# Best DAST Solutions for Business (2026)

Compare 7 DAST solutions, like PortSwigger Burp Suite DAST, Invicti and Rapid7, on login and API scanning, false positives and CI/CD fit for your apps.

We pick every solution on this list [on merit](https://cybersectools.com/methodology#shortlist-order). Featured vendors that made the list are shown first.

Source: https://cybersectools.com/shortlists/best-dast-solutions
Updated: 2026-11-01
Edition: Fall 2026.
Reviewed by Nika (Nikoloz) Kokhreidze, CybersecTools.

## Executive summary

As of November 2026, CybersecTools tracks 303 companies that sell application security solutions as their main business. Dynamic Application Security Testing is part of that family. The largest groups are based in the United States, Israel and the United Kingdom. In the last 12 months they raised $1.3B across 53 funding rounds, 14 companies were acquired and 40 new companies started in the last two years.

From that field we chose seven solutions that test your running web apps and APIs from the outside, the way an attacker would. PortSwigger Burp Suite DAST suits security teams that want automated scanning built on the scanner many testers already know. Invicti fits teams that want proof that a flaw is real before developers spend time on it. Rapid7 InsightAppSec suits teams that want quick setup and a clear dashboard.

The main choice is how scanning fits your delivery process. Some products run inside your CI/CD pipeline on every change. Others suit scheduled scans run by a security team.

Ask how each product handles login, single-page apps and APIs. Those are the areas where scanners differ the most from each other.

## How we evaluated

We looked at 90 dynamic application security testing solutions from 48 companies, and the 7 on this page made the cut. We combined our judgment from years of leading enterprise security programs with market data from [Mandos](https://mandos.io/data/companies?utm_source=cybersectools.com&utm_medium=shortlist), our market intelligence platform, and with the vendor and review pages listed under Sources at the end of this page. For customer feedback, we left out paid reviews, reviews by vendor staff or partners, review campaigns and anything older than two years, so you get an accurate view of what customers say.

Four traits mattered most: finding real flaws with few false positives; scanning behind login and in single-page apps; testing APIs as well as web pages; and fitting into CI/CD pipelines and ticketing. We left out fuzzers, code-only scanners and services that mainly sell human pentesting. The order follows how widely each product is used by teams like yours. Company momentum shows how the vendor itself is growing, so a market leader can rank first with a lower score.

Read the full method: https://cybersectools.com/methodology#why

## What is Dynamic Application Security Testing

Dynamic application security testing (DAST) tests a running web app or API from the outside. The scanner crawls pages, forms and API endpoints, then sends attack payloads such as SQL injection and cross-site scripting to see what breaks. It needs no access to your source code, so it finds problems that only show up when the app runs, such as server settings and login flaws.

For you, this matters because attackers see your apps exactly this way. A flaw that a code scan misses can still be open on the live site. DAST shows what an outsider can reach and exploit today, so your team can fix the flaws that matter most before someone finds them.

### Compare Dynamic Application Security Testing solutions

This analysis focuses on seven DAST solutions. The table compares them on vendor, who each one is best for, deployment model and the NIST CSF functions they cover.

| # | Solution | Best for | Starting price | Deployment | Company size | NIST CSF functions |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | [PortSwigger Burp Suite DAST](https://cybersectools.com/tools/burp-suite-enterprise-edition) | Security teams scaling Burp scanning across many apps | Contact sales | Cloud | Mid-Market to Enterprise | Identify, Protect, Detect |
| 2 | [Invicti DAST](https://cybersectools.com/tools/invicti-dast) | Teams wanting proof that each flaw is real | Contact sales | Hybrid | Mid-Market to Enterprise | Identify, Protect |
| 3 | [Rapid7 InsightAppSec](https://cybersectools.com/tools/rapid7-insightappsec) | Teams wanting quick setup and a clear dashboard | From $175 per app per month | Hybrid | SMB to Enterprise | Identify, Protect |
| 4 | [Qualys TotalAppSec](https://cybersectools.com/tools/qualys-totalappsec) | Teams already running Qualys for vulnerability management | Contact sales | Cloud | SMB to Enterprise | Identify, Detect |
| 5 | [Tenable One Web App Scanning](https://cybersectools.com/tools/tenable-web-app-scanning) | Teams already using Tenable for vulnerability scanning | From $3,578 per FQDNs per year | Hybrid | SMB to Enterprise | Identify, Protect |
| 6 | [Checkmarx One DAST](https://cybersectools.com/tools/checkmarx-one-dast) | AppSec teams already using Checkmarx One | Contact sales | Cloud | Mid-Market to Enterprise | Identify, Protect |
| 7 | [Snyk API & Web](https://cybersectools.com/tools/snyk-api-and-web) | Developer teams adding DAST to a Snyk setup | Contact sales | Cloud | Startup to Enterprise | Identify |

