What are your recommendations for application security scanning tools, both SAST and DAST

like
Posting as :
works at
You are currently posting as works at

I LOVE snyk. It has been a tool that I’ve used for about 6 months. It definitely filters out all the bs false positive.

When it comes to DAST, I am not a fan of many tools out there. I have used a bunch in my tenure of appsec.
Veracode - terrible UI. Good customer service.

Rapid7 - not truly a DAST as it is super invasive. More a pentest tool

Invicti - I believe it is probably the best tool I’ve used out of everything.

Qualys - it is probably my second go to tool.

Burp - thumbs DOWN.

I can go more in detail but I hate this character limitation! Let me know if you want a thorough review on each. I can do it!

Related Posts

How has anybody had luck with getting freelance account gigs? Been silent in LA

like

Not able to clear Independence Training for new joiners can anyone help how I can clear this?

like

Wondering if $150,000 base + 25% bonus, no RSU, is underpaid for a Director of Operations in a Marketing/Tech firm?

Responsibilities include direct oversight of onboarding, support, implementation/integrations, customer success, production - fulfillment, production-web dev, and content departments. 8 years experience at various management levels, 2 years as DOP.

like

How do filmmakers find investors?

like

Matched with a guy on Tinder. Had a great first date. We are stilling chatting on WhatsApp. But he has disappeared from my tinder (presumably, he unmatched with me). Is it typical for ppl to unmatch on Tinder when they are still interested in you?

like

my sister died this morning. I posted about her in a past post. Alcohol addiction, liver failure and then it taxed the kidneys too much, she went into cardiac arrest at 9 am and they could not save her. She was 51. Sad day for sure. Feels odd that she is no longer here. I just wish she could have had a better future.

like

Any recommendations for Tennis lessons here in Austin? North or downtown (but any recommendations works)

like

Welcome to the FP&A Bowl. I came on this app looking for a place to connect with others working in corporate planning but saw that there was no Bowl for us, so I created it! Hope you’re all doing well

like

do globallogic noida gives free cab and free food me

Has anyone done online teaching with VipKid?
I’m considering it as a side job.
Any other ideas/suggestions would be great

like

I am looking for a lower stress, mostly remote, part time job. Any recommendations? My background is corporate Income tax. 10 years experience.

like

Hey everyone, Withum is still hiring entry-level staff accountants (audit and tax) with the start date of November 2023, experienced associates, senior associates, and more!
The firm is currently number 22 in the nation based on INSIDE Public Accounting. AMAZING culture, good wlb, and really nice people (at least in the nyc office). Please message me directly if you’re interested!

likefunny

Where are we supposed to submit tax declaration documents after declaring them in the system in EY India?

The system shows the supporting documents need to be submitted by 6th January.

like

Red red red

like

Looking for remote healthcare opportunities in business ops or project management. Recommendations welcome.

like

Hey I am trying to get into consulting tips

Are Coforge reviews fake on Glassdoor? Had a discussion with their HR today. He was telling Coforge is doubling in size and revenue in the next 2 years, we had the least attrition. You can do your research. Maybe Delhi Noida based companies, I really feel scared about. I think they will say anything to get a joining.

For those that lateraled to another firm for FDD work - was your 2 week period paid out? Were you worked? Should I expect to have a 2 week paid vacation when I put in notice?

Receiving approx 30% pay bump to move firms. Stay schemin boys

like

So really the only exercise I can tolerate is boxing, and those exercises around it. Any thoughts on replicating what I can find at my local boxing gym while on the road?

Additional Posts in Cybersecurity Bowl

Need help finding a cybersecurity job!

BS Cybersecurity (2021)
5+ YOE in IT

I have been looking for an entry level job in cybersecurity for more than a year now. It’s really frustrating I am not getting invited to interviews. Anyone willing to help with a referral, a resume review, or just a chat to help me improve my job search strategy? Thank you!

like

Hey all, looking to switch from SWE to Cyber Security… Any suggestions or tips on the best way to get my foot in the door?

like

I am looking for a entry level position in cybersecurity.

like

Anyone looking or know anyone looking for a job in Cybersecurity as App Security Analyst/Engineer?

like

Anyone here has experience with a WAAP?

