Application Security Testing (AST) platforms find and prioritize vulnerabilities in custom code, open-source dependencies, infrastructure-as-code templates, containers, and running applications — across the software development lifecycle and into production. The category spans multiple scan types: static code analysis (SAST), software composition analysis (SCA) for open-source dependencies, dynamic testing (DAST), interactive testing (IAST), secret detection, container and IaC scanning. Modern AST platforms unify these scanner types under a single policy and developer-workflow integration, and increasingly include Application Security Posture Management (ASPM) capabilities that consolidate findings across the portfolio, deduplicate alerts, and track program metrics. Leading vendors include Snyk, Veracode, Checkmarx, Black Duck (Synopsys), GitHub Advanced Security, Mend, and ASPM-centric platforms such as ArmorCode, Apiiro, and Cycode.