COBOL static code analysis
COBOL carries the business logic of payments, policies and ledgers. DerScanner scans .cbl, .cob and .cpy sources and returns the same finding list, severity and report as any modern service.
Legacy systems carry the same risk as new ones and need the same level of security as modern stack. Scan legacy code and back the result with reports auditors and regulators accept.
250B+
lines of COBOL still run in production
IBM, 2026
31%
of breaches start with an exploited vulnerability
Verizon DBIR 2026
55 days
to fix a high or critical application flaw
Edgescan 2026
43
languages covered by DerScanner
DerScanner
Securing the world's best teams
Which languages does DerScanner cover?
COBOL
ABAP
Delphi
Pascal
Perl
PL/SQL
T-SQL
LotusScript
Visual Basic
VB.NET
VBA
VBScript
ASP.NET
JSP
1C
Every language in the list is scanned by the same platform, with one severity scale and one report format.
Which checks run for which language?
| Language | Source code (SAST) | Binaries | Code quality | SBOM and dependencies (SCA) |
|---|---|---|---|---|
| COBOL, ABAP, LotusScript, 1C, Apex | — | — | — | |
| Delphi, Pascal | — | |||
| Perl, PL/SQL, T-SQL, VBA, VBScript, Visual Basic, VB.NET | — | — | VB.NET only | |
| Java, Kotlin, Scala | .class | — | ||
| C, C++ | .dll, .exe | — | ||
| C# | — | — | ||
| JavaScript, TypeScript | — | |||
| Python, Go, PHP, Ruby, Rust, Dart | — | — | ||
| Objective-C, Swift | .ipa | — | ||
| Groovy, Solidity, Vyper, HTML, Bash, PowerShell, YAML, TOML, XML | — | — | — | |
| Erlang | — | — |
What legacy coverage changes for the security team
Without legacy coverage
With DerScanner
The core system stays outside every scan
COBOL, Perl, Pascal & more go through the same static analysis as Java and Python
A separate tool and license per language
One platform, one license, one severity scale
Reports arrive in different formats from different tools
One report across all applications, exported in PDF, HTML, CSV or JSON
Source code has to leave the perimeter for an external service
Install on internal servers, on-premise or fully air-gapped
ABAP code security
ABAP runs inside SAP, where a flaw reaches finance and master data. Scans run on the source with no agent inside the SAP system, and findings land in the same project as the rest of the applications.
Delphi and Pascal
Delphi and Pascal run long-lived desktop and industrial applications. Both pass security analysis and code quality checks in the same project.
Teams already shipping with DerScanner
When looking for the scanner to build our secure development process on, we evaluated the capabilities of global leading vendors. We were surprised with the very convenient licensing model along with the capabilities of the product. DerScanner addresses our main challenge of checking the health of our product's code.
DerScanner discovered potential weaknesses that would have been difficult or even impossible to find, even in long-standing, mature code. I definitely recommend DerScanner if you are serious about the security of your code and the apps you create.
We use DerScanner to support our secure code review and SAST services. Its broad language support, reliable static analysis, and actionable findings help our consultants deliver consistent, high-quality security assessments.
Frequently asked questions
DerScanner covers 43 languages in one platform, from Java, Python, C# and Go to COBOL, Perl, Pascal & more. Smart contract languages Solidity and Vyper, scripting languages Bash and PowerShell, and configuration formats YAML, TOML and XML are included. Every language produces findings in the same format, with the same severity scale.
Yes. COBOL and ABAP go into a static analysis project the same way as any other language, and findings land in the same list, with severity, description, recommendations and code location. No conversion or migration of the source is needed. Reports cover legacy and modern applications side by side, so one audit file covers every application.
Code quality analysis runs for JavaScript, TypeScript, Delphi and Pascal. It highlights duplicates, outdated practices, and functions that grew too long or too complex. The scan starts in the Static Analysis tab, either together with the security scan or on its own. Results carry statuses and comments in the same way as security findings.
Yes, for the formats listed in the documentation: .dll and .exe for C and C++, .class for Java, .apk for Android, and .ipa for iOS applications. Binary analysis suits vendor software and applications whose source code sits with a contractor. Findings appear in the same project view as source code findings.
SCA builds an SBOM from manifests for Java, Kotlin, Scala, JavaScript, TypeScript, Python, C, C++, Go, PHP, Ruby, C#, VB.NET, Objective-C, Swift, Rust, Dart, Delphi and Erlang. Each ecosystem has its own manifest files, from pom.xml and package.json to Cargo.toml and rebar.config. The dependency list feeds vulnerability checks and the SBOM export.
No. The scanner reads the source as it is, in the repository or an archive, so the application stays where it runs. Scanning can start before any modernization decision and can run alongside a migration, which gives a before and after picture of the same code base.
Yes. DerScanner installs on-premise, including air-gapped networks. Source code, scan results and reports stay on internal servers, which matters for mainframe and core banking code that policy does not allow outside the perimeter.
Run a proof of concept on a legacy application
- Run a proof of concept on the oldest application in production.
- Install on internal servers, on-premise or fully air-gapped.
- Export the first report with findings from legacy and modern code side by side.
Prefer email? company@derscanner.com