> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/new-to-sto/sto-whats-supported/scanners.md). # Supported Security Scanners Harness STO supports over 40 security scanners, they are categorized as follows: * [**Harness Security Scanners**](#harness-security-scanners): Scanners developed, maintained, and fully supported by Harness * [**Third-Party Scanners**](#third-party-scanners): External commercial or open-source scanners integrated with the Harness platform, not developed or directly maintained by Harness. * **Open-Source Scanners**: A subset of third-party scanners that are open-source. * [**Built-in Scanner Steps**](/security-testing-orchestration/use-sto/set-up-sto-scans/built-in-scanners.md): Harness-provided scanner steps using pre-configured open-source scanners. These are ready-to-use within Harness pipelines and do not require additional commercial licenses. For a complete guide, refer to [Built-in Scanners](/security-testing-orchestration/use-sto/set-up-sto-scans/built-in-scanners.md). For a comprehensive list of all scanners, you can view them by [**Scan Type**](#third-party-scanners) or [**Target Type**](#third-party-scanners) further down this page. #### Harness Security Scanners Harness is expanding its native security scanning capabilities. These scanners are developed and maintained directly by Harness. * [**API DAST**](/security-testing-orchestration/use-sto/sto-scanner-configuration/traceable-step-configuration.md) (*previously Traceable*): A Dynamic Application Security Testing scanner for your APIs. This was formerly known as the **Traceable API DAST** scanner. * [**SAST**](/security-testing-orchestration/use-sto/harness-security-scanners/sast.md): A Static Application Security Testing scanner for your Code Repositories. * [**SCA**](/security-testing-orchestration/use-sto/harness-security-scanners/sca.md): A Software Composition Analysis scanner for your Container Images. #### Third-Party Scanners The following are the list of third-party scanners that are categorized by **Scan Type** and **Target Type**. The list includes both commercial and open-source scanners. {% tabs %} {% tab title="Scan Type" %} Here are the list of scanners supported by STO by scan type. * [Static Application Security Testing - SAST Scanners](#static-application-security-testing---sast-scanners) * [Secret Detection Scanners](#secret-detection-scanners) * [Software Composition Analysis - SCA Scanners](#software-composition-analysis---sca-scanners) * [Container Scanners](#container-scanners) * [Dynamic Application Security Testing - DAST Scanners](#dynamic-application-security-testing---dast-scanners) * [Infrastructure as Code - IaC Scanners](#infrastructure-as-code---iac-scanners) * [AI Scanners](#ai-scanners) In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step). #### Static Application Security Testing - SAST Scanners Static Application Security Testing (SAST) is a security testing practice that analyzes source code for potential vulnerabilities without executing the application. To configure and run SAST scans, refer [Static Application Security Testing documentation](/security-testing-orchestration/use-sto/set-up-sto-scans/static-application-security-testing.md). 1. [**Harness Code**](/security-testing-orchestration/use-sto/harness-security-scanners/sast.md) 2. [**Bandit**](/security-testing-orchestration/use-sto/sto-scanner-configuration/bandit-scanner-reference.md) - *open-source* 3. [**Black Duck**](/security-testing-orchestration/use-sto/sto-scanner-configuration/black-duck-hub-scanner-reference.md) (by Synopsys) 4. [**Brakeman**](/security-testing-orchestration/use-sto/sto-scanner-configuration/brakeman-scanner-reference.md) - *open-source* 5. [**Checkmarx**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarx-scanner-reference.md) 6. [**Checkmarx One**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarxone-scanner-reference.md) 7. [**Coverity**](/security-testing-orchestration/use-sto/sto-scanner-configuration/coverity-scanner-reference.md) - *open-source* 8. [**CodeQL**](/security-testing-orchestration/use-sto/sto-scanner-configuration/codeql-scanner-reference.md) 9. [**FOSSA**](/security-testing-orchestration/use-sto/sto-scanner-configuration/fossa-scanner-reference.md) 10. [**GitHub Advanced Security**](/security-testing-orchestration/use-sto/sto-scanner-configuration/github-advanced-security.md) 11. [**Mend**](/security-testing-orchestration/use-sto/sto-scanner-configuration/mend-scanner-reference.md) (formerly known as WhiteSource) 12. [**Semgrep**](/security-testing-orchestration/use-sto/sto-scanner-configuration/semgrep/semgrep-scanner-reference.md) - *open-source option* 13. [**Snyk**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md) 14. [**SonarQube**](/security-testing-orchestration/use-sto/sto-scanner-configuration/sonarqube-sonar-scanner-reference.md) 15. [**Veracode**](/security-testing-orchestration/use-sto/sto-scanner-configuration/veracode-scanner-reference.md) 16. [**Wiz**](/security-testing-orchestration/use-sto/sto-scanner-configuration/wiz/repo-scans-with-wiz.md) In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step). #### Secret Detection Scanners Secret Detection is a security testing practice that scans code repositories for exposed credentials, API keys, tokens, and other sensitive information. To configure and run secret detection scans, refer Secret Detection documentation. 