Shipvane · 4 AE roles
Marco E. · joined Cargolio
Fleetora · first roles in DEapplication security testing, ranked by real usage_
As of 4 November 2026, Burp Suite leads application security testing with 760 companies naming it in job postings, ahead of Snyk at 372.
As of 4 November 2026 · refreshed daily · counts move as websites, DNS and career sites are re-read.
- Leader
- Burp Suite · 760
- Runner-up
- Snyk · 372
- Most hiring, 90 days
- Burp Suite
- Highest postings per company
- GitGuardian
- Catalogue
- T-1.0.1-prov
Every application security testing we can measure
Companies naming the tool, and postings naming it in the last 90 days. Bars are relative to the leader.
| # | Tool | Companies | companies | Postings, 90 days | postings | per company |
|---|---|---|---|---|---|---|
| 1 | Burp SuitePortSwigger | 760 | 1,363 | 1.8 | ||
| 2 | SnykSnyk | 372 | 845 | 2.3 | ||
| 3 | OWASP ZAPOWASP Foundation | 312 | 510 | 1.6 | ||
| 4 | TrivyAqua Security | 253 | 474 | 1.9 | ||
| 5 | CheckmarxCheckmarx | 244 | 643 | 2.6 | ||
| 6 | FortifyOpenText | 233 | 747 | 3.2 | ||
| 7 | VeracodeVeracode | 148 | 469 | 3.2 | ||
| 8 | GitHub Advanced SecurityGitHub | 142 | 266 | 1.9 | ||
| 9 | SemgrepSemgrep | 122 | 232 | 1.9 | ||
| 10 | CheckovPalo Alto Networks | 102 | 187 | 1.8 | ||
| 11 | CoveritySynopsys | 95 | 311 | 3.3 | ||
| 12 | Black DuckBlack Duck Software | 91 | 308 | 3.4 | ||
| 13 | DependabotGitHub | 86 | 128 | 1.5 | ||
| 14 | CodeQLGitHub | 74 | 134 | 1.8 | ||
| 15 | cosignSigstore | 70 | 117 | 1.7 | ||
| 16 | SigstoreLinux Foundation | 64 | 229 | 3.6 | ||
| 17 | SonatypeSonatype | 58 | 120 | 2.1 | ||
| 18 | CycloneDXOWASP Foundation | 51 | 131 | 2.6 | ||
| 19 | HCL AppScanHCL | 46 | 82 | 1.8 | ||
| 20 | WebInspectOpenText | 45 | 80 | 1.8 | ||
| 21 | GrypeAnchore | 40 | 98 | 2.5 | ||
| 22 | SPDXLinux Foundation | 39 | 102 | 2.6 | ||
| 23 | SyftAnchore | 33 | 76 | 2.3 | ||
| 24 | Aikido SecurityAikido | 30 | 53 | 1.8 | ||
| 25 | GitGuardianGitGuardian | 12 | 46 | 3.8 |
Compare two tools
Same data, two columns: who chooses which by size, industry and country.
Quote the sentence with the date and the link. The numbers change daily; the link always shows the current ones.
Burp Suite leads application security testing with 760 companies naming it in job postings, ahead of Snyk at 372. (Breaknorm, 4 November 2026, https://breaknorm.co/tools/category/application-security-testing)
Read from the source, not self-reported
Every number on this page can be traced to a page we crawled or a posting we read. Full methodology →
- CatalogueBreaknorm technology catalogue T-1.0.1-prov: 6,296 tools with vendor and category, editions folded into their parent.
- CompaniesCompanies whose own postings name the tool as the team's system, any confidence. Candidate wish-lists excluded.
- 90-day postingsOpen postings first seen or posted in the last 90 days that name the tool.
- Not countedTools used by teams that do not post jobs, and companies without a career site we can read.
application security testing: questions
How is this ranking made?
By the number of companies whose own job postings name the tool as the team's system, from the Breaknorm technology catalogue (version T-1.0.1-prov). No vendor paid for a position and no editor chose the order.
Why is this different from review-site rankings?
Review sites rank by reviews collected. This ranks by companies hiring people to work in the tool, which is closer to seats in use. It under-counts tools used by teams that rarely post jobs.
What about product editions?
Editions and sub-products () are counted under the parent so no company is counted twice.
Can I get the companies behind a number?
Yes: click a tool, see the first 20, and sign up for the full list with verified e-mails. Counting is free.
Get the companies your way
The same data as a search, over MCP and the API, as bulk files, or pushed to you as it changes.
Every company on every tool,
ranked by what they say
Connect the MCP server, ask which companies run a tool, and get 1,000 records free.