Kiuwan
Kiuwan is a SaaS application security platform that provides static code analysis (SAST) and software composition analysis (SCA) to software development, security QA, and application security teams across 30+ programming languages, with hybrid-cloud and on-premise deployment.
- Company typePrivate
- Founded2005
- HeadquartersHouston, United States
- Headcount101–250
- GTM typeB2B
- OfferingSoftware
What Kiuwan does
Kiuwan is a SaaS-based application security platform that delivers Static Application Security Testing (SAST) and Software Composition Analysis (SCA) to software development teams, security QA engineers, and application security groups. Founded in 2005 and legally organized as Kiuwan Software S.L. in Spain, with operating presence in Houston, the company has operated for approximately 20 years and supports scanning across 30+ programming languages using a rule base of more than 4,300 checks aligned to OWASP Top 10, CWE/SANS-25, PCI-DSS, CERT, and SANS standards. Core offerings are Kiuwan Code Security (SAST) and Kiuwan Insights (SCA), complemented by Kiuwan Add-Ons for code quality and governance, a Local Analyzer for on-premise deployment, a Headless Scanner for CI/CD automation, and SBOM (CycloneDX) and SARIF export capabilities. Deployment is hybrid-cloud SaaS or fully on-premise, with IDE and CI/CD integrations plus a publicly documented REST API (Swagger/OpenAPI) for programmatic access.
The company monetizes primarily through recurring SaaS subscriptions and on-premise licenses, with pricing not publicly disclosed. GTM combines a 14-day product-led free trial, direct enterprise field sales for larger contracts, an active partner program for channel distribution, and an API-first motion for mid-market and platform-engineering buyers. Distribution is supported by content marketing (blog, knowledge hub, how-to videos, newsletter, YouTube), webinars and live demos, and documentation. Kiuwan operates within the Sembi DevOps tools portfolio alongside PreEmptive, Ranorex, and TestRail, and is enhanced by Sembi IQ, a parent-provided AI engine for intelligent quality analysis launched in 2024. The platform has been externally validated with a near 100% true-positive detection rate on the OWASP Benchmark test and is OWASP-accredited as a verified testing tool.
Kiuwan firmographics
Firmographics- Name
- Kiuwan
- Legal name
- Kiuwan Software S.L.
- Website
- https://kiuwan.com
- Company type
- Private
- Founded year
- 2005
- Operating status
- Operating
- Headcount range
- 101–250 employees
- Short description
- Kiuwan is a SaaS application security platform that provides static code analysis (SAST) and software composition analysis (SCA) to software development, security QA, and application security teams across 30+ programming languages, with hybrid-cloud and on-premise deployment.
- Ownership category
- akta.pro rank
Kiuwan industry classification
Industry- Product category
- Application Security Testing
- NAICS
- Computer Systems Design and Related Services (5415)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Application Security Testing (SAST/DAST/IAST/SCA) (HDADACAC)
- akta.pro secondary industry
- Software Supply Chain & Dependency Security (SBOM, Signing) (HDADACAD)
Keywords
Where Kiuwan is headquartered
LocationHeadquarters
- HQ city
- Houston
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
Kiuwan business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations
Revenue model
- SaaS Subscription: Cloud-based subscription model for Kiuwan Code Security platform accessible via web login. Customers pay recurring subscription fees for access to SAST, SCA, and governance tools.
- On-Premise License: Local analyzer deployment option for organizations requiring on-premise code analysis with secure local processing and cloud result sync.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Free 14-Day Trial |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels8 records
Kiuwan product offering
Product offeringCore offering
Kiuwan provides a SaaS application security platform that performs Static Application Security Testing (SAST) and Software Composition Analysis (SCA) across 30+ programming languages to detect code vulnerabilities, manage open-source component risk, and ensure license compliance during the software development lifecycle. The platform integrates with IDEs, CI/CD pipelines, and enterprise DevSecOps toolchains via a public REST API, with hybrid-cloud and on-premise deployment options for organizations requiring source code to remain on premise.
Product overview
Kiuwan is a code security platform offering a portfolio of complementary products for application security testing. The core offerings are Kiuwan Code Security (SAST) for static code analysis and vulnerability detection, and Kiuwan Insights (SCA) for open-source component and license management. These are complemented by Add-Ons for code quality and governance, a Local Analyzer for secure on-premise scanning, and a Headless Scanner for CI/CD automation. The platform supports 30+ programming languages, integrates with IDEs and CI toolchains, and generates SBOM and SARIF reports. Kiuwan operates as a hybrid-cloud or on-premise solution and is powered by Sembi IQ AI technology for intelligent quality analysis.
Differentiator
Problem solved
Functional benefit
Brands
- Code Security: Static Application Security Testing (SAST) product that identifies vulnerabilities in source code, compliant with CWE, OWASP, PCI, CERT, and SANS standards.
- Insights
- Kiuwan Code Security
Products and services
- Kiuwan Code Security
Quantifiable outcome
- Near 100% true positive detection in OWASP Benchmark testing
Companies that use Kiuwan
Customer profileNamed customers1 record
Segments3 records
Ideal customer profiles2 records
Kiuwan technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration4 records
AI capability3 records
Feature8 records
Kiuwan partnerships and signals
Strategic signalPartnerships
One partnership is on record.
- SembicoreKiuwan is part of the Sembi DevOps tools suite. Sembi provides the product logos and branding (Product_Logos_-_By_Sembi_KWN), indicating Kiuwan is an owned product within the Sembi ecosystem of developer and security tools.