like

What is the standard yearly hike in IT Security industry in North America? I have worked for 7 months in Threat Intelligence in a company in Canada, and I got a yearly hike of just 3% in my first appraisal cycle. My manager says that you get 3% when you are meeting expectations but not going above and beyond. Is this the standard or am I being underpaid? According to me, I haven't gone above and beyond every day, but there are some things I did work on exceptionally well.

like

Is 80k a year a good starting pay for a SOC Analyst with no certs, clearance and experience?

like

I need help. I work in performance analytics, but leading projects surrounding privacy, consent, auditing, and a lot of things legal related. I already feel underpaid, but now I also feel like I'm being placed in charge of things above my pay scale, but maybe I'm wrong 🤷🏽‍♀️. Ref 70k range, 5+ yrs experience, educated and working on sec+ certs. Is this average pay? I don't even know what job title I would fall under with all things privacy security related. Tips/advice as I'm clueless tbh. I

like

Hey everyone - I am trying to get an entry level position in cyber / info security. Got my BS Cyber and Info Security in 2021. Have 5+ YoE in IT Support. Based in Chicago. Anyone willing to provide a referral or share advice on how to get in? I am applying daily on LinkedIn and Indeed but barely getting interviews. Appreciate any help.

Could you all please suggest or share any tips/key things to prepare for an upcoming AWS Partner SA, Security phone interview. Already prepared for LPs. Thank you.

like

Hi everyone, I am new here! Looking for any Business Development Representatives /SDR's in the Chicago area! 1 year SaaS sales Experience required. $50K base 80K OTE! Please let me know if this could be an exciting for yourself and we can connect and set up an initial call!

Thanks in advance!

like

Hi all - Trying to pivot into Cybersecurity/Infosec after 7 + years of experience in Network Engineering. No security related certifications. I have enough work experience in network security to match 60-70% of job requirements for infosec positions. Capable to get CEH/OSCP certifications in a few months, but want to wait until I get my foot into the door before investing 2-3K on these certs. Any advice for me will be greatly appreciated.

like

Any thoughts on the company Deep Instinct? So far, I am seeing good press and reviews.

like

Currently looking for my first job in Cybersecurity. I have a 4 year degree in CIS and emphasis in Security, but no Certifications yet. Asking for advise- is it possible to get my first job in this field without having a Cert yet? Or do most companies want a degree and certs right off the bat?

like

When it comes to education and application of the knowledge, what is preferred, masters in cyber security or various cyber security certifications in regards to application at work?

like

Hello all,
Hope everyone doing well. I have my resume, and I need check it with formatting and everything. Anyone willing to help? I will be appreciate it.
My job now Desktop Support Analyst/ IT Security Associate. Thank you all

like

Hello there. I’m looking for an internship or entry level position in cybersecurity. Any leads? In the meantime what are your favorite online labs? I’m using TryHackMe for now.

like

Hi Everyone ,
I am a recent graduate from University of Leicester looking for SoC analyst roles , I have a question does being SoC analyst be considered a High clearance Job in the United Kingdom ? , Because all the Job role I have applied for the recruiters have been asking for clearance. Could anyone shed some light how I need to answer them or any tips would be greatly appreciated .

Regards
Jabez

I'm almost to the 2 year mark in my role of a SOC Analyst after graduating with a degree in Cybersecurity. During my time here, I've acquired the GCIH certification via a comprehensive SANS course Sec504. I've been applying everywhere but it seems we're in a rough season in tech. I'm new to fishbowl, would anyone here be interested in connecting?

Thank you!

like

New to Fishbowl?

Download the Fishbowl app to
unlock all discussions on Fishbowl.
That was just a preview…
Sign Up to see all discussions
  • Discover what it’s like to work at companies from real professionals
  • Get candid advice from people in your field in a safe space
  • Chat and network with other professionals in your field
Sign up in seconds to unlock all discussions on Fishbowl.

Already a user?
Login here

Share

Embed this post

Copy and paste embed code on your site

Preview

Download the
Fishbowl app

See what’s happening in your industry
from the palm of your hand.

A phone with Fishbowl app

Scan your QR code to download
Fishbowl app on your mobile

Download app

Sign up for free to view this conversation on Fishbowl

By continuing you agree to Terms of Use and Privacy Policy

Already have an account? Log in

Sign up for free to continue using Fishbowl

By continuing you agree to Terms of Use(New) and Privacy Policy(New)
Messaging rates may apply

Already have an account? Log in

For account settings, visit Fishbowl on Desktop Browser or

General

Legal