality of Support: 8.7/10 (Category avg: 9.0/10)
  • Language Support: 8.5/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 8.8/10 (Category avg: 8.8/10)
  • Integration: 8.7/10 (Category avg: 8.8/10)

Who Is the Company Behind Mend.io?

  • Seller: Mend
  • Company Website:
  • Year Founded: 2011
  • HQ Location: Boston, Massachusetts
  • LinkedIn® Page: www.linkedin.com
    259 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Software Engineer
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 36% Small, 33% Large

What Do G2 Reviewers Say About Mend.io?

AI-generated summary from verified user reviews

Pros
  • Users highlight the scanning efficiency of Mend.io, enabling seamless integration and effective source code analysis.
  • Users appreciate the ease of use of Mend.io, finding it helpful and easy to integrate into their workflow.
  • Users value the easy integrations with source code repositories, making security management efficient and straightforward.
  • Users praise Mend.io for its quick and accurate scanning capabilities, enhancing efficiency across various platforms.
  • Users value the automated vulnerability detection in Mend.io, enabling quick identification and resolution of critical issues.
Cons
  • Users face integration issues, finding it challenging to connect with on-premise tools and experiencing configuration problems.
  • Users find the limited features of Mend.io challenging, requiring workarounds for integration and specific use cases.
  • Users find missing features in Mend.io, struggling with integration and needing additional functionality for their workflows.
  • Users report complex implementation with numerous issues, including false positives and difficult integration processes.
  • Users find the interface confusing due to navigating between different portals for SAST and SCA products.

What Are Recent G2 Reviews of Mend.io?

What Are G2 Users Discussing About Mend.io?

AI can help you find the answers. G2 helps you trust them.

Connect G2 to Claude or ChatGPT for answers grounded in G2's trusted reviews, comparisons, and pricing from real user insights.

How it works
Connect G2 to ChatGPTConnect G2 to Claude

JFrog

JFrog Ltd. (Nasdaq: FROG), the creators of the unified DevOps, DevSecOps, DevGovOps and MLOps platform, is on a mission to create a world of software delivered without friction from development to production. Driven by a “Liquid Software” vision to keep software continuously flowing, secure, and always up to date, the JFrog Platform serves as the definitive software supply chain system of record. It is uniquely engineered to power organizations as they build, manage, and distribute trusted software with unprecedented speed, security, and scale across hybrid and multi-cloud environments. As software engineering evolves in the AI era, JFrog’s newest offerings address the industry's most pressing trend: the rise of agentic software development and the hidden security risks of "Shadow AI." In response to threat actors increasingly targeting developer workflows including a massive surge in malicious open-source AI models and infected packages; JFrog has expanded its platform capabilities to deliver absolute end-to-end visibility and automated compliance. Key new innovations include the JFrog AI Catalog, which enables organizations to centralize, govern, and control the lifecycle of AI models approved for enterprise use. To secure autonomous coding environments, JFrog introduced the Universal MCP Registry and the Agent Skills Registry (developed alongside NVIDIA). These new solutions establish the industry’s first enterprise-grade trust layer to safely manage and store AI agent skills, monitor connections, and instantly block unsafe developer tools or malicious coding extensions right where developers work. Furthermore, the integration of advanced DevGovOps and Runtime Security tools allows teams to replace slow, manual compliance audits with continuous, background policy enforcement. By shifting security left directly into the binary pipeline, JFrog ensures that the volume of AI-assisted code does not outpace an organization's ability to verify its safety. Today, millions of users and approximately 6,600 organizations worldwide, including a majority of the Fortune 100, depend on the universal JFrog Platform to eliminate point-solution fatigue, bridge the governance gap, and securely embrace digital transformation. Learn more at www.jfrog.com or follow us on X @JFrog.

Average Rating: 4.2/5.0

Total Reviews: 178

How Do G2 Users Rate JFrog?

  • Quality of Support: 8.4/10 (Category avg: 9.0/10)
  • Language Support: 8.3/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 9.2/10 (Category avg: 8.8/10)
  • Integration: 8.3/10 (Category avg: 8.8/10)

Who Is the Company Behind JFrog?

  • Seller: JFrog Ltd
  • Company Website:
  • Year Founded: 2008
  • HQ Location: Sunnyvale, CA
  • LinkedIn® Page: www.linkedin.com
    2,527 employees on LinkedIn®
  • Ownership: NASDAQ: FROG

Who Uses This Product?

