PT Application Inspector is a SAST platform from Positive Technologies that combines SAST, DAST, IAST, and SCA in a single tool. It supports 15 programming languages and automatically generates safe exploit payloads to verify whether detected vulnerabilities are actually exploitable.
What is PT Application Inspector?
PT Application Inspector (PT AI) takes a different approach from most SAST tools by integrating four testing methodologies into one platform. Instead of managing separate static, dynamic, and composition analysis tools, PT AI runs them together and correlates the results.
The differentiator is automatic exploit generation. When static analysis finds a potential SQL injection or XSS vulnerability, PT AI constructs a safe test payload and executes it against the application.
If the exploit succeeds, the vulnerability is marked as verified. If defenses block it, the finding is downgraded.
Positive Technologies claims this reduces false positives without requiring manual triage.
PT AI uses abstract interpretation technology for its SAST engine, which distinguishes it from pattern-matching-only tools. Version 5.2 (October 2025) introduced custom analysis rules via a JSA (Just Static Analyzer) DSL for describing code semantics.
The tool was positioned as a Niche Player in the 2018 Gartner Magic Quadrant for Application Security Testing.
Key features
Language support
PT AI supports 15 programming languages. Language coverage has expanded across recent releases:
| Version | Languages Added |
|---|---|
| v4.0 (2022) | TypeScript |
| v4.7 (2024) | C#, C, C++, Objective-C, Ruby |
| v5.2 (2025) | Scala |
The full list: Java, C#, PHP, JavaScript, TypeScript, Python, Go, C/C++, Objective-C, Kotlin, Swift, Ruby, Scala, Solidity, and SQL.
Note: C/C++ and Objective-C scanning is not supported on macOS.
WAF integration
PT AI integrates with PT Application Firewall (PT AF) for virtual patching. When a vulnerability is detected but can’t be immediately fixed in code, PT AI automatically exports findings to the WAF, which generates rules to block exploit attempts in production.
Docker container scanning
Version 4.0 (April 2022) introduced Docker container support and a web-based interface. The SSDL Edition runs as a server application accessible through a browser.
IDE plugins
PT AI provides plugins for Visual Studio Code (v2.8.0, 3,400+ installs) and IntelliJ IDEA. The VS Code plugin performs static analysis, detects configuration errors, and scans third-party components for vulnerabilities directly in the editor.
Positive Technologies was sanctioned by the US Treasury Department in April 2021 and added to the Commerce Department Entity List in November 2021. This restricts the product from being sold to US entities.
The company operates primarily in Russia, CIS countries, India, and parts of Europe and Asia.
Getting started
When to use PT Application Inspector
PT AI fits organizations that want SAST, DAST, IAST, and SCA from a single vendor with automatic vulnerability verification. The integrated approach reduces tool sprawl and the exploit verification reduces manual triage effort.
Due to US sanctions on Positive Technologies, the tool is not available to US entities. Organizations outside the US that want consolidated security testing with verified findings should evaluate PT AI alongside alternatives like Checkmarx or Fortify.
