Kiuwan Code Security is a cloud-based SAST platform that scans 30+ programming languages for security vulnerabilities and code quality issues. Founded in 2003 and now part of the Sembi portfolio (IDERA, Inc.), Kiuwan has over 20,000 users across 300+ organizations.
What is Kiuwan?
Kiuwan takes a hybrid approach to static analysis. The Local Analyzer runs on your machine or CI server and scans source code without sending it externally. Encrypted results then upload to the Kiuwan cloud, where the platform calculates metrics, generates reports, and provides team dashboards.
This means source code stays local while teams get centralized reporting, trend analysis, and collaboration features through the cloud interface.
Kiuwan maps findings to OWASP Top 10, CWE, SANS 25, PCI DSS, ISO 25000, CERT, and NIST standards. According to PCI DSS Requirement 6.3, organizations processing payment data must use application security testing to identify vulnerabilities in custom code, which Kiuwan’s compliance mapping directly addresses.
Key features
Legacy language support
Most modern SAST tools skip languages like COBOL, RPG4, ABAP, and Natural. Kiuwan supports them alongside modern languages, which matters for organizations running mixed technology stacks with mainframe applications.
| Category | Languages |
|---|---|
| Enterprise | Java, C#, VB.NET, COBOL, ABAP, RPG4, Natural |
| Web | JavaScript, PHP, Python, Ruby, Go, Perl |
| Mobile | Kotlin, Swift, Objective-C |
| Database | PL/SQL, Transact-SQL |
| Other | Groovy, Scala, Oracle Forms, Oracle Apex, JCL, PowerScript |
Technical debt tracking
Kiuwan calculates a technical debt score that estimates remediation effort in concrete terms. Development managers can set quality gates that block releases when debt passes a threshold.
The platform tracks how debt changes over time, so teams can see whether code health is improving or degrading.
Customizable rules
Kiuwan ships with thousands of built-in rules. Teams can enable or disable individual rules, adjust severity levels, create custom rules for internal standards, and share rule configurations across projects.
Getting started
When to use Kiuwan
Kiuwan works well for organizations with mixed technology stacks that include legacy languages. If your codebase spans COBOL, Java, JavaScript, and Python, Kiuwan gives you one scanning command and one dashboard instead of managing four separate tools.
For teams focused on a single modern language, specialized tools like Semgrep or SonarQube may provide deeper analysis. For enterprises needing broader security testing (DAST, IAST), consider platforms like Checkmarx or Fortify.