  • Who Uses This: Software Engineer, DevOps Engineer
  • Top Industries: Information Technology and Services, Computer Software
  • Company Size: 48% Large, 30% Medium

What Do G2 Reviewers Say About JFrog?

AI-generated summary from verified user reviews

Pros
  • Users highlight the centralized platform of JFrog, facilitating efficient management of artifacts and secure sharing across environments.
  • Users value the centralized repository management in JFrog, making artifact storage and sharing seamless and efficient.
  • Users appreciate the ease of deployment with JFrog, seamlessly integrating CI/CD and security into a single platform.
  • Users value the seamless integrations of JFrog with various CI/CD tools, enhancing their workflow and automation.
  • Users appreciate the easy integrations of JFrog with CI/CD tools, enhancing their DevOps workflows seamlessly.
Cons
  • Users find JFrog's complexity in workflows challenging, especially for newcomers navigating its powerful features.
  • Users note the expensive cost compared to similar products, making it a less attractive option for some.
  • Users find the steep learning curve of JFrog challenging, requiring significant time and training to navigate effectively.
  • Users find difficult learning curves with JFrog, often requiring extensive training to navigate its complex functionalities.
  • Users find the learning difficulty of JFrog frustrating, requiring significant time and training to master its features.

What Are Recent G2 Reviews of JFrog?

What Are G2 Users Discussing About JFrog?

Semgrep

Semgrep is a modern static analysis (SAST), software composition analysis (SCA), and secrets detection platform designed for both developers and security teams. It combines fast, deterministic analysis with context-aware AI that triages findings like a senior security engineer. The AI Assistant helps reduce false positives, prioritize meaningful results, and offers clear remediation guidance. Its “Memories” feature learns from past decisions to further reduce triage noise over time. Semgrep also supports deep analysis of transitive dependencies, not just direct ones, helping teams surface and address hidden risks in their supply chain. It integrates well into modern development workflows and is easy to customize across environments.

Average Rating: 4.6/5.0

Total Reviews: 56

How Do G2 Users Rate Semgrep?

  • Quality of Support: 8.8/10 (Category avg: 9.0/10)
  • Language Support: 8.4/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 8.3/10 (Category avg: 8.8/10)
  • Integration: 8.3/10 (Category avg: 8.8/10)

Who Is the Company Behind Semgrep?

  • Seller: Semgrep
  • Year Founded: 2017
  • HQ Location: San Francisco, US
  • LinkedIn® Page: www.linkedin.com
    265 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer Software
  • Company Size: 45% Large, 43% Medium

What Do G2 Reviewers Say About Semgrep?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the ease of use of Semgrep, enabled by its intuitive syntax and smooth integration with CI/CD.
  • Users appreciate the flexibility and speed of Semgrep in enforcing coding standards and catching vulnerabilities effectively.
  • Users appreciate the effective vulnerability detection of Semgrep, facilitating quick identification and resolution of security issues.
  • Users appreciate the scanning efficiency of Semgrep, benefiting from rapid scans and streamlined CI/CD integration.
  • Users value Semgrep for its effective security vulnerability detection, enabling quick resolutions without hindering development speed.
Cons
  • Users find Semgrep not user-friendly due to a steep learning curve and complex initial setup requirements.
  • Users find the limited features of Semgrep restrict its usability and complicate effective vulnerability management.
  • Users find the difficult learning curve for Semgrep daunting, especially for creating advanced rules and setups.
  • Users express concerns about the lack of guidance in creating custom rules, complicating effective use of Semgrep.
  • Users note a steep learning curve for Semgrep's rule syntax, making it challenging for newcomers to master.

What Are Recent G2 Reviews of Semgrep?

Cortex Cloud

Cortex Cloud by Palo Alto Networks, the next version of Prisma Cloud, understands a unified security approach is essential for effectively addressing AppSec, CloudSec, and SecOps. Connecting cloud security and SOC workflows enables teams to achieve holistic visibility, trace risk across the lifecycle, and correlate real-time threat activity with development and runtime contexts. Cortex Cloud is a unified platform built on three core pillars: data integration, AI-driven intelligence, and automation. Now you can safeguard applications, data, and infrastructure across multicloud and hybrid environments with a unified data model that consolidates telemetry from code, runtime, identity, and endpoints, all into a single data source. Empower teams with precise, AI-powered insights and 2200+ machine learning models to identify and stop zero-day threats with real-time advanced threat detection and response. And automate with 1000+ prebuilt playbooks across your cloud stack to reduce manual workloads, accelerate remediations, and cut response times tenfold. Cortex Cloud delivers more than tools—it transforms how organizations secure their cloud environments.

