Skip to content

Platform

By Role

CISORisk posture without the spreadsheet EngineersFindings where you already work Cloud OperationsCoverage across cloud and container scanners

Platform

Platform AI + Dojo Managed AppSec

By Solution

Vulnerability ManagementEvery finding tracked from intake to retest ASPMOne view of application security posture DevSecOpsFindings routed into the pipeline, no hand off SOCScanner findings and alerts in a single queue

Pen TestingRetests tracked in the same system of record PSIRTCVE impact, advisories, and disclosures ComplianceEvidence and SLAs without the spreadsheet CSPMCloud security posture, unified with AppSec

Integrations

500+ integrations, one source of truth

Every SAST, DAST, SCA, cloud, and container scanner in your stack, deduplicated into a single queue.

Dedup active Browse all integrations

SASTStatic analysis findings from your source code DASTDynamic scans of running applications

SCAVulnerabilities in open source dependencies Cloud & ContainerPosture and image findings across environments

CI/CDIngest results straight from the pipeline TicketingCreate and track remediation tickets automatically

Resources

Connect

CommunityJoin a global network of security professionals building best-in-class solutions for vulnerability management. EventsCheck out live events, upcoming features, and connect with other security professionals.

Learn

BlogAppSec practice, product news, and how-tos Case StudiesHow security teams run DefectDojo in production

WhitepapersDeeper research and guides for download NewsPress, announcements, and milestones

Featured

BlogOct 9, 2026 You're Being Misled About Mythos Read the post

Docs

Docs

DocumentationOfficial docs for the Pro and Open Source editions API ReferenceEvery endpoint, parameter, and response

Deployment GuidesInstall, configure, and scale your instance ChangelogWhat shipped in each release

Docs for both editions

Official documentation for DefectDojo Pro and Open Source editions, maintained by DefectDojo, Inc. and the Open Source community.

Pro + Community Search the docs

Company

Company

Why DefectDojoThe case for one system of record AboutWho we are and where we came from

PartnersPrograms for resellers and integrators

Reach out

Need some help? Pro users can send an email to support@defectdojo.com.

Contact us

Pricing

Get Started Ready to go Pro?Request a quote from the DefectDojo, Inc. team and be up and running this week. Request a quote See Pricing Tiers that scale with your team.Straightforward pricing with no per-scanner surprises. View tiers

Still not convinced?

Run the free one first.

Community Edition is the full open source platform, in production at 10,000+ organizations. Prove it in your stack, then bring the same system of record to Pro.

Free forever Get Community Edition

Login Book a demo

SCA

ONE CVE SHOULDN'T MEAN A THOUSAND ALERTS.

One CVE becomes one deduplicated finding, no matter how many repos it haunts.

DefectDojo parses every major software composition analysis tool into one data model, so results from different scanners are finally comparable. Run one SCA tool or five; the findings land in the same deduplicated queue. Vulnerabilities in your open source dependencies, with fix versions attached where they exist.

Browse all integrations

All Integrations54 Integration Guides

Every SCA Tool We Parse

If your scanner writes a report, DefectDojo reads it. Browse the full SCA catalog below; every parser normalizes into the same finding model.

AuditJS

SCA

View integration

Black Duck

SCA

View integration

bomber

SCA

View integration

Bundler-Audit

SCA

View integration

Calico Cloud Image Assurance

Cloud and Container

View integration

Cargo Audit

SCA

View integration

Checkmarx One

Cloud and Container

View integration

Codacy

SAST

View integration

CSAF

SCA

View integration

CycloneDX

SCA

View integration

Datadog Cloud Security

Cloud and Container

View integration

DeepSource

SAST

View integration

Dotnet Vulnerable Packages

SCA

View integration

Endor Labs

SCA

View integration

Finite State

SCA

View integration

FOSSA

SCA

View integration

GitHub Advanced Security

SAST

View integration

GitLab

Cloud and Container

View integration

Govulncheck

SCA

View integration

GuardDog

SCA

View integration

JFrog

SCA

View integration

Kiuwan

SAST

View integration

licensecheck

SCA

View integration

Mend (Formerly known as Whitesource)

SCA

View integration

Meterian

SCA

View integration

Mix Audit

SCA

View integration

Nancy

SCA

View integration

NetRise

SCA

View integration

Node Security Platform

SCA

View integration

NPM Audit

SCA

View integration

OpenVEX

SCA

View integration

OSV Scanner

SCA

View integration

OWASP Dependency Check

SCA

View integration

OWASP Dependency Track

SCA

View integration

PHP Symfony Security Check

SCA

View integration

pip-audit

SCA

View integration

pip-licenses

SCA

View integration

pnpm Audit

SCA

View integration

Qwiet AI

SAST

View integration

Retire.js

SCA

View integration

ReversingLabs

SCA

View integration

sbomqs

SCA

View integration

Scantist

SCA

View integration

Seal Security

SCA

View integration

Snyk

SCA

View integration

Socket

SCA

View integration

Sonatype

SCA

View integration

SOOS

SCA

View integration

Syft

SCA

View integration

uv audit

SCA

View integration

Veracode

SAST

View integration

Xeol

SCA

View integration

Xygeni

SAST

View integration

Yarn

SCA

View integration

Get your backlog to zero.

See DefectDojo run with your own stack. Thirty minutes with the technical team, not a sales pitch.

Built by the OWASP community, for the people who refuse to accept the status quo.

Platform

Overview
AI and Dojo
Managed AppSec
Integrations

Solutions

Vulnerability management
Application security posture
DevSecOps
Compliance

Resources

Blog
Community
Events
Case studies

Company

Why DefectDojo
About
Partners
Contact

© 2026 DefectDojo Inc. All Rights Reserved. Privacy Policy Trust Center DefectDojo Status

0000 0000