What AppCheck Ltd does

AppCheck Ltd is a UK-based cybersecurity software vendor founded in 2009 and headquartered in Birstall (Leeds), providing automated Dynamic Application Security Testing (DAST) through a cloud-based vulnerability scanning platform. The platform detects security flaws across web applications, APIs, infrastructure, and cloud environments without requiring source code access, and is supplemented by proprietary technologies including the VulnFeed vulnerability database (updated hourly with hundreds of CVEs daily), the GoScript custom scripting language for modelling complex user journeys, and the Sentinel out-of-band detection system. AppCheck holds CVE Numbering Authority (CNA) status (granted 2021), ISO 27001:2022 accreditation, and ICO Data Protection registration, and operates an open API for integration with CI/CD and issue-tracking tools.

The company's product portfolio comprises core scanning modules — Web Application Scanning, Infrastructure Scanning, API Security Scanning, CMS Scanning, SPA Scanning, and SDLC Security Scanning — extended by modular capabilities including Asset Discovery (continuous external attack surface visibility), Trust Monitor (third-party and supply chain exposure tracking), and ThreatRadar (consolidated threat intelligence). It serves enterprise and public sector customers across financial services, healthcare, retail, higher education, and government, with named logos including JD Sports, Mars, Pret a Manger, Dr. Martens, NHS Leeds York, Network Rail, First Group, University of St Andrews, UK Sport, Age UK, Access Group, and Saint Gobain.

AppCheck generates revenue primarily through recurring SaaS subscription licences (per-asset or per-scan, typically annual enterprise contracts), supplemented by professional services for implementation, training, and remediation support, and by technology licensing to OEM partners such as Outpost24. Distribution combines a product-led growth motion (free trial via website) with enterprise field sales and a channel partner network including reseller CyberWhite and integration partner Peritus Cloud. In May 2026, AppCheck received a minority investment from LDC (the private equity arm of Lloyds Banking Group) to fund UK and international expansion; CEO Lloyd Devey and the existing management team remained in operational control, with LDC joining the board as non-executive directors.

Name

AppCheck Ltd

Legal name

AppCheck Ltd

Website

https://appcheck-ng.com

Company type

Private

Founded year

2009

Operating status

Operating

Headcount range

51–100 employees

Short description

AppCheck Ltd is a UK-based cybersecurity software vendor providing automated Dynamic Application Security Testing (DAST) for web applications, APIs, infrastructure, and cloud environments. It serves enterprise and public sector clients across financial services, healthcare, retail, higher education, and government via recurring SaaS subscriptions and OEM technology licensing.

Ownership category

akta.pro rank

Product category

Application Security Testing

NAICS

Computer Systems Design Services (541512), Computer Systems Design and Related Services (54151)

SIC

Services-Prepackaged Software (7372), Services-Testing Laboratories (8734)

akta.pro primary industry

Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC)

akta.pro secondary industry

API Security (Discovery, Testing, Runtime Protection) (HDADACAB)

Keywords

• Dynamic application security testing
• Vulnerability scanning platform
• Web application security
• API security testing
• Penetration testing automation

Headquarters

HQ city

Birstall

HQ country

United Kingdom

HQ region

Europe

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations

Revenue model

1. SaaS Subscription Licenses: Core revenue stream from recurring subscription licenses for access to the AppCheck DAST platform, typically sold on a per-asset or per-scan basis with annual billing cycles for enterprise customers.
2. Professional Services: Implementation, training, and ongoing support services provided alongside the core platform to assist enterprise customers with deployment and vulnerability remediation guidance.
3. Technology Licensing: Licensing of AppCheck's DAST technology to partners like Outpost24 who embed the scanning capabilities into their own security platforms.

Pricing tiers

Go-to-market motion4 records

Distribution channels4 records

Marketing channels4 records

Core offering

AppCheck Ltd provides a cloud-based Dynamic Application Security Testing (DAST) platform that automatically discovers and prioritizes security vulnerabilities across web applications, APIs, single-page applications, content management systems, and network infrastructure without requiring source code access. The platform supplements automated scanning with proprietary detection technologies including the VulnFeed vulnerability database, GoScript scripting for complex authentication flows, and Sentinel out-of-band detection, and is sold via SaaS subscriptions with optional professional services to enterprise and public sector customers.

Product overview

AppCheck Ltd offers a unified cloud-based cybersecurity platform that provides comprehensive automated vulnerability scanning across web applications, APIs, infrastructure, and cloud environments. The platform is built around its core Dynamic Application Security Testing (DAST) engine, supplemented by proprietary technologies including the VulnFeed vulnerability database (updated hourly), the GoScript custom scripting language for complex authentication flows, and the Sentinel out-of-band detection system. The product portfolio consists of multiple specialized scanning modules (Web Application, Infrastructure, API Security, CMS, and Single Page Application Scanning) that can be deployed across the SDLC. Advanced modules include Asset Discovery for continuous external attack surface visibility, Trust Monitor for third-party and supply chain exposure tracking, ThreatRadar for consolidated threat intelligence, and an Automated Penetration Testing capability. The platform integrates with development tools (Jira, TeamCity, Azure DevOps, Jenkins) via an open API and holds ISO 27001:2022 accreditation for information security management.