Average Rating: 4.1/5.0

Total Reviews: 126

How Do G2 Users Rate Cortex Cloud?

  • Quality of Support: 8.0/10 (Category avg: 9.0/10)
  • Language Support: 6.7/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 7.9/10 (Category avg: 8.8/10)
  • Integration: 9.2/10 (Category avg: 8.8/10)

Who Is the Company Behind Cortex Cloud?

  • Seller: Palo Alto Networks
  • Company Website:
  • Year Founded: 2005
  • HQ Location: Santa Clara, CA
  • LinkedIn® Page: www.linkedin.com
    23,492 employees on LinkedIn®
  • Ownership: NYSE: PANW

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer & Network Security
  • Company Size: 38% Large, 32% Medium

What Do G2 Reviewers Say About Cortex Cloud?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the ease of use of Cortex Cloud, promoting faster performance monitoring and streamlined decision-making.
  • Users appreciate the centralized data and analytics of Cortex Cloud, enhancing efficiency and decision-making across security operations.
  • Users appreciate the centralized security management of Cortex Cloud, streamlining workload management and enhancing operational efficiency.
  • Users appreciate the centralized visibility of Cortex Cloud, enhancing data monitoring and facilitating better decision-making.
  • Users value the seamless integration of Cortex Cloud, enhancing efficiency in managing resources across different environments.
Cons
  • Users note the expensive pricing of Cortex Cloud, making it less accessible for smaller teams or businesses.
  • Users find the difficult learning curve of Cortex Cloud can slow down adoption for new teams and users.
  • Users find the steep learning curve of Cortex Cloud challenging, especially for those unfamiliar with its advanced features.
  • Users express concerns over high and unclear pricing, which complicates budgeting and can escalate with scaling needs.
  • Users experience a complex setup with Cortex Cloud, often struggling with intuitive navigation and steep learning curves.

What Are Recent G2 Reviews of Cortex Cloud?

Snyk

Snyk (pronounced sneak) is a developer security platform for securing custom code, open source dependencies, containers, and cloud infrastructure all from a single platform. Snyk’s developer security solutions enable modern applications to be built securely, empowering developers to own and build security for the whole application, from code & open source to containers & cloud infrastructure. Secure while you code in your IDE: find issues quickly using the scanner, fix issues easily with remediation advice, verify the updated code. Integrate your source code repositories to secure applications: integrate a repository to find issues, prioritize with context, fix & merge. Secure your containers as you build, throughout the SDLC: start fixing containers as soon as your write a Dockerfile, continuously monitor container images throughout their lifecycle, and prioritize with context. Secure build and deployment pipelines: Integrate natively with your CI/CD tool, configure your rules, find & fix issues in your application, and monitor your applications. Secure your apps quickly with Snyk’s vulnerability scanning and automated fixes - Try for Free!

Average Rating: 4.5/5.0

Total Reviews: 136

How Do G2 Users Rate Snyk?

  • Quality of Support: 8.6/10 (Category avg: 9.0/10)
  • Language Support: 8.1/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 8.7/10 (Category avg: 8.8/10)
  • Integration: 8.8/10 (Category avg: 8.8/10)

Who Is the Company Behind Snyk?

  • Seller: Snyk
  • HQ Location: Boston, Massachusetts
  • LinkedIn® Page: www.linkedin.com
    1,764 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Software Engineer
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 45% Medium, 35% Small

What Do G2 Reviewers Say About Snyk?

AI-generated summary from verified user reviews

Pros
  • Users appreciate Snyk's vulnerability detection, which enables timely identification and remediation of security issues.
  • Users value Snyk for its rapid vulnerability identification, significantly enhancing code security and DevOps efficiency.
  • Users value Snyk's easy integration setup, enhancing workflow and efficiency in vulnerability management within CI/CD pipelines.
  • Users find Snyk's easy setup with GitHub highly beneficial for seamless integration and vulnerability management.
  • Users appreciate the intuitive GUI and robust organizational features of Snyk, streamlining vulnerability management and reporting.
Cons
  • Users experience false positives from Snyk, leading to confusion and delays in their workflow.
  • Users find the poor interface design of Snyk inconvenient and seek better integration and usability.
  • Users express concerns over high pricing, especially for full feature access, though they see long-term value.
  • Users face scanning issues with false positives, slow scans, and lack of integration affecting workflow efficiency.
  • Users experience false positives and slow scans with Snyk, complicating integration and reducing effectiveness in detecting issues.