Vendors change prices, so check before you buy.

**See every Dynamic Application Security Testing solution we list**

The full Dynamic Application Security Testing market, filtered by company size, deployment and NIST coverage.

[Browse Dynamic Application Security Testing solutions →](https://cybersectools.com/categories/dast)

### 1. PortSwigger Burp Suite DAST

**[PortSwigger Ltd.](https://mandos.io/data/companies/portswigger-ltd?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. An enterprise-scale dynamic application security testing (DAST) platform that provides automated vulnerability scanning and security assessment for web applications.

Knutsford, United Kingdom · Founded 2008 · $112M raised · Momentum 57/100 (Mandos)

Certifications: ISO 27001

**Best for:** Security teams scaling Burp scanning across many apps

Product page: https://cybersectools.com/tools/burp-suite-enterprise-edition

#### At a glance

- Vendor: PortSwigger Ltd.
- Headquarters: Knutsford, United Kingdom
- Founded: 2008
- Deployment: Cloud
- Company size: Mid-Market, Enterprise
- NIST CSF: Identify, Protect, Detect
- Pricing: Contact sales

#### Our take

Burp Suite DAST brings PortSwigger's scanner to many sites at once. A Chromium-based crawler handles JavaScript single-page apps, scans can log in and keep a session, and API scans start from Postman, OpenAPI, SOAP or GraphQL definitions. Every finding comes with request and response evidence, and you can host it yourself, in the cloud or on Kubernetes.

It connects to Jenkins, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, ServiceNow, Slack and Splunk, among others.

It earns a place because it puts a scanner many testers already know into a platform that runs on a schedule or on every pull request across many apps. It suits mid-sized and large security teams that want one place for all their web scans. Ask how much setup each logged-in scan needs, because that work grows with every app you add.

#### PortSwigger Burp Suite DAST main features

- Chromium-based crawler for JavaScript SPAs
- Session-aware authenticated scanning
- API scanning from Postman, OpenAPI, SOAP, and GraphQL definitions
- Support for custom BChecks
- Scheduled, on-PR, on-merge, and on-demand scans
- Request and response evidence for each finding
- Role-based access control and audit trails
- Site groups and bulk operations

#### PortSwigger Burp Suite DAST main integrations

Jenkins, Apiiro, Amazon API Gateway, Azure API Management, Google Apigee, Trello, Slack, Splunk, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, CircleCI, TeamCity, ServiceNow, Azure Boards, GitHub Issues, Jira Service Management, ArmorCode, Cycode, Snyk, DefectDojo, Brinqa, Kenna, Qualys, Okta, Microsoft Entra ID, HashiCorp Vault, AWS Secrets Manager, Postman, OpenAPI, SOAP, GraphQL

#### Before you buy

Where it is strong:

- Chromium crawler for single-page apps
- Scans on pull request, merge or schedule
- Self-hosted, cloud or Kubernetes deployment

Ask in the demo:

- Ask how many sites and scans your license covers
- Test a scan behind your own login flow
- Ask how custom BChecks fit your team's skills

### 2. Invicti DAST

**[Invicti](https://mandos.io/data/companies/invicti?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. DAST scanner with proof-based vulnerability validation and CI/CD integration

Austin, United States · Founded 2018 · $40M raised · Momentum 41/100 (Mandos)

Certifications: SOC 2, ISO 27001

**Best for:** Teams wanting proof that each flaw is real

Product page: https://cybersectools.com/tools/invicti-dast

#### At a glance

- Vendor: Invicti
- Headquarters: Austin, United States
- Founded: 2018
- Deployment: Hybrid
- Company size: Mid-Market, Enterprise
- NIST CSF: Identify, Protect
- Pricing: Contact sales

#### Our take

Invicti DAST uses proof-based scanning: it safely exploits many flaws to confirm they are real before it reports them. It scores web assets by risk before scanning, finds shadow APIs, tests REST, SOAP and GraphQL APIs, and scans behind login. It can open tickets and retest fixes automatically. You can run it as SaaS, on-premises or hybrid.

