> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/new-to-sto/sto-whats-supported/scanners.md).

# Supported Security Scanners

Harness STO supports over 40 security scanners, they are categorized as follows:

* [**Harness Security Scanners**](#harness-security-scanners): Scanners developed, maintained, and fully supported by Harness
* [**Third-Party Scanners**](#third-party-scanners): External commercial or open-source scanners integrated with the Harness platform, not developed or directly maintained by Harness.
  * **Open-Source Scanners**: A subset of third-party scanners that are open-source.
* [**Built-in Scanner Steps**](/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/built-in-scanners.md): Harness-provided scanner steps using pre-configured open-source scanners. These are ready-to-use within Harness pipelines and do not require additional commercial licenses. For a complete guide, refer to [Built-in Scanners](/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/built-in-scanners.md).

For a comprehensive list of all scanners, you can view them by [**Scan Type**](#third-party-scanners) or [**Target Type**](#third-party-scanners) further down this page.

#### Harness Security Scanners <a href="#harness-security-scanners" id="harness-security-scanners"></a>

Harness is expanding its native security scanning capabilities. These scanners are developed and maintained directly by Harness.

* [**API DAST**](/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/traceable-step-configuration.md) (*previously Traceable*): A Dynamic Application Security Testing scanner for your APIs. This was formerly known as the **Traceable API DAST** scanner.
* [**SAST**](/security-testing-orchestration/3.0/use-sto/harness-security-scanners/sast.md): A Static Application Security Testing scanner for your Code Repositories.
* [**SCA**](/security-testing-orchestration/3.0/use-sto/harness-security-scanners/sca.md): A Software Composition Analysis scanner for your Container Images.

#### Third-Party Scanners <a href="#third-party-scanners" id="third-party-scanners"></a>

The following are the list of third-party scanners that are categorized by **Scan Type** and **Target Type**. The list includes both commercial and open-source scanners.

{% tabs %}
{% tab title="Scan Type" %}
Here are the list of scanners supported by STO by scan type.

* [Static Application Security Testing - SAST Scanners](#static-application-security-testing---sast-scanners)
* [Secret Detection Scanners](#secret-detection-scanners)
* [Software Composition Analysis - SCA Scanners](#software-composition-analysis---sca-scanners)
* [Container Scanners](#container-scanners)
* [Dynamic Application Security Testing - DAST Scanners](#dynamic-application-security-testing---dast-scanners)
* [Infrastructure as Code - IaC Scanners](#infrastructure-as-code---iac-scanners)
* [AI Scanners](#ai-scanners)

In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step).

#### Static Application Security Testing - SAST Scanners <a href="#static-application-security-testing-sast-scanners" id="static-application-security-testing-sast-scanners"></a>

Static Application Security Testing (SAST) is a security testing practice that analyzes source code for potential vulnerabilities without executing the application. To configure and run SAST scans, refer [Static Application Security Testing documentation](/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/static-application-security-testing.md).

In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step).

#### Secret Detection Scanners <a href="#secret-detection-scanners" id="secret-detection-scanners"></a>

Secret Detection is a security testing practice that scans code repositories for exposed credentials, API keys, tokens, and other sensitive information. To configure and run secret detection scans, refer Secret Detection documentation.

In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step).

#### Software Composition Analysis - SCA Scanners <a href="#software-composition-analysis-sca-scanners" id="software-composition-analysis-sca-scanners"></a>

Software Composition Analysis (SCA) is a security testing practice that identifies vulnerabilities in open-source dependencies and third-party libraries used in your applications. To configure and run SCA scans, refer [Software Composition Analysis documentation](/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/software-composition-analysis.md).

In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step).

#### Container Scanners <a href="#container-scanners" id="container-scanners"></a>

Container Scanning is a security testing practice that analyzes your container images for potential vulnerabilities. To configure and run container scans, refer [Container Scanning documentation](/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/container-scanning/container-scanning.md).

In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step).

#### Dynamic Application Security Testing - DAST Scanners <a href="#dynamic-application-security-testing-dast-scanners" id="dynamic-application-security-testing-dast-scanners"></a>

Dynamic Application Security Testing (DAST) is a security testing practice that identifies vulnerabilities in running applications by simulating real-world attacks. To configure and run DAST scans, refer [Dynamic Application Security Testing documentation](/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/dynamic-application-security-testing.md).

In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step).

#### Infrastructure as Code - IaC Scanners <a href="#infrastructure-as-code-iac-scanners" id="infrastructure-as-code-iac-scanners"></a>

Infrastructure as Code (IaC) scanning is a security testing practice that analyzes IaC configurations to identify misconfigurations, security vulnerabilities, and compliance issues before deployment. To configure and run IaC scans, refer [Infrastructure as Code documentation](/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/infrastructure-as-code-scanning.md).

#### AI Scanners <a href="#ai-scanners" id="ai-scanners"></a>

AI Scanners are helps you to identify vulnerabilities in your ML models. To configure and run AI scanners, refer to [ModelScan](/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/modelscan.md) step documentation.

In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step).

***

{% endtab %}

{% tab title="Target Type" %}

***

{% endtab %}
{% endtabs %}

#### Scanners supported with Custom Scan step <a href="#scanners-supported-with-custom-scan-step" id="scanners-supported-with-custom-scan-step"></a>

The following scanners do not have a dedicated step in STO, but they can be used through the [Custom Scan step](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md).

If you are looking for scanners that are not available as steps or are not supported through the [Custom Scan](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) step, you can use the **Custom Ingest** step to import scan results into STO. For detailed instructions, see [Ingest results from unsupported scanners](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/ingesting-issues-from-other-scanners.md)

### Supported ingestion formats <a href="#supported-ingestion-formats" id="supported-ingestion-formats"></a>

Here are the scanners that support ingestion scan mode in STO and the data format each scanner expects for ingestion into STO.