ASPM
Application security posture management
A tool category that collects findings from SAST, SCA, secrets, IaC and DAST scanners, removes duplicates and ranks them by owner and risk; it detects nothing its scanners miss.
Covered in
Guide
Choose and evaluate application security testing tools
What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.
Guide
Choose cloud security posture tools and apply zero trust
What CSPM, CWPP, CIEM, CNAPP, DSPM and ASPM each find and miss, how they overlap, how to evaluate one on your own accounts, and how zero trust as defined in NIST SP 800-207 uses what they measure.
Practice: Local project: Repair a security pipeline for GitHub Actions and GitLab CI