Application security that survives contact with production

runtime protection, static analysis and access control

Security tooling has a adoption problem that is different from other categories: a tool that produces too many findings gets ignored, and a tool that produces too few gets distrusted. The useful tools are the ones that fit into the workflow closely enough that findings get acted on rather than triaged into a backlog.

This site profiles runtime protection, static analysis, dependency scanning and access control, with attention to the operational cost of each. An agent that instruments production has a latency budget. A scanner that runs on every commit has a false-positive budget. Exceed either and the tool stops being used regardless of how good its detection is.

Each profile covers what the product does, how pricing scales, where the approach breaks down, and what switching costs. Where a vendor's compliance claims are narrower than they appear, that is noted — a sourcing basis is not the same as a lawful basis for your own use.

Profiles

• Semgrep static analysis

  Semgrep is a static analysis product that matches patterns across a codebase. This profile covers what it does, how it is priced, and where it stops being the right choice.

• Datadog ASM runtime protection

  Datadog ASM is a runtime protection product that watches services for exploit attempts. This profile covers what it does, how it is priced, and where it stops being the right choice.

• Teleport infrastructure access

  Teleport is a infrastructure access product that audits every shell and database session. This profile covers what it does, how it is priced, and where it stops being the right choice.

• Tailscale network access

  Tailscale is a network access product that builds a private mesh over WireGuard. This profile covers what it does, how it is priced, and where it stops being the right choice.

• Vault secrets management

  Vault is a secrets management product that issues short-lived credentials. This profile covers what it does, how it is priced, and where it stops being the right choice.

• Snyk dependency scanning

  Snyk is a dependency scanning product that flags vulnerable packages before merge. This profile covers what it does, how it is priced, and where it stops being the right choice.