What Are Recent G2 Reviews of Snyk?

What Are G2 Users Discussing About Snyk?

GitHub

GitHub is where the world builds software. Millions of individuals, organizations and businesses around the world use GitHub to discover, share, and contribute software. Developers at startups to Fortune 50 companies use GitHub, every step of the way.

Average Rating: 4.7/5.0

Total Reviews: 2,368

How Do G2 Users Rate GitHub?

  • Quality of Support: 8.7/10 (Category avg: 9.0/10)
  • Language Support: 8.8/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 9.0/10 (Category avg: 8.8/10)
  • Integration: 9.0/10 (Category avg: 8.8/10)

Who Is the Company Behind GitHub?

  • Seller: GitHub
  • Year Founded: 2008
  • HQ Location: San Francisco, CA
  • LinkedIn® Page: www.linkedin.com
    6,653 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Software Engineer, Senior Software Engineer
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 47% Small, 31% Medium

What Do G2 Reviewers Say About GitHub?

AI-generated summary from verified user reviews

Pros
  • Users love the user-friendly interface of GitHub, enjoying seamless collaboration and efficient project management.
  • Users value the ease of use of GitHub, praising its intuitive interface and seamless collaboration features.
  • Users value the efficient team collaboration GitHub offers, streamlining workflows and enhancing project management.
  • Users value the smooth collaboration on GitHub, appreciating its all-in-one platform for managing projects and code.
  • Users appreciate how GitHub offers integrated version control, enhancing collaboration and workflow efficiency in development projects.
Cons
  • Users find the complexity of GitHub's features challenging, especially for new team members adapting to advanced workflows.
  • Users find the steep learning curve challenging, especially for advanced features and managing complex repositories.
  • Users find the difficulty for beginners in mastering advanced features and git commands to be quite challenging.
  • Users find the learning difficulty challenging, especially with advanced features and complex workflows for newcomers.
  • Users find the steep learning curve for advanced features challenging, especially for beginners navigating Git commands and workflows.

What Are Recent G2 Reviews of GitHub?

What Are G2 Users Discussing About GitHub?

DigiCert ONE

DigiCert ONE is a cloud-native digital trust platform that helps organizations automate, manage, and secure certificates, identities, software, devices, DNS infrastructure, documents, and email communications from a single platform. Designed to simplify complex trust environments, DigiCert ONE provides centralized visibility, policy-based governance, and automation to reduce operational risk, improve compliance, and accelerate digital transformation initiatives. The platform includes: - Trust Lifecycle Manager for CA-agnostic certificate lifecycle management, certificate discovery, automation, and public and private PKI. - Software Trust Manager for secure code signing, software supply chain protection, and automated signing workflows. - Device Trust Manager for establishing and managing trusted device identities throughout the IoT and device lifecycle. - Content Trust Manager for digital signatures, electronic seals, timestamping, and document trust services. - UltraDNS for highly available, secure DNS infrastructure, intelligent traffic management, and application resiliency. - Messaging Trust for email authentication, domain protection, phishing prevention, and improved email deliverability. DigiCert ONE also integrates with CertCentral®, enabling organizations to streamline the issuance, management, and automation of publicly trusted TLS/SSL certificates alongside their broader digital trust operations. Built on a scalable, container-based architecture, DigiCert ONE supports cloud, on-premises, hybrid, and air-gapped deployments, enabling organizations to meet security, operational, and regulatory requirements while maintaining agility. Organizations use DigiCert ONE to eliminate manual trust management processes, prevent certificate-related outages, secure software and connected devices, protect critical infrastructure, and build trusted digital experiences at scale.

Average Rating: 4.3/5.0

Total Reviews: 83

How Do G2 Users Rate DigiCert ONE?

  • Quality of Support: 8.9/10 (Category avg: 9.0/10)

Who Is the Company Behind DigiCert ONE?

  • Seller: DigiCert
  • Company Website:
  • Year Founded: 2003
  • HQ Location: Lehi, UT
  • LinkedIn® Page: www.linkedin.com
    1,957 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer Software
  • Company Size: 38% Small, 37% Medium

What Are Recent G2 Reviews of DigiCert ONE?