1. [**Harness Code**](/security-testing-orchestration/use-sto/harness-security-scanners/sast.md) 2. [**Aqua Trivy**](/security-testing-orchestration/use-sto/sto-scanner-configuration/trivy/aqua-trivy-scanner-reference.md) - *open-source* 3. [**Checkmarx One**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarxone-scanner-reference.md) 4. [**Gitleaks**](/security-testing-orchestration/use-sto/sto-scanner-configuration/gitleaks-scanner-reference.md) - *open-source* 5. [**GitHub Advanced Security**](/security-testing-orchestration/use-sto/sto-scanner-configuration/github-advanced-security.md) In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step). #### Software Composition Analysis - SCA Scanners Software Composition Analysis (SCA) is a security testing practice that identifies vulnerabilities in open-source dependencies and third-party libraries used in your applications. To configure and run SCA scans, refer [Software Composition Analysis documentation](/security-testing-orchestration/use-sto/set-up-sto-scans/software-composition-analysis.md). 1. [**Harness Container**](/security-testing-orchestration/use-sto/harness-security-scanners/sca.md) 2. [**Aqua Trivy**](/security-testing-orchestration/use-sto/sto-scanner-configuration/trivy/aqua-trivy-scanner-reference.md) - *open-source* 3. [**Checkmarx**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarx-scanner-reference.md) 4. [**Checkmarx One**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarxone-scanner-reference.md) 5. [**GitHub Advanced Security**](/security-testing-orchestration/use-sto/sto-scanner-configuration/github-advanced-security.md) 6. [**OSV Scanner**](/security-testing-orchestration/use-sto/sto-scanner-configuration/osv-scanner-reference.md) - *open-source* 7. [**OWASP Dependency-Check**](/security-testing-orchestration/use-sto/sto-scanner-configuration/owasp-scanner-reference.md) - *open-source* 8. [**Snyk**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-code-scanning.md) 9. [**Veracode**](/security-testing-orchestration/use-sto/sto-scanner-configuration/veracode-scanner-reference.md) 10. [**Wiz**](/security-testing-orchestration/use-sto/sto-scanner-configuration/wiz/repo-scans-with-wiz.md) In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step). #### Container Scanners Container Scanning is a security testing practice that analyzes your container images for potential vulnerabilities. To configure and run container scans, refer [Container Scanning documentation](/security-testing-orchestration/use-sto/set-up-sto-scans/container-scanning/container-scanning.md). 1. [**Anchore**](/security-testing-orchestration/use-sto/sto-scanner-configuration/anchore-enterprise-scanner-reference.md) 2. [**Aqua Security**](/security-testing-orchestration/use-sto/sto-scanner-configuration/aquasec-scanner-reference.md) 3. [**Aqua Trivy**](/security-testing-orchestration/use-sto/sto-scanner-configuration/trivy/aqua-trivy-scanner-reference.md) *- open-source* 4. [**AWS ECR Scan**](/security-testing-orchestration/use-sto/sto-scanner-configuration/aws-ecr-scanner-reference.md) 5. [**Black Duck**](/security-testing-orchestration/use-sto/sto-scanner-configuration/black-duck-hub-scanner-reference.md) 6. [**Checkmarx One**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarxone-scanner-reference.md) 7. [**Grype**](/security-testing-orchestration/use-sto/sto-scanner-configuration/grype/grype-scanner-reference.md) - *open-source* 8. [**Prisma Cloud**](/security-testing-orchestration/use-sto/sto-scanner-configuration/prisma-cloud-scanner-reference.md) 9. [**Snyk**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md) 10. [**Sysdig**](/security-testing-orchestration/use-sto/sto-scanner-configuration/sysdig-scanner-reference.md) 11. [**Wiz**](/security-testing-orchestration/use-sto/sto-scanner-configuration/wiz/artifact-scans-with-wiz.md) In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step). #### Dynamic Application Security Testing - DAST Scanners Dynamic Application Security Testing (DAST) is a security testing practice that identifies vulnerabilities in running applications by simulating real-world attacks. To configure and run DAST scans, refer [Dynamic Application Security Testing documentation](/security-testing-orchestration/use-sto/set-up-sto-scans/dynamic-application-security-testing.md). 