Draft:DefectDojo

DefectDojo, Inc.
Company type
Private
IndustryCybersecurity
Founded2013; 13 years ago (2013)
FoundersGreg Anderson
Matt Tesauro
HeadquartersAustin, Texas, U.S.
Key people
Greg Anderson (CEO)
Matt Tesauro (CTO)
ProductsDefectDojo (open source)
DefectDojo Pro
Websitedefectdojo.com

DefectDojo is an open-source application security and vulnerability management platform. Originally created in 2013 at Rackspace by Greg Anderson and Matt Tesauro, the project was publicly released as open-source software in 2015.[citation needed] The platform enables DevSecOps teams to aggregate, deduplicate, and manage security findings from more than 200 security tools, including static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA) scanners.[1] DefectDojo is an OWASP Flagship project.[1]

DefectDojo Inc., headquartered in Austin, Texas, develops and maintains both the open-source edition and a commercial version called DefectDojo Pro.[2]

History

Origins

DefectDojo originated in 2013 when Greg Anderson, then an intern working under Matt Tesauro at Rackspace, sought to address the difficulty of consolidating security testing results from multiple tools into a single platform.[3][4] Anderson developed the initial tool while working on Rackspace's application security team, and the project was released as open-source software in 2015 under the BSD 3-Clause License.[5]

After leaving Rackspace, Anderson and Tesauro worked together at Pearson, where they used DefectDojo to scale the company's application security program from scanning 44 applications per year to 414, an increase of 849 percent.[3]

OWASP Flagship status

DefectDojo was adopted as a project of the Open Worldwide Application Security Project (OWASP) Foundation and was designated a Flagship project, the highest project tier within the organization.[1] The project is featured in the OWASP Developer Guide as a recommended tool for vulnerability management.[6]

Incorporation and commercial product

Anderson incorporated DefectDojo Inc. (formerly known as 10Security) and launched DefectDojo Pro, a commercial edition offering enterprise scalability, a redesigned user interface, and additional integrations with platforms such as ServiceNow, GitHub, GitLab, and Azure DevOps.[2]

Funding

In September 2024, DefectDojo raised $7 million in a Series A funding round led by Iolar Ventures and Aspenwood Ventures.[2]

Technology

DefectDojo is written in Python using the Django web framework.[5] The platform uses a relational database (PostgreSQL or MySQL) for data storage and Celery for asynchronous task processing, including automated deduplication and synchronization with issue trackers.[6][5]

The platform's data model is organized around four core components: products, engagements, tests, and findings.[6] Security scan results can be imported from more than 200 tools, and the platform applies deduplication algorithms to reduce duplicate findings across different scanners.[1] DefectDojo provides a REST API for integration with CI/CD pipelines and other automation workflows.[5]

Key capabilities include:

  • Aggregation and deduplication of vulnerability findings from multiple sources
  • Risk-based prioritization and triage workflows
  • Bi-directional integration with Jira for issue tracking
  • Compliance reporting for standards such as PCI DSS
  • Endpoint and host management
  • Report generation and security program dashboards

Products

OWASP Edition (open source)

The open-source edition, released under the BSD 3-Clause License, provides the core vulnerability management platform including multi-tool aggregation, deduplication, remediation tracking, and API access.[5][1] It is self-hosted and can be deployed using Docker or Kubernetes.[5]

DefectDojo Pro

DefectDojo Pro is the commercial edition, available as a cloud-hosted software as a service (SaaS) or self-hosted deployment.[2]

Reception

DefectDojo is recognized on the Open Source Security Index as one of the most popular open-source security projects on GitHub.[1] As of February 2026, the project's GitHub repository has more than 4,500 stars and over 400 contributors.[5]

See also

References

  1. ^ a b c d e f "OWASP DefectDojo". OWASP Foundation. Retrieved 2026-02-11.
  2. ^ a b c d Kovacs, Eduard (2024-09-25). "DefectDojo Raises $7 Million for Application Security Platform". SecurityWeek. Retrieved 2026-02-11.
  3. ^ a b "Interview With Greg Anderson – CEO and Co-Founder of DefectDojo". Safety Detectives. Retrieved 2026-02-11.
  4. ^ "DefectDojo: Interview With Founder & CEO Greg Anderson About The DevSecOps And Vulnerability Management Company". Pulse 2.0. Retrieved 2026-02-11.
  5. ^ a b c d e f g "DefectDojo/django-DefectDojo". GitHub. Retrieved 2026-02-11.
  6. ^ a b c "DefectDojo – OWASP Developer Guide". OWASP Foundation. Retrieved 2026-02-11.

Category:Computer security software Category:Free security software Category:Free software programmed in Python Category:Software using the BSD license Category:Software companies based in Texas Category:Companies based in Austin, Texas Category:American companies established in 2013 Category:2013 software

Content Disclaimer

Informasi ini disarikan dari Wikipedia dan disajikan kembali untuk tujuan edukasi. Konten tersedia di bawah lisensi CC BY-SA 3.0. Kami tidak bertanggung jawab atas ketidakakuratan data yang bersumber dari kontribusi publik tersebut.

  1. The information displayed on this website is sourced in part or in whole from Wikipedia and has been adapted for the purpose of restating it. We strive to provide accurate and relevant information, however:
  2. There is no guarantee of absolute accuracy. Wikipedia is an open, collaborative project that can be edited by anyone, so information is subject to change.
  3. It is not intended to constitute professional advice. The content displayed is for informational and educational purposes only. For important decisions (e.g., medical, legal, or financial), please consult a professional.
  4. Content copyright. Wikipedia is licensed under the Creative Commons Attribution-ShareAlike License (CC BY-SA). This means that content may be reused with appropriate attribution and shared under a similar license.
  5. Responsible use. Any risk arising from the use of information from this website is entirely the responsibility of the user.