What Are G2 Users Discussing About DigiCert ONE?

Arnica

Arnica is a comprehensive application security posture management (ASPM) platform that protects developers, source code, and products throughout the software development lifecycle. The platform provides real-time application security scanning with 100% coverage across the software supply chain, addressing risks in Static Application Security Testing (SAST), Software Composition Analysis (SCA), Infrastructure as Code (IaC), hardcoded secrets detection, and more. At its core, Arnica offers AI-native security governance that takes control of AI-generated code through advanced AI SAST scanning and agentic rules enforcement. The platform automatically injects centrally-controlled security requirements into AI coding agents like Copilot, Cursor, and Claude at the point of code generation, ensuring every line of AI-written code is secure by default before vulnerabilities reach production. This approach addresses 92% of risks before they ever reach production environments. Arnica's pipelineless architecture provides automatic coverage for every repository without requiring CI/CD pipeline integrations or IDE deployments. The platform scans every code change at the feature branch level, delivering developer-native workflows that keep teams focused on building features rather than chasing security issues. Risk prioritization is enhanced through OWASP Top 10, CVSS, EPSS, and KEV scoring, combined with organizational context to surface the most critical vulnerabilities. The platform excels in developer experience by delivering security findings directly within existing workflows through Slack, Microsoft Teams, pull request comments, and automated ticket management in Jira and Azure DevOps Boards. AI-powered mitigation suggestions provide context-aware, automated fixes that align with organizational coding standards, significantly reducing mean-time-to-remediation. Key security capabilities include real-time secrets detection with automatic validation and mitigation, comprehensive container scanning that maps vulnerabilities directly to source code, and intelligent dependency management with automated SCA upgrades. The platform maintains SOC 2 Type 2 compliance and ISO 27001 certification, ensuring enterprise-grade security standards. Arnica's unique value proposition lies in its ability to scale security across entire organizations while maintaining development velocity, providing complete visibility into code risks, and enabling proactive security measures that prevent vulnerabilities from reaching production environments.

Average Rating: 4.4/5.0

Total Reviews: 36

How Do G2 Users Rate Arnica?

  • Quality of Support: 8.8/10 (Category avg: 9.0/10)
  • Language Support: 8.3/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 10.0/10 (Category avg: 8.8/10)
  • Integration: 10.0/10 (Category avg: 8.8/10)

Who Is the Company Behind Arnica?

  • Seller: Arnica
  • Company Website:
  • Year Founded: 2021
  • HQ Location: Alpharetta, Georgia
  • LinkedIn® Page: www.linkedin.com
    64 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Computer Software, Retail
  • Company Size: 62% Large, 22% Medium

What Do G2 Reviewers Say About Arnica?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the accuracy of findings from Arnica, effectively managing elevated privileges and reducing security risks.
  • Users value the actionable recommendations from Arnica, simplifying the removal of unused elevated privileges for enhanced security.
  • Users love the easy setup and administration of Arnica, saving time while meeting their needs effectively.
  • Users love the easy setup of Arnica, appreciating the quick and efficient administration process.
  • Users value Arnica for its ability to effectively remediate over-provisioning and enhance security without developer input.
Cons
  • Users note the limited access to features in Arnica for smaller teams not on GitHub Enterprise.

What Are Recent G2 Reviews of Arnica?

What Are G2 Users Discussing About Arnica?

GitLab

GitLab is the most comprehensive AI-Powered DevSecOps platform that enables software innovation by empowering development, security, and operations teams to build better software, faster. With GitLab, teams can create, deliver, and manage code quickly and continuously instead of managing disparate tools and scripts. GitLab helps your teams across the complete DevSecOps lifecycle, from developing, securing, and deploying software. What makes us truly different? - Flexibility: Consume as a service or manage your own deployment - Cloud-Agnostic: Deploy anywhere with no vendor lock-in - No rip and replace: Scale to a platform approach at your own pace

Average Rating: 4.5/5.0

Total Reviews: 888

How Do G2 Users Rate GitLab?

  • Quality of Support: 8.5/10 (Category avg: 9.0/10)
  • Language Support: 8.7/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 9.0/10 (Category avg: 8.8/10)
  • Integration: 8.8/10 (Category avg: 8.8/10)

Who Is the Company Behind GitLab?

