DongTai IAST vs NowSecure Platform

DongTai IAST is an open-source tool for finding vulnerabilities in running Java applications and their third-party components. It examines application traffic as it runs, using method-call data and taint tracking across HTTP, HTTPS, and RPC requests; it does not rely on dedicated attack tests. The project lists Java, Python, PHP, and Go for detection, though the Python, PHP, and Go agents are beta and community-maintained beta agents may not deploy successfully. DongTai can analyze runtime data flows, prioritize verified findings by risk, and provide vulnerability tracing and reports. Its server also offers project and user management, notifications, a Web API, and custom vulnerability rules. Deployment options include SaaS, localized installation, Docker Compose, and Kubernetes. An IntelliJ IDEA plugin can run the Java probe and detect vulnerabilities in the IDE. The open-source self-hosted plan costs nothing. The project lists web runtime support and an Apache-2.0 license.

NowSecure Platform gives organizations visibility into security, privacy, AI, compliance, and software supply-chain risks in mobile apps they build, use, or manage. It analyzes compiled Android and iOS binaries and runs apps on physical devices to observe runtime behavior such as network activity, storage, permissions, and data movement. Findings can include decompiled code, data-flow traces, runtime captures, and the technique used to produce them. The platform checks static flags against runtime behavior, raising corroborated findings and lowering the priority of those that runtime tests cannot reproduce. It produces a CycloneDX mobile software bill of materials based on components observed in the shipped binary, and maps findings to OWASP MASVS controls, MASWE weaknesses, and MASTG testing techniques. NowSecure describes the platform as cloud-deployed and lists CI/CD, issue-tracking, security-tool, and Slack integrations, along with REST and GraphQL APIs. Its integrations page reports more than 200 integrations. Pricing is available on request, with no public price stated.