It connects to Jenkins, GitHub, GitLab, Azure DevOps and Jira.

Proof-based scanning is why it is here, because confirming a flaw before it reaches a developer cuts the time lost on false alarms. It fits mid-sized and large teams, including those that need it on-premises or hybrid. Its listed integrations cover the main CI/CD systems and Jira, so ask how it reaches any ticketing or chat system outside that set.

#### Invicti DAST main features

- Proof-based scanning
- Predictive risk scoring
- Authenticated scanning
- Shadow API discovery
- API scanning (REST, SOAP, GraphQL)
- OWASP API Top 10 testing
- Scanning of single page apps
- Automatic ticket creation and retests

#### Invicti DAST main integrations

Jenkins, GitHub, GitLab, Azure DevOps, Jira

#### What customers say

Sentiment: 100% positive · 0% mixed · 0% negative (from first-hand public reviews and comments, 2025 to 2026).
Most criticized: Setup, Missing features.

Invicti is a scanner teams set up once and leave running, because it plugs into build pipelines and tests each new release, and it confirms which findings are real so developers fix the serious ones first. The weak spot is APIs, since customers say it may not truly test them, especially behind complex logins, unless you feed it API definitions and check the results. Full scans of large sites can also take days, which slows fast release cycles.

#### Before you buy

Where it is strong:

- Proof-based scanning confirms real flaws
- Automatic tickets and retests
- SaaS, on-premises or hybrid deployment

Ask in the demo:

- Test API scanning on your own APIs during a trial
- Ask how long full scans of your largest site take
- Ask how Invicti differs from Acunetix, its sister product

### 3. Rapid7 InsightAppSec

**[Rapid7](https://mandos.io/data/companies/rapid7?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. DAST product for automated web app and API vulnerability scanning and testing

Boston, United States · Founded 2000 · Public company · Momentum 60/100 (Mandos)

Certifications: SOC 2, ISO 27001, FedRAMP, PCI DSS

**Best for:** Teams wanting quick setup and a clear dashboard

Product page: https://cybersectools.com/tools/rapid7-insightappsec

#### At a glance

- Vendor: Rapid7
- Headquarters: Boston, United States
- Founded: 2000
- Ownership: Public company (RPD)
- Deployment: Hybrid
- Company size: SMB, Mid-Market, Enterprise
- NIST CSF: Identify, Protect
- Starting price: From $175 per app per month

#### Our take

Rapid7 InsightAppSec runs black-box tests against web apps and APIs with more than 95 attack types. Attack Replay lets developers rerun a finding to confirm it and test the fix. It offers compliance reports for PCI DSS, HIPAA and the OWASP Top 10, scheduled scans with blackout windows, and an on-premises scan engine for apps on closed networks.

It connects to Jenkins, GitHub Actions, GitLab, Azure DevOps, Jira and ServiceNow.

It is on this list because Attack Replay lets developers check a finding and its fix themselves, which keeps security out of the middle of every ticket. It fits teams of any size that need compliance reports, and the on-premises engine helps if some apps sit on closed networks. It is built on Rapid7's Insight platform, so ask what you gain if you do not use that platform today.

#### Rapid7 InsightAppSec main features

- Black-box security testing for web applications and APIs
- Support for 95+ attack types
- Attack Replay for vulnerability validation and patch testing
- Universal Translator for modern web app assessment
- Compliance reporting for PCI-DSS, HIPAA, and OWASP Top Ten
- Cloud and on-premises scan engines
- Scan scheduling and blackout windows
- Automated vulnerability identification and triage

#### Rapid7 InsightAppSec main integrations

Atlassian Jira, Jenkins, Azure DevOps, GitHub Actions, GitLab, Jira, ServiceNow

#### What customers say

Its central dashboard is what customers bring up most, because it lays out scans, findings and fixes in a clean view that is easy to work in. They also trust the scans themselves, which they run against their own web apps to find flaws and to meet compliance needs.

