What Rainforest is
Rainforest combines all in one code vulnerable scanning with brand protection capabilities. They instrument via an on premise VM allowing you to scan everything in your own environment. The vendor site is www.rainforestqa.com. This profile is an entry in the oneNorma directory, not a vendor landing page.
What Rainforest covers
Rainforest is in the catalog for these capabilities. Categories: ASPM, IaC, SAST, SCA, and Container Vulnerability. Catalog tags: Best for Startups and Best for MidMarket.
How to evaluate Rainforest in a security program
Use Rainforest as a stack candidate, not as diligence evidence. The oneNorma score for Rainforest is 3.8/10 (percentile 9). If the real gap is in ASPM, IaC, SAST, SCA, and Container Vulnerability, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what www.rainforestqa.com publishes. Contrast it with pentesting and Security Cloud & Compliance.