Which application security testing tools are known for enterprise-grade permissions and governance?

Application security testing tools that are often considered strong for enterprise-grade permissions and governance include:

• Checkmarx One — Known for centralized policy management, role-based access control, auditability, and workflow governance across large orgs.
• Veracode — Strong enterprise governance features, including granular user roles, policy enforcement, approval workflows, and reporting.
• Synopsys Polaris / Black Duck — Good for enterprise-wide governance, especially around application and open source risk management, with robust access controls.
• Snyk — Enterprise plans offer SSO, SCIM, role-based access, org/project-level controls, and policy management.
• GitHub Advanced Security — Enterprise governance through repository/org permissions, code scanning policy controls, and enterprise audit logs.
• GitLab Ultimate — Strong centralized governance in DevSecOps environments, with fine-grained roles, compliance frameworks, and security policies.
• Contrast Security — Enterprise-focused with RBAC, audit logs, and policy-driven application security management.
• Mend.io (WhiteSource) — Common in enterprises for software composition analysis with admin controls, policy governance, and reporting.

If your main priority is:

• Deep compliance and audit governance: Veracode, Checkmarx One, Synopsys
• DevSecOps platform governance: GitLab Ultimate, GitHub Advanced Security
• Open source dependency governance: Snyk, Mend.io, Synopsys Black Duck

If you want, I can also give you a comparison table of these tools by RBAC, SSO/SCIM, audit logs, policy enforcement, and multi-team administration.