#### Before you buy

Where it is strong:

- Attack Replay to confirm findings and fixes
- On-premises engine for closed networks
- Compliance reports for PCI DSS and HIPAA

Ask in the demo:

- Test its CI/CD and ticketing links during a trial
- Test a scan behind your own login flow
- Confirm the per-app price for your number of apps

### 4. Qualys TotalAppSec

**[Qualys](https://mandos.io/data/companies/qualys?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. Cloud-based DAST solution for web app & API security with AI-powered scanning

Foster City, United States · Founded 1999 · Public company · Momentum 63/100 (Mandos)

Certifications: SOC 2, ISO 27001, ISO 27017, ISO 27018, FedRAMP, HIPAA

**Best for:** Teams already running Qualys for vulnerability management

Product page: https://cybersectools.com/tools/qualys-totalappsec

#### At a glance

- Vendor: Qualys
- Headquarters: Foster City, United States
- Founded: 1999
- Ownership: Public company (QLYS)
- Deployment: Cloud
- Company size: SMB, Mid-Market, Enterprise
- NIST CSF: Identify, Detect
- Pricing: Contact sales

#### Our take

Qualys TotalAppSec combines DAST, API security and web malware detection. It finds web apps and APIs across on-premises, multi-cloud, API gateways and containers, including forgotten and shadow assets. It scans for the OWASP Top 10 and OWASP API Top 10, flags personal data exposure, and can pull in findings from Burp, ZAP and Bugcrowd. TruRisk scores rank issues by business risk.

It connects to Jenkins, GitHub Actions, Azure DevOps, Jira, ServiceNow, AWS, Microsoft Azure and Kong, among others.

It earns its place because it finds the web apps and APIs you may have lost track of before it tests them, which matters in large, spread-out estates. It fits best if you already run Qualys VMDR or CSAM, so web findings share one risk score with the rest. Because it can pull in results from other scanners, decide whether you want it as your single view of web app risk or as one source among several.

#### Qualys TotalAppSec main features

- Automated web application and API discovery across on-premises and multi-cloud environments
- DAST scanning for OWASP Top 10 and OWASP API Top 10 vulnerabilities
- PII and sensitive data exposure detection for GDPR, PCI DSS, and HIPAA compliance
- Web malware detection using behavioral analysis and deep learning
- REST and SOAP API scanning with OpenAPI v3 drift detection
- Third-party penetration testing data consolidation from Burp, ZAP, and BugCrowd
- TruRisk scoring for vulnerability prioritization based on business context
- AI-assisted clustering for optimized scanning of large applications

#### Qualys TotalAppSec main integrations

AWS, Microsoft Azure, Azure DevOps, Bamboo, Google Cloud Apigee, GitHub Actions, Jenkins, Jira, Kong, MuleSoft, PortSwigger Burp Suite, ServiceNow, Splunk, Swagger, TeamCity, Burp Suite, OWASP ZAP, BugCrowd, Qualys CSAM, Qualys VMDR

#### What customers say

Customers use it to scan their web apps for security flaws automatically, and they credit it with broad coverage across the apps and APIs they run. It also fits into development work, because it plugs into DevSecOps pipelines so apps get tested as part of the build.

#### Before you buy

Where it is strong:

- Finds shadow and forgotten web apps and APIs
- Web malware detection alongside DAST
- Pulls in findings from other testers

Ask in the demo:

- Ask how it is licensed alongside other Qualys apps
- Test scans of your single-page apps
- Ask how API drift detection works with your gateway

**Alternatives to each solution on this list**

The closest Dynamic Application Security Testing alternatives for every pick, matched on features and integrations.