  • Seller: GitLab Inc.
  • Year Founded: 2014
  • HQ Location: San Francisco, California
  • LinkedIn® Page: www.linkedin.com
    3,431 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Software Engineer, Senior Software Engineer
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 37% Medium, 37% Small

What Do G2 Reviewers Say About GitLab?

AI-generated summary from verified user reviews

Pros
  • Users value the ease of use in GitLab, appreciating its intuitive interface and straightforward setup for seamless collaboration.
  • Users appreciate the powerful all-in-one functionalities of GitLab that enhance collaboration and streamline development workflows.
  • Users value GitLab's integrated CI/CD feature, enhancing collaboration and streamlining code management seamlessly.
  • Users value the integrated CI/CD in GitLab, enhancing workflow efficiency and collaboration seamlessly.
  • Users value the seamless integration of GitLab with security tools, enhancing workflow efficiency and convenience.
Cons
  • Users find the complexity of the interface challenging, especially with large projects and advanced features being tiered.
  • Users find the difficult learning curve challenging, particularly when adapting to GitLab's complex features and structure.
  • Users often find the confusing interface of GitLab challenging, especially when navigating its extensive features and settings.
  • Users find the complex user interface challenging, especially with large projects, affecting performance and usability.
  • Users find the learning curve steep when adapting to GitLab's many features and unique group structures.

What Are Recent G2 Reviews of GitLab?

What Are G2 Users Discussing About GitLab?

Contrast Security

Contrast Security is the global leader in Application Detection and Response (ADR), empowering organizations to see and stop attacks on applications and APIs in real time. Contrast embeds patented threat sensors directly into the software, delivering unmatched visibility and protection. With continuous, real-time defense, Contrast uncovers hidden application layer risks that traditional solutions miss. Contrast’s powerful Runtime Security technology equips developers, AppSec teams and SecOps with one platform that proactively protects and defends applications and APIs against evolving threats.

Average Rating: 4.5/5.0

Total Reviews: 49

How Do G2 Users Rate Contrast Security?

  • Quality of Support: 9.3/10 (Category avg: 9.0/10)
  • Language Support: 8.1/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 9.0/10 (Category avg: 8.8/10)
  • Integration: 8.8/10 (Category avg: 8.8/10)

Who Is the Company Behind Contrast Security?

Who Uses This Product?

  • Top Industries: Insurance, Information Technology and Services
  • Company Size: 67% Large, 20% Medium

What Do G2 Reviewers Say About Contrast Security?

AI-generated summary from verified user reviews

Pros
  • Users value the accuracy of findings from Contrast Security, ensuring greater precision in identifying vulnerabilities.
  • Users value the accuracy of results from Contrast Security, benefiting from precise vulnerability monitoring and analysis.
  • Users commend the real-time vulnerability detection of Contrast Security, appreciating its quick feedback and agile support.
Cons
  • Users experienced performance issues with Contrast Security, particularly with Java applications, but found support helpful in resolving them.

What Are Recent G2 Reviews of Contrast Security?

What Are G2 Users Discussing About Contrast Security?

Black Duck Polaris Platform

Black Duck builds trust in software by enabling organizations to manage application security, quality, and compliance risks at the speed their business demands. Black Duck solutions help developers to secure code as fast as they write it, development and DevSecOps teams to automate testing within development pipelines without compromising velocity, and security teams to proactively manage risk and focus remediation efforts on what matters most. With Black Duck, organizations can transform the way they build and deliver software, aligning people, processes, and technology to intelligently address software risks across their portfolio and at all stages of the application lifecycle.

Average Rating: 4.2/5.0

Total Reviews: 103

How Do G2 Users Rate Black Duck Polaris Platform?

  • Quality of Support: 8.5/10 (Category avg: 9.0/10)
  • Language Support: 9.3/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 8.6/10 (Category avg: 8.8/10)
  • Integration: 8.3/10 (Category avg: 8.8/10)

Who Is the Company Behind Black Duck Polaris Platform?

  • Seller: Black Duck
  • Year Founded: 2024
  • HQ Location: Burlington, US
  • LinkedIn® Page: www.linkedin.com
    1,317 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer Software
  • Company Size: 53% Large, 32% Medium

What Do G2 Reviewers Say About Black Duck Polaris Platform?

AI-generated summary from verified user reviews

Pros
  • Users commend the accuracy of findings in Black Duck Polaris, especially its powerful engine for identifying open source issues.
  • Users praise the powerful open source issue identification by Black Duck Polaris, benefiting from extensive Black Duck Knowledge.
Cons
  • Users note that the platform requires huge resource constraints for on-prem deployment, impacting its usability.