1. [**Burp Suite Enterprise Edition**](/security-testing-orchestration/use-sto/sto-scanner-configuration/burp-scanner-reference.md) 2. [**Checkmarx One**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarxone-scanner-reference.md) 3. [**Nikto**](/security-testing-orchestration/use-sto/sto-scanner-configuration/nikto-scanner-reference.md) *- open-source* 4. [**Nmap**](/security-testing-orchestration/use-sto/sto-scanner-configuration/nmap-scanner-reference.md) *- open-source* 5. [**Traceable**](/security-testing-orchestration/use-sto/sto-scanner-configuration/traceable-step-configuration.md) 6. [**Veracode**](/security-testing-orchestration/use-sto/sto-scanner-configuration/veracode-scanner-reference.md) 7. [**Zap**](/security-testing-orchestration/use-sto/sto-scanner-configuration/zap/zap-scanner-reference.md) *- open-source* In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step). #### Infrastructure as Code - IaC Scanners Infrastructure as Code (IaC) scanning is a security testing practice that analyzes IaC configurations to identify misconfigurations, security vulnerabilities, and compliance issues before deployment. To configure and run IaC scans, refer [Infrastructure as Code documentation](/security-testing-orchestration/use-sto/set-up-sto-scans/infrastructure-as-code-scanning.md). 1. [**Checkmarx One**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarxone-scanner-reference.md) 2. [**Checkov**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkov-iac-scan.md) - *open-source* 3. [**Snyk**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-iac-scanning.md) 4. [**Wiz**](/security-testing-orchestration/use-sto/sto-scanner-configuration/wiz/iac-scans-with-wiz.md) #### AI Scanners AI Scanners are helps you to identify vulnerabilities in your ML models. To configure and run AI scanners, refer to [ModelScan](/security-testing-orchestration/use-sto/sto-scanner-configuration/modelscan.md) step documentation. In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step). *** {% endtab %} {% tab title="Target Type" %} The following sections describe the scanners supported by Harness STO, based on the target type: * [Code repo scanners](#code-repo-scanners) * [Artifact scanners](#artifact-scanners) * [Instance scanners](#instance-scanners) * [Configuration scanners](#configuration-scanners) * [Other scanners](#other-scanners) In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](/security-testing-orchestration/new-to-sto/sto-whats-supported/scanners.md#scanners-supported-with-custom-scan-step). **Code repo scanners** A code scanner can detect one or more of the following issue types in your source code. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation. * **SAST (Static Application Security Testing):** Known vulnerabilities in open-source and proprietary code. * **SCA (Software Composition Analysis):** Known vulnerabilities in open-source libraries and packages used by the code. * **Secrets:** Hard-coded secrets such as access keys and passwords. * **IaC:** Known vulnerabilities in Infrastructure-as-Code files such as Terraform configurations. * **Misconfigurations:** Known vulnerabilities in software configurations. | Open Source | Commercial | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | | **Artifact scanners** An artifact scanner can detect one or more of the following issue types in your container images and other artifacts. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation. * **SCA (Software Composition Analysis):** Known vulnerabilities in open-source libraries and packages used by the code. * **Container Scanning:** Identify vulnerabilities in container images. | Open Source | Commercial | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | | **Instance scanners** An instance scanner scans a running application for vulnerabilities by simulating a malicious external actor exploiting known vulnerabilities. This is also known as a DAST (Dynamic Application Security Testing) scan. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation. | Open Source | Commercial | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | | **Configuration scanners** The following scanners detect misconfigurations in your cloud environment that can result in vulnerabilities. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation. | Open Source | Commercial | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | | | **Other scanners** If you use a scanner that isn't listed above, you can still ingest your scan results into STO. * If your scanner can publish to SARIF format, go to [Ingest SARIF scan results into STO](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/ingest-sarif-data.md). * For other scanners, go to [Ingest results from unsupported scanners](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/ingesting-issues-from-other-scanners.md). *** {% endtab %} {% endtabs %} #### Scanners supported with Custom Scan step The following scanners do not have a dedicated step in STO, but they can be used through the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md). 1. [**Clair**](/security-testing-orchestration/use-sto/sto-scanner-configuration/clair-scanner-reference.md) 2. [**Data Theorem**](/security-testing-orchestration/use-sto/sto-scanner-configuration/data-theorem-scanner-reference.md) 3. [**Docker Content Trust**](/security-testing-orchestration/use-sto/sto-scanner-configuration/docker-content-trust-dct-scanner-reference.md) 4. [**Fortify Static Code Analyzer**](/security-testing-orchestration/use-sto/sto-scanner-configuration/fortify-scanner-reference.md) 5. [**Fortify on Demand**](/security-testing-orchestration/use-sto/sto-scanner-configuration/fortify-on-demand-scanner-reference.md) 6. [**HCL AppScan**](/security-testing-orchestration/use-sto/sto-scanner-configuration/hql-appscan-scanner-reference.md) 7. [**Metasploit**](/security-testing-orchestration/use-sto/sto-scanner-configuration/metasploit-scanner-reference.md) *- open-source* 8. [**Nessus**](/security-testing-orchestration/use-sto/sto-scanner-configuration/nessus-scanner-reference.md) 9. [**Nexus**](/security-testing-orchestration/use-sto/sto-scanner-configuration/nexus-scanner-reference.md) 10. [**OpenVAS**](/security-testing-orchestration/use-sto/sto-scanner-configuration/openvas-scanner-reference.md) *- open-source* 11. [**Qualys Web Application Scanning**](/security-testing-orchestration/use-sto/sto-scanner-configuration/qualys-web-app-scanner-reference.md) 12. [**Reapsaw**](/security-testing-orchestration/use-sto/sto-scanner-configuration/reapsaw-scanner-reference.md) - *open-source* 13. [**ScoutSuite**](/security-testing-orchestration/use-sto/sto-scanner-configuration/scoutsuite-scanner-reference.md) - *open-source* 14. [**Tenable**](/security-testing-orchestration/use-sto/sto-scanner-configuration/tenable-scanner-reference.md) 15. [**Veracode**](/security-testing-orchestration/use-sto/sto-scanner-configuration/veracode-scanner-reference.md) 16. [**JFrog Xray**](/security-testing-orchestration/use-sto/sto-scanner-configuration/xray-scanner-reference.md) If you are looking for scanners that are not available as steps or are not supported through the [Custom Scan](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) step, you can use the **Custom Ingest** step to import scan results into STO. For detailed instructions, see [Ingest results from unsupported scanners](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/ingesting-issues-from-other-scanners.md) ### Supported ingestion formats Here are the scanners that support ingestion scan mode in STO and the data format each scanner expects for ingestion into STO. {% hint style="info" %} Static Analysis Results Interchange Format (SARIF) is an open JSON format supported by many scan tools, especially tools available as GitHub Actions. Harness STO can [ingest SARIF 2.1.0 data](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/ingest-sarif-data.md) from any tool that supports this format. Harness recommends that you publish and ingest using the scanner-specific JSON format when available, because it tends to include more useful information. {% endhint %} * **Anchore Enterprise** — JSON * **Aqua Security** — JSON * **Aqua Trivy** — JSON *(recommended)*, SARIF * **AWS ECR** — JSON * **AWS Security Hub** — JSON * **Bandit** — JSON *(recommended)*, SARIF * **Black Duck Hub** — JSON * **Brakeman** — JSON * **Burp** — XML * **Traceable** — JSON * **Checkmarx** — XML, SARIF * **CheckmarxOne** — JSON * **CodeQL** — SARIF * **Coverity** — XML * **Data Theorem** — JSON * **Docker Content Trust** — JSON * **Fortify** — JSON * **Fortify on Demand** — JSON * **Fossa** — JSON * **Gitleaks** — JSON *(recommended)*, SARIF * **GitHub Advanced Security** — SARIF * **HQL AppScan** — XML * **Grype** — JSON * **Mend *****(formerly Whitesource)*** — JSON * **ModelScan** — JSON * **Nessus** — XML * **Nexus** — JSON * **Nikto** — XML * **Nmap** — XML * **OpenVAS** — JSON * **OWASP Dependency Check** — JSON * **Prisma Cloud** — JSON * **Prowler** — JSON * **Qualys** — XML * **Reapsaw** — JSON * **Semgrep** — SARIF * **Snyk** — JSON *(recommended)*, SARIF * **SonarQube** — JSON * **Sysdig** — JSON * **Tenable** — JSON * **Veracode** — XML * **JFrog Xray** — JSON * **Wiz** - JSON *(recommended)*, SARIF * **Zed Attack Proxy (ZAP)** — JSON * **Checkov** - JSON, SARIF