[See Dynamic Application Security Testing alternatives →](https://cybersectools.com/alternatives)

### 5. Tenable One Web App Scanning

**[Tenable](https://mandos.io/data/companies/tenable?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. DAST solution for web apps and APIs with automated scanning capabilities

Columbia, United States · Founded 2002 · Public company · Momentum 60/100 (Mandos)

Certifications: SOC 2, ISO 27001, FedRAMP, PCI DSS, HIPAA, CSA STAR

**Best for:** Teams already using Tenable for vulnerability scanning

Product page: https://cybersectools.com/tools/tenable-web-app-scanning

#### At a glance

- Vendor: Tenable
- Headquarters: Columbia, United States
- Founded: 2002
- Ownership: Public company (TENB)
- Deployment: Hybrid
- Company size: SMB, Mid-Market, Enterprise
- NIST CSF: Identify, Protect
- Starting price: From $3,578 per FQDNs per year

#### Our take

Tenable One Web App Scanning crawls web apps to build a map of pages, links and forms. It then tests them for the OWASP Top 10, vulnerable third-party components, certificate issues and misconfigurations. Quick scans for common problems return results in a few minutes. It supports single-page apps, scheduled scans and role-based access, and it shares results with Tenable's other products.

It belongs here because it adds web app testing to the Tenable products many teams already use for vulnerability scanning, so web findings sit next to the rest. It fits teams of any size already on Tenable One or Security Center. Its listed integrations are all Tenable products, so if you want a scan on every release, ask how it connects to your CI/CD pipeline and ticketing.

#### Tenable One Web App Scanning main features

- Dynamic application security testing (DAST) for web apps and APIs
- OWASP Top 10 vulnerability detection including XSS and SQL injection
- Third-party component vulnerability scanning
- SSL/TLS certificate validation and misconfiguration detection
- Fast scanning with results in two minutes or less
- Support for single page applications
- Role-based access control for user permissions
- Customizable dashboards and reporting

#### Tenable One Web App Scanning main integrations

Tenable Security Center, Tenable One, Tenable Vulnerability Management

#### Before you buy

Where it is strong:

- Quick scans for common web problems
- Pre-built scan templates
- Results shared with other Tenable products

Ask in the demo:

- Ask how pricing works per site or domain
- Count false positives during a trial
- Ask which CI/CD systems it connects to

### 6. Checkmarx One DAST

**[Checkmarx](https://mandos.io/data/companies/checkmarx?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. Enterprise DAST solution for runtime app and API security testing

Paramus, United States · Founded 2006 · $92M raised · Momentum 51/100 (Mandos)

Certifications: SOC 2, ISO 27001, FedRAMP

**Best for:** AppSec teams already using Checkmarx One

Product page: https://cybersectools.com/tools/checkmarx-one-dast

#### At a glance

- Vendor: Checkmarx
- Headquarters: Paramus, United States
- Founded: 2006
- Deployment: Cloud
- Company size: Mid-Market, Enterprise
- NIST CSF: Identify, Protect
- Pricing: Contact sales

#### Our take

Checkmarx One DAST tests live web apps and REST, SOAP and gRPC APIs. It handles complex logins, two-factor authentication and single sign-on by recording browser logins or uploading scripts. Its API inventory combines APIs found by code scans and live scans, and its risk scores sit alongside Checkmarx's other scanners.

It connects to Jenkins, TeamCity, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, CircleCI and AWS CodeBuild, among others.

It is on this list because it is built for hard logins, from two-factor to single sign-on, and because it joins what code scans and live scans find about your APIs. It fits mid-sized and large AppSec teams already on Checkmarx One. If you do not run other Checkmarx scanners, the shared inventory and scores matter less, so judge it on its scanning alone.

#### Checkmarx One DAST main features

- Browser recording for authentication flows
- Two-factor authentication support
- REST, SOAP, and gRPC API testing
- Centralized API inventory with SAST and DAST findings
- CI/CD pipeline integration
- Automated configuration and YAML generation
- ASPM integration with unified risk scoring
- Vulnerability to compliance requirement mapping

#### Checkmarx One DAST main integrations

Anthropic, Jenkins, TeamCity, GitHub Actions, Azure DevOps, Maven, Bitbucket Pipelines, CircleCI, GitLab CI, Bamboo, AWS CodeBuild, SonarQube, VS Code, JetBrains, IntelliJ, Visual Studio, Eclipse, Cursor, Windsurf, Kiro, Jira, GitHub Issues, Azure Boards, Slack, Microsoft Teams, GitLab Issue Board, GitLab Security Dashboard, GitHub