| » Ideal for organizations: | Without internal application security expertise, building a traditional, web, or mobile application | Without internal application security expertise, building a traditional, web, or mobile application, and require a higher level of application security maturity through adoption of standards. | Without internal application security expertise, building a traditional, web, or mobile application, and require a higher level of application security maturity through adoption of standards and continuous threat modelling. |
| Technology | | | |
| » Code security analysis: | Find Sec Bugs (Java, Kotlin, Groovy, Scala), Bandit (Python), Brakeman (Ruby on Rails), SonarQube* | Find Sec Bugs (Java, Kotlin, Groovy, Scala), Bandit (Python), Brakeman (Ruby on Rails), SonarQube* | Find Sec Bugs (Java, Kotlin, Groovy, Scala), Bandit (Python), Brakeman (Ruby on Rails), SonarQube* |
| » 3rd party component vulnerability scanning: | OWASP Dependency Check, MergeBase scanner (unlimited scans)* | OWASP Dependency Check, MergeBase (unlimited scans, component level blocking)* | OWASP Dependency Check, MergeBase (unlimited scans, component level blocking)* |
| » Dynamic application security testing: | OWAP ZAP | OWAP ZAP | OWAP ZAP |
| » Infrastructure scanning: | OpenVAS, Nessus | OpenVAS, Nessus | OpenVAS, Nessus |
| » SSL/TLS configuration analysis: | SSLyze | SSLyze | SSLyze |
| People | | | |
| » Dedicated Subject Matter Expert + access to our Center of Excellence: | 12 hrs/month | 18 hrs/month | 24 hrs/month |
| Process | | | |
| » Security Training: | Secure development & threat modelling training (twice per year) | Secure development & threat modelling training (quarterly) | Secure development, threat modelling training and workshops (quarterly) |
| » Adoption of security requirements and processes (based on ASVS) | Basic | Standard | Advanced |