ShieldProbe and static application security testing

SAST or penetration testing?
Review the code. Test what it does.

SAST shows where your code might be unsafe. ShieldProbe Assess pentests the running app and API with the user roles you agree, and keeps the request and response behind each finding. A named consultant approves every Assess finding before you see it.

See the sample finding Compare the two methods

Fictional source excerpt

const order = await orders.findOne({
  id: req.params.id
});
return res.json(order);

The question the code leaves open: where is the ownership check?

Runtime test of the deployed app

What does the
deployed path allow?

Identity: Customer A
Requested object: Customer B's order
Evidence recorded: Request, response and impact
Observed (illustrative SP-014): GET /api/orders/order-b07 · 200 OK. Customer A received Customer B's order.
Retest after patch, Defend off: 404 · access denied

Illustrative example with fictional data, not a live result.

SAST and a pentest: different evidence for different questions

SAST reads your source code. An application pentest tests the running system and its security boundaries.

Scroll the table sideways to compare both options. You can also focus it and use the arrow keys.

SAST and a pentest: different evidence for different questions
Compared on	SAST	ShieldProbe
Input	Source code, in the languages the tool supports.	A reachable running application or API, with test accounts for each role in scope.
Timing	Feedback in the IDE, repository or CI pipeline before a deployment.	Runs against an authorized deployed target, such as a staging environment.
Evidence	Points to potentially unsafe code paths and explains the issue in the source.	Records the request, response and observed impact for each confirmed finding.
Business logic	Can spot risky source patterns and data flows, but does not know your intended access rules.	Tests workflows and authorization against the roles, data and business rules you agree.
Remediation	Many tools suggest fixes and integrate with developer workflows.	Fix drafts a code change from the attack evidence. Your developers review it and raise the pull request.
Limitations	Results depend on language support, configuration and the code the tool can see.	Results depend on the scope the test can reach. A clean result does not prove there are no vulnerabilities.

Discuss source and runtime coverage

When to use SAST, runtime testing, or both

Every pull request and CI run

SAST, SCA and secret scanning.

Before a release, or after changes to auth, roles or payment flows

Runtime testing of the agreed roles.

A static finding you can’t settle from code alone

For authorization or a multi-step workflow, test it on a staging target.

Ongoing

Continuous (developer preview) runs selected tests on the repository events you enable.

What we need from you

A reachable staging URL, test accounts per role and agreed limits.

What happens after the report

Each module takes a finding one step further.

Assess

A pentest of your web apps, APIs, networks and servers. A named consultant approves every finding, and each one comes with evidence your team can reproduce.

Explore Assess

Defend

Protection for supported findings inside your Node.js app, sold separately. It starts in log-only mode and blocks only when you turn enforcement on. Ownership flaws are logged, never blocked.

Explore Defend

Fix

A code change drafted from the actual attack, in VS Code or Visual Studio (beta). Your developers review it and raise the pull request.

Explore Fix

Continuous

Developer preview. Selected tests run on the repository events you enable, so each change is tested as it ships.

Explore Continuous

Common questions

Is ShieldProbe a DAST scanner?

Both DAST and an Assess pentest test a running application. Assess goes further into the roles, workflows and authorization boundaries you agree, such as broken object level authorization (IDOR), and a named consultant approves each finding with its request and response. See how a pentest compares with vulnerability scanning.

What do you need from us?

A reachable target, test accounts for each role, the agreed scope and agreed limits for testing.

Does it depend on our languages?

Assess needs a reachable web app or API, not support for your source language. Defend currently supports Node.js applications.

Can it run in our pipeline?

Continuous is a developer preview: the repository events you enable trigger selected tests against authorized targets.

Does ShieldProbe work alongside Checkmarx, Veracode, Snyk Code or SonarQube?

Yes, keep them. Assess tests the running application whichever SAST tool you use.

Does ShieldProbe replace SAST?

No. Assess tests the running application. Keep SAST, dependency scanning and secret scanning to catch issues before deployment.

Does a Fix patch merge automatically?

No. Fix prepares a code change and branch for your pull-request workflow. Review, tests, approval and deployment stay with your team.

Sources

Details about other products and standards come from the public sources below, reviewed on 20 October 2026 unless dated. If anything has changed, tell us and we will correct it.

OWASP: source code analysis tools and method
OWASP Web Security Testing Guide
Checkmarx: SAST product page (reviewed 22 October 2026)
Veracode: static analysis (SAST) product page (reviewed 22 October 2026)
Snyk Code product page (reviewed 22 October 2026)
SonarQube product page (reviewed 22 October 2026)