What Are Recent G2 Reviews of Black Duck Polaris Platform?

What Are G2 Users Discussing About Black Duck Polaris Platform?

CAST Highlight

Portfolio-level insights for app modernization, AI readiness, tech debt, OSS risks CAST Highlight is a SaaS software intelligence technology that delivers rapid, fact-based insights across your entire application portfolio. With Ask CAST, IT leaders can query this intelligence in plain language through Microsoft Teams or AI assistants such as Claude and ChatGPT and receive grounded answers based on their portfolio data. By automatically analyzing the source code of hundreds or thousands of applications, CAST Highlight helps organizations assess cloud maturity, AI & Agentic readiness, software health, open source risk, resiliency, technical debt, and sustainability from a single lightweight scan. CAST Highlight is designed for CIOs, CTOs, enterprise architects, cloud leaders, application owners, security teams, and modernization teams that need a fact-based way to prioritize modernization, cloud, and AI adoption decisions at scale. It helps teams identify which applications are ready to move quickly, which require remediation, and where hidden software risks may affect transformation cost, timelines, security, resilience, or business outcomes. Unlike traditional manual or survey-based assessments, CAST Highlight analyzes application source code directly to rapidly segment portfolios, prioritize modernization paths, and uncover risks before they impact transformation programs. Organizations use CAST Highlight to: - Accelerate cloud migration and modernization planning - Segment applications by cloud maturity and transformation path - Identify high-value AI adoption opportunities - Assess Agentic Readiness across application portfolios - Prioritize technical debt, resiliency, and maintainability improvements - Assess open source vulnerabilities and IP / license exposure - Evaluate software sustainability with Green Impact insights - Reduce complexity, cost, and risk across transformation programs Businesses move faster using CAST to understand, improve, and transform their software. Through semantic analysis of source code, CAST generates dashboards and 3D maps for executives, technologists, and AI to navigate inside individual applications and across entire portfolios. This intelligence enables companies to steer, speed, and report on initiatives such as technical debt, modernization, and cloud. As the pioneer of the software intelligence field, CAST is trusted by the world’s leading companies and governments, their consultancies and cloud providers. See it all at castsoftware.com.

Average Rating: 4.5/5.0

Total Reviews: 87

How Do G2 Users Rate CAST Highlight?

  • Quality of Support: 9.1/10 (Category avg: 9.0/10)
  • Language Support: 8.5/10 (Category avg: 8.5/10)
  • Continuous Monitoring: 8.5/10 (Category avg: 8.8/10)
  • Integration: 8.5/10 (Category avg: 8.8/10)

Who Is the Company Behind CAST Highlight?

  • Seller: CAST
  • Company Website:
  • Year Founded: 1990
  • HQ Location: New York
  • LinkedIn® Page: www.linkedin.com
    1,270 employees on LinkedIn®
  • Ownership: Bridgepoint

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer Software
  • Company Size: 57% Large, 25% Small

What Do G2 Reviewers Say About CAST Highlight?

AI-generated summary from verified user reviews

Pros
  • Users highlight the ease of use of CAST Highlight, noting its quick setup and straightforward functionality for assessments.
  • Users find the easy setup of CAST Highlight highly beneficial, enabling quick integration and efficient use with enterprise tools.
  • Users value CAST Highlight for its insights into cloud migration and technical debt assessment, enhancing software health evaluation.
  • Users appreciate the efficient analysis offered by CAST Highlight, enabling fast insights and effective modernization strategies.
  • Users value the speed and simplicity of CAST Highlight, enabling quick, actionable insights for portfolio analysis.
Cons
  • Users find the complex navigation of CAST Highlight challenging, making it harder to efficiently use the tool.
  • Users find dashboard issues prevalent, including lack of depth and customization challenges for specific organizational needs.
  • Users find that the delayed detection of issues may hinder timely responses and overall effectiveness of CAST Highlight.
  • Users find the difficulty in initial configuration and metric interpretation a barrier for new teams using CAST Highlight.
  • Users find the high price of CAST Highlight a barrier for broader adoption in larger companies.

What Are Recent G2 Reviews of CAST Highlight?

What Are G2 Users Discussing About CAST Highlight?

Adam Crivello
AC
Researched and written by Adam Crivello
Updated