Applicationscan

Applicationscan refers to the practice and set of tools used to scan software applications for security vulnerabilities, compliance issues, and quality problems throughout the software development life cycle. It aims to identify weaknesses in web, mobile, and desktop applications before deployment.

The practice encompasses several analysis modalities: static application security testing (SAST), which analyzes source code, bytecode, or binaries without execution; dynamic application security testing (DAST), which tests a running application by interacting with it; interactive application security testing (IAST), which combines both during execution; and software composition analysis (SCA), which inventories third-party libraries and components to identify known vulnerabilities and licensing risks.

In practice, applicationscan tools are integrated into development and security workflows, used in CI/CD pipelines, staging environments, and manual assessments. Findings are reported with severities, affected components, vulnerability details, and remediation guidance, often mapped to standard scoring like CVSS.

Limitations include false positives, incomplete coverage, environmental differences between test and production, and dependence on the scanner’s signature sets and heuristics. Scanners complement but do not replace manual testing, threat modeling, and secure design reviews.

Notable examples include IBM AppScan, among other vendors offering SAST, DAST, IAST, and SCA solutions.

See also: static analysis, dynamic analysis, software composition analysis, application security.