Scale indicators4 records
Recent moves6 records
Expansion highlights5 records
Kiuwan competitors and assessment
Company assessmentDirect peers
- Mend (formerly WhiteSource): Mend provides SCA, SAST, and supply-chain security focused on open-source risk and license compliance. It is a direct competitor to Kiuwan Insights (SCA) and an adjacent competitor on SAST in the application security market.
- Checkmarx: Checkmarx is a leading commercial SAST platform (CxSAST) that also offers SCA and IaC security, targeting enterprise AppSec teams and developers. It is a direct competitor to Kiuwan Code Security on rule-based SAST, language coverage, and enterprise procurement motions.
- Veracode: Veracode provides SAST, SCA, DAST, and manual penetration testing as an integrated application security platform sold to enterprise security and development teams. It directly competes with Kiuwan on SAST/SCA breadth and on-premise/cloud deployment options for regulated buyers.
- Sonar (SonarQube): Sonar offers SonarQube and SonarCloud for continuous code quality and code security analysis (SAST) across 30+ languages, with IDE and CI/CD integrations. It is directly comparable to Kiuwan's SAST product and shares the polyglot, developer-embedded positioning.
- Snyk: Snyk is a developer-first security platform spanning SAST, SCA, IaC, and container security, sold to both developers and enterprise security teams. Its SCA (Snyk Open Source) directly overlaps Kiuwan Insights, and its SAST competes with Kiuwan Code Security.
Emerging players
- Semgrep: Semgrep is an open-source and commercial SAST platform emphasizing developer experience, fast scans, and customizable rules across many languages. It competes with Kiuwan Code Security for developer-led AppSec adoption and is gaining enterprise share.
Broad incumbents
- JFrog (including Xray / Advanced Security): JFrog offers Xray for SCA and software supply chain security, integrated with Artifactory for binary and dependency management. It is comparable to Kiuwan Insights on SCA, SBOM, and supply-chain risk management for enterprises.
- Fortify (OpenText / Micro Focus): Fortify (now part of OpenText) is an established enterprise SAST platform with on-premise and cloud deployment options, often used in regulated industries. It is a broader incumbent competitor to Kiuwan on enterprise SAST, especially in financial services and government.
- Synopsys (Coverity / Black Duck): Synopsys offers Coverity (SAST) and Black Duck (SCA) as part of a broad application security and software integrity portfolio serving large enterprises. It is a broader incumbent alternative to Kiuwan's combined SAST+SCA+Governance stack.
- GitHub Advanced Security: GitHub Advanced Security bundles Code Scanning (SAST), Dependabot (SCA), and secret scanning into the GitHub platform, sold primarily to enterprises standardizing on GitHub. It competes with Kiuwan on SAST/SCA embedded into developer workflows and platform-level procurement motions.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights7 records
Customer concentration
Kiuwan social profiles
Digital presenceKiuwan compliance and trust
Trust signalCompliance9 records
Kiuwan financial estimates
Financial estimateRevenue estimate
Valuation estimate
Kiuwan leadership team
Management profileNumber of profiles
Kiuwan funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Kiuwan M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Kiuwan
What does Kiuwan do?
Kiuwan provides a SaaS application security platform that performs Static Application Security Testing (SAST) and Software Composition Analysis (SCA) across 30+ programming languages to detect code vulnerabilities, manage open-source component risk, and ensure license compliance during the software development lifecycle. The platform integrates with IDEs, CI/CD pipelines, and enterprise DevSecOps toolchains via a public REST API, with hybrid-cloud and on-premise deployment options for organizations requiring source code to remain on premise.
Is Kiuwan a public or private company?
Kiuwan is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was Kiuwan founded?
Kiuwan was founded in 2005. It employs 101 to 250 people.
Where is Kiuwan based?
Kiuwan is headquartered in Houston, United States, in the North America region.
How does Kiuwan make money?
Two revenue lines are on record. SaaS Subscription is the primary driver. The others are on-Premise License.
Who are Kiuwan's main competitors?
Direct peers on record are Mend (formerly WhiteSource), Checkmarx, Veracode, Sonar (SonarQube) and Snyk. Semgrep is listed as an emerging player. Broad incumbents are JFrog (including Xray / Advanced Security), Fortify (OpenText / Micro Focus), Synopsys (Coverity / Black Duck) and GitHub Advanced Security.
Does Kiuwan have an API?
Yes. Kiuwan provides a comprehensive public REST API for interacting with its code security and analysis platform. The API supports application management, code analysis execution and retrieval, defect management, security vulnerability tracking, SCA (Insights) operations, user management, and audit/ delivery workflows. It uses HTTPS for all access via api.kiuwan.com domain. Authentication is via HTTP Basic Auth, with an additional X-KW-CORPORATE-DOMAIN-ID header required for Single Sign-On accounts. All data is sent and received as JSON. The API provides a Swagger/OpenAPI specification (kiuwan-rest-api.json) for client generation. Rate limiting is set to 1000 requests per hour per authenticated user. Supported languages for SDK examples include Java, JavaScript, C#, PHP, Perl, Python, and more. The API version is 2.8.2606.0. Developer documentation is at static.kiuwan.com/rest-api/kiuwan-rest-api.html.
What industry is Kiuwan in?
Kiuwan's product category is Application Security Testing. Its primary akta.pro industry code is HDADACAC, Application Security Testing (SAST/DAST/IAST/SCA), with a secondary code of HDADACAD, Software Supply Chain & Dependency Security (SBOM, Signing). Its NAICS code is 5415 and its SIC code is 7372.