Supported Security Scanners
Supported scanners in STO
Harness STO supports over 40 security scanners, they are categorized as follows:
Harness Security Scanners: Scanners developed, maintained, and fully supported by Harness
Third-Party Scanners: External commercial or open-source scanners integrated with the Harness platform, not developed or directly maintained by Harness.
Open-Source Scanners: A subset of third-party scanners that are open-source.
Built-in Scanner Steps: Harness-provided scanner steps using pre-configured open-source scanners. These are ready-to-use within Harness pipelines and do not require additional commercial licenses. For a complete guide, refer to Built-in Scanners.
For a comprehensive list of all scanners, you can view them by Scan Type or Target Type further down this page.
Harness Security Scanners
Harness is expanding its native security scanning capabilities. These scanners are developed and maintained directly by Harness.
API DAST (previously Traceable): A Dynamic Application Security Testing scanner for your APIs. This was formerly known as the Traceable API DAST scanner.
SAST: A Static Application Security Testing scanner for your Code Repositories.
SCA: A Software Composition Analysis scanner for your Container Images.
Third-Party Scanners
The following are the list of third-party scanners that are categorized by Scan Type and Target Type. The list includes both commercial and open-source scanners.
Here are the list of scanners supported by STO by scan type.
In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.
Static Application Security Testing - SAST Scanners
Static Application Security Testing (SAST) is a security testing practice that analyzes source code for potential vulnerabilities without executing the application. To configure and run SAST scans, refer Static Application Security Testing documentation.
In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.
Secret Detection Scanners
Secret Detection is a security testing practice that scans code repositories for exposed credentials, API keys, tokens, and other sensitive information. To configure and run secret detection scans, refer Secret Detection documentation.
In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.
Software Composition Analysis - SCA Scanners
Software Composition Analysis (SCA) is a security testing practice that identifies vulnerabilities in open-source dependencies and third-party libraries used in your applications. To configure and run SCA scans, refer Software Composition Analysis documentation.
In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.
Container Scanners
Container Scanning is a security testing practice that analyzes your container images for potential vulnerabilities. To configure and run container scans, refer Container Scanning documentation.
In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.
Dynamic Application Security Testing - DAST Scanners
Dynamic Application Security Testing (DAST) is a security testing practice that identifies vulnerabilities in running applications by simulating real-world attacks. To configure and run DAST scans, refer Dynamic Application Security Testing documentation.
In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.
Infrastructure as Code - IaC Scanners
Infrastructure as Code (IaC) scanning is a security testing practice that analyzes IaC configurations to identify misconfigurations, security vulnerabilities, and compliance issues before deployment. To configure and run IaC scans, refer Infrastructure as Code documentation.
AI Scanners
AI Scanners are helps you to identify vulnerabilities in your ML models. To configure and run AI scanners, refer to ModelScan step documentation.
In addition to the listed supported scanners, the Custom Scan step allows the use of various other scanners. For a complete list of supported scanners, refer to Scanners Supported with Custom Scan Step.
Scanners supported with Custom Scan step
The following scanners do not have a dedicated step in STO, but they can be used through the Custom Scan step.
If you are looking for scanners that are not available as steps or are not supported through the Custom Scan step, you can use the Custom Ingest step to import scan results into STO. For detailed instructions, see Ingest results from unsupported scanners
Supported ingestion formats
Here are the scanners that support ingestion scan mode in STO and the data format each scanner expects for ingestion into STO.
Last updated
Was this helpful?