Application security products help users to identify software security flaws and can aid in prioritizing remediation efforts. These products are either dynamic and can scan a program externally while it is running (called black box testing) or are static source code testers (called white box testing, due to the user's ability to see the internal structure of the application). This study focuses on products and will not include revenues from professional services organizations.