Differentiator

Problem solved

Functional benefit

Brands

• Asset Discovery: Continuous visibility layer that identifies and tracks external web estate including domains, subdomains, and internet-facing services.
• ThreatRadar
• Trust Monitor
• GoScript
• VulnFeed
• Sentinel

Products and services

• Web Application Scanning Dynamic application security testing (DAST) scanner that identifies vulnerabilities in web applications through automated crawling, fuzzing, and first-principles detection methodology without requiring source code access.
• Infrastructure Scanning Scanner that identifies security vulnerabilities and misconfigurations across network infrastructure, servers, and cloud services, including Post-Quantum weakness detection for SSL/TLS.
• API Security Scanning Dedicated API scanning tool that ensures complete coverage through complex authentication flows, parameter mining, client certificates, TOTP AWS request signing, and automatic authentication support for Swagger (Open API), GraphQL, and SOAP endpoints.
• CMS Security Scanning Scanner targeting content management system vulnerabilities including plugins, themes, and configurations for platforms such as WordPress and Joomla.
• Single Page Application (SPA) Scanning Browser-based crawler that scans Single Page Applications (SPAs) for security vulnerabilities, supporting modern authentication systems and complex JavaScript frameworks.
• SDLC Security Scanner Scanner designed for integration into the Software Development Life Cycle (SDLC), supporting development, staging, and production environments with continuous security testing.
• Asset Discovery Continuous visibility layer that automatically identifies and tracks external web estate assets including domains, subdomains, and internet-facing services, and discovers assets not covered by existing scans.
• Trust Monitor Third-party and supply chain exposure monitoring that continuously identifies, audits, and tracks external services, scripts, domains, and integrations connected to web applications.
• Automated Penetration Testing Advanced automated penetration testing capability that combines crawling, reasoning, and authentication to detect vulnerabilities typically requiring manual testing, including Insecure Direct Object Reference (IDOR).

Quantifiable outcome

• Recognized as 'Best Vulnerability Management Solution' - shortlisted finalist at SC Awards Europe 2022
• +1 more outcomes

Named customers12 records

Segments5 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration5 records

AI capability3 records

Feature5 records

Partnerships

Two partnerships are on record, tiered flagship and core.

• Outpost24flagshipTechnology or Integration · 25 November 2025Extended partnership where Outpost24 embeds AppCheck's DAST technology into its security platform. This technology integration allows Outpost24 to offer enhanced vulnerability scanning capabilities to their customer base. The partnership was announced on November 25, 2025.
• CyberWhitecoreChannel Partner/ Reseller/ DistributorCyberWhite is a channel partner and reseller of AppCheck's DAST security solutions, extending market reach and providing localized sales and support for customers.

Scale indicators4 records

Recent moves7 records

Expansion highlights6 records

Emerging players

• Indusface WAS: Indusface offers a web application scanning and vulnerability management platform serving enterprise customers with DAST capabilities. While smaller in scale, it competes with AppCheck in the DAST category with comparable automated web application security testing features.
• StackHawk: StackHawk is a developer-focused DAST platform emphasizing CI/CD integration and shift-left security testing. While smaller and focused on the developer persona, it competes with AppCheck in automated DAST scanning with comparable SDLC integration capabilities.

Direct peers

• Invicti: Invicti (formerly Netsparker) is a direct DAST competitor offering automated web application security scanning with proof-based scanning technology. Both companies target the same enterprise customers needing automated vulnerability detection for web applications and APIs, with comparable DAST-first positioning.
• Rapid7 InsightAppSec: Rapid7's InsightAppSec is a DAST solution integrated within the broader Insight platform serving enterprise security teams. Both companies compete in the DAST category serving similar enterprise customers with comparable web application vulnerability scanning capabilities.
• HCL AppScan: HCL AppScan is a long-standing enterprise DAST solution offering automated web application and API security testing. Both AppCheck and AppScan serve enterprise customers needing automated vulnerability scanning with comparable feature sets across DAST and API security testing.
• Detectify: Detectify is a crowdsourced DAST and external attack surface management platform built on ethical hacker research. Both companies compete in DAST with similar product-led growth motions and serve enterprise customers needing continuous web application vulnerability assessment.
• Outpost24: Outpost24 is a European-based exposure management and application security company that is both an AppCheck technology integration partner (OEM of AppCheck DAST engine) and a broader competitor offering ASM, vulnerability management, and application security. The partnership indicates overlapping product capabilities in the application security space.
• PortSwigger Burp Suite: PortSwigger's Burp Suite is the dominant tool for web application security testing, used by penetration testers and security professionals. While more pen-tester oriented than AppCheck's automated scanner approach, both serve the web application security testing use case for enterprise customers.

Broad incumbents

• Tenable Nessus and Web App Scanning: Tenable is a large established vulnerability management platform that includes DAST capabilities as part of its broader Tenable One exposure management platform. While it competes directly with AppCheck in DAST, Tenable's primary positioning is broader vulnerability management across infrastructure and cloud, with DAST as one component.
• Qualys VMDR: Qualys is a major cloud security and vulnerability management platform with web application scanning as part of its broader VMDR platform. Comparable to AppCheck in the DAST capability but operates as a broader security platform with much larger scale and enterprise footprint.

Market position

Strengths5 records

Weaknesses4 records

Competitive moat5 records

Key highlights7 records

Customer concentration

• Xx.com/appcheckng

Compliance4 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles10 records

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about AppCheck Ltd