Of breaches involve the supply chain, up 60% year over year
Verizon DBIR 2026
Global average cost of a data breach, a record high
IBM Cost of a Data Breach Report 2026
Outbound connections required to run a full scan
Languages analyzed inside the perimeter
Analysis modules start on servers inside the network, pull the repository over an internal Git connection and write results to a database on the same network. The code never passes through a vendor endpoint at any stage of the scan.
DerTriage filters false positives and DerCodeFix writes fix suggestions, both on the same servers as the scanners and with no internet access needed. An AI policy review stops being a reason to switch the features off.
A license arrives as a file and loads through the admin panel. There is no activation endpoint for a firewall team to whitelist, and a certificate authority change cannot take the platform offline.
Every module writes event logs to the file system of the server it runs on, and security events forward over syslog to an internal collector. The audit trail lands where the SOC already looks.
Static analysis of the systems that rarely leave the internal network in the first place: core banking, ERP, plant control and records management.
The main module holds the interface, the API and the data on one server. SAST, DAST and SCA install next to it or on their own machines, and each one spreads across several servers once scans start queuing.
Each module arrives with the environment it needs to run. Setup and updates happen from that package, so an isolated server never reaches out to an external repository.
DerScanner connects to Jenkins, TeamCity and Azure DevOps, to Eclipse, IntelliJ IDEA and Visual Studio, and to Jira and SonarQube. A command line client covers whatever the list misses, and all of it stays inside the network.
LDAP connects DerScanner to the corporate directory, so accounts follow the joiner and leaver process already in place. Access is scoped per project, with read-only roles for auditors.
Static analysis across 43 languages, from legacy modules to modern services, running on changed files at every commit.
Runtime testing of web applications and their APIs against authentication, session handling and injection flaws.
Open-source dependencies resolved to full depth and checked against CVEs, with a CycloneDX SBOM generated on every scan.
iOS and Android applications, source and compiled package, checked for insecure storage, weak crypto and permission scope.
.dll, .exe, .ipa, .apk, .jar and .war deliverables scanned directly with no source code, and findings mapped to CWE and OWASP like any other.
False positives filtered against real exploitability data, so the queue reaching developers holds what actually matters.
Fix suggestions written inline against the surrounding code, so the developer applies the change without leaving the file.
Findings mapped to OWASP and CWE and exported as the evidence a review asks for, in PDF, HTML or CSV.
Hover any card to see how DerScanner handles it.
Select a framework to see what it requires and what DerScanner produces for it.
Security of processing under Art. 32, and conditions on transferring personal data outside the EEA under Art. 44 onward.
A deployment that holds source code and scan data inside the existing infrastructure, which removes the transfer from scope.
Deployment architecture description.
Security of processing under Art. 32, and conditions on transferring personal data outside the EEA under Art. 44 onward.
A deployment that holds source code and scan data inside the existing infrastructure, which removes the transfer from scope.
Deployment architecture description.
Classified and CUI networks carry no route to the public internet by design.
Scan classified code without moving it to a network that has one.
Talk to us about classified networksA regulator, an internal audit function and a third-party risk register all ask where the code goes.
Answer the ICT third-party question with a deployment diagram.
Talk to us about financial complianceSegmented industrial zones take new software through a controlled conduit, and nothing dials out.
Deploy into a segment without opening a conduit for the scanner.
Talk to us about industrial networksePHI, clinical systems and GxP-validated environments sit under data residency rules.
Scan ePHI-handling applications without moving data off site.
Talk to us about clinical systemsJoint development agreements decide where pre-production source code may travel.
Answer a confidentiality clause with the deployment diagram.
Talk to us about supplier codeTeams already shipping with DerScanner
When looking for the scanner to build our secure development process on, we evaluated the capabilities of global leading vendors. We were surprised with the very convenient licensing model along with the impressive capabilities of the product. DerScanner is an optimal solution to our main challenge of checking the health of our product's code.
DerScanner discovered potential weaknesses that would have been difficult or even impossible to find, even in long-standing, mature code. I definitely recommend DerScanner if you are serious about the security of your code and the apps you create.
We use DerScanner to support our secure code review and SAST services. Its broad language support, reliable static analysis, and actionable findings help our consultants deliver consistent, high-quality security assessments.
A scan produces nothing that leaves it. Analysis modules run on internal servers, results write to a database on the same network, and the AI agents execute on the same infrastructure. Licensing arrives as a file through the admin panel, so there is no activation server for a firewall team to whitelist.
Each module ships with a complete environment for its own operation: a containerized Docker environment, or a native JDK-11 runtime for the Windows and macOS C/C++ analysis modules. The distribution package is transferred into the network once, and every installation and update runs from it, so an isolated host needs no access to a package mirror.
The main module carries the web interface, the API and the data, runs on a single server and holds the license. SAST, DAST and SCA are optional and install alongside it or on separate servers. Additional modules cover C, C++ and Objective-C on Windows and macOS, and the Builder module handles custom builds for Java, Scala and Kotlin projects.
SAST, DAST and SCA each install on several servers at once, so throughput rises by adding hardware. The number of servers and modules changes after the initial deployment without a reinstall.
Yes. DerTriage and DerCodeFix are DerScanner's own modules, available locally with no internet access required, and both can be permanently disabled if policy calls for it. Neither the code nor the findings reach a third-party model.
LDAP configuration connects DerScanner to the corporate directory, so accounts follow the existing joiner and leaver process. Access is scoped per project and includes read-only roles for internal audit and external assessors.
Modules write event logs to the file system of the server they run on, separated by level from error through debug. Security events forward over syslog to an internal collector.
Vendor security assessment materials are available on request at company@derscanner.com, covering the deployment architecture and the data flows inside it. Procurement and third-party risk functions use them to complete a supplier review without a discovery call.
Request a demo, or run a proof of concept on one codebase inside the environment that has to stay isolated. The restricted segment answers the deployment question that a connected trial leaves open.
Prefer email? company@derscanner.com