DerScanner
| Developer(s) | DerSecur |
|---|---|
| Engine | |
| Type | Application security |
| Website | docs |
Search DerScanner on Amazon.
DerScanner is an application security testing tool developed by DerSecur. It is used to detect security vulnerabilities in software by analysing source code, compiled binaries, third-party components and web applications.[1]
Overview
DerScanner belongs to the class of application security testing tools used in secure software development and DevSecOps practices.[2] It combines several analysis techniques that are commonly employed to identify security weaknesses in software, including static and dynamic analysis, software composition analysis and binary analysis.
Types of analysis
Static application security testing (SAST)
DerScanner performs static analysis of software artefacts in order to detect potential security issues without executing the program, following the general approach described in Static application security testing.[3] Static analysis is typically used to find issues such as injection flaws, insecure data handling and improper error processing at the source code or intermediate representation level. Tools of this class are often compared with those listed in List of tools for static code analysis.[4]
Dynamic application security testing (DAST)
Dynamic analysis is carried out against a running application, following the approach described in Dynamic application security testing.[5] The tool interacts with the application as a black box by sending crafted HTTP or other protocol requests and analysing responses to identify vulnerabilities that only manifest at runtime, such as cross-site scripting (XSS), SQL injection, broken authentication and session management issues.
Software composition analysis (SCA)
DerScanner includes software composition analysis capabilities comparable to those described in Software composition analysis.[6] This type of analysis inspects third-party libraries and other dependencies for known vulnerabilities recorded in public vulnerability databases, such as Common Vulnerabilities and Exposures (CVE).[7] According to the vendor documentation, SCA results can be used both for vulnerability management and for generating software bills of materials.[1]
Binary analysis
In addition to source code analysis, DerScanner can examine compiled binaries or bytecode when source code is partially available or not available.[1] Binary analysis uses techniques from Static program analysis and Reverse engineering to locate potential security issues at the level of machine code or intermediate code.[8][9]
Software bill of materials (SBOM)
A Software bill of materials (SBOM) is a formal record of the components and dependencies that make up a software application.[10] According to DerScanner documentation, the tool can generate SBOMs for analysed projects as a by-product of software composition analysis, including for applications written in languages such as Delphi.[1]
Correlation of static and dynamic results
According to its documentation, DerScanner supports correlation between static and dynamic analysis results, linking findings that refer to the same underlying vulnerability in the application.[1] This can help reduce duplicate reports and assist security teams in prioritising remediation efforts. The general idea of combining multiple application security testing techniques is consistent with wider trends in application security and DevSecOps practices.[11]
Integration and usage
DerScanner is intended to be integrated into the software development lifecycle. It can be connected to version control systems and continuous integration / continuous delivery (CI/CD) pipelines so that security checks are executed automatically together with other quality assurance tasks.[1] It can also be used in a stand-alone mode to scan existing code bases or deployed applications.
Programming languages
According to its documentation, DerScanner supports a range of general-purpose and web programming languages, including both modern and legacy technology stacks that are commonly used in enterprise software.[1] Supported languages include:
configuration files and related formats
Delphi
The tool is therefore described as supporting a multi-language analysis model that covers both legacy enterprise platforms and newer application stacks.[1]
Features
DerScanner implements a set of functions that are typical for application security testing platforms, including:
- automated scanning of source code repositories and build artefacts;[1]
- reporting and classification of findings according to industry standards such as OWASP Top 10, Common Weakness Enumeration (CWE), Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS);[12][13][14][15]
- integration into issue tracking systems and CI/CD pipelines;[1]
- correlation of SAST and DAST findings within a single view;[1]
- analysis of binaries when source code is unavailable or incomplete;[1]
- generation of SBOMs based on dependency and component analysis.[1]
Recognition and partnerships
DerScanner has been mentioned in materials related to application security testing and source code analysis tools published by independent organisations and media outlets.
It is included in a list of source code security analyzers maintained by the United States National Institute of Standards and Technology (NIST).[16]
The cybersecurity news outlet The Last Watchdog reported that DerScanner was recognised in a Forrester report on static application security testing (SAST) tools.[17]
According to vendor and certification materials, DerScanner has also been associated with a security-related certification issued by the MITRE Corporation.[18]
DerScanner is additionally described as a technology partner of Embarcadero Technologies, the company behind the Delphi integrated development environment (IDE), with a focus on support for Delphi-based projects and ecosystems.[19]
See also
Static application security testing
Dynamic application security testing
Software composition analysis
Software bill of materials
DevSecOps
Application security
List of tools for static code analysis
References
- ↑ 1.00 1.01 1.02 1.03 1.04 1.05 1.06 1.07 1.08 1.09 1.10 1.11 1.12 "DerScanner documentation". DerScanner. Retrieved 2025-12-09.
- ↑ "DevSecOps". Wikipedia. Retrieved 2025-12-09.
- ↑ "Static application security testing". Wikipedia. Retrieved 2025-12-09.
- ↑ "List of tools for static code analysis". Wikipedia. Retrieved 2025-12-09.
- ↑ "Dynamic application security testing". Wikipedia. Retrieved 2025-12-09.
- ↑ "Software composition analysis". Wikipedia. Retrieved 2025-12-09.
- ↑ "Common Vulnerabilities and Exposures". Wikipedia. Retrieved 2025-12-09.
- ↑ "Static program analysis". Wikipedia. Retrieved 2025-12-09.
- ↑ "Reverse engineering". Wikipedia. Retrieved 2025-12-09.
- ↑ "Software bill of materials". Wikipedia. Retrieved 2025-12-09.
- ↑ "Application security". Wikipedia. Retrieved 2025-12-09.
- ↑ "OWASP". Wikipedia. Retrieved 2025-12-09.
- ↑ "Common Weakness Enumeration". Wikipedia. Retrieved 2025-12-09.
- ↑ "Common Vulnerabilities and Exposures". Wikipedia. Retrieved 2025-12-09.
- ↑ "Common Vulnerability Scoring System". Wikipedia. Retrieved 2025-12-09.
- ↑ "Source Code Security Analyzers". National Institute of Standards and Technology (NIST). Retrieved 2025-12-09.
- ↑ Acohido, Byron V. "News alert: DerSecur recognized in Forrester's Static Application Security Testing (SAST) report". The Last Watchdog. Retrieved 2025-12-09.
- ↑ "MITRE certification for DerScanner". MITRE. Missing or empty
|url=(help);|access-date=requires|url=(help) - ↑ "Technology partners". Embarcadero. Missing or empty
|url=(help);|access-date=requires|url=(help)
This article "DerScanner" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:DerScanner. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.
