Sat through a 90 minute SAST demo in Austin, then went with the free scanner instead
The vendor wanted $28k a year and the trial flagged the same 4 things our open source one did on a test repo. Curious if anyone here has actually seen paid SAST catch stuff free tools miss.
The $28k number is what gets me. When you ran both on that test repo, did the paid one give you anything besides the 4 findings, like a fix suggestion or a code path trace that the free tool skipped? I've noticed free scanners will tell you there's a hole but leave you hanging on how the data actually flows there. That gap is usually where the sales guy points when he says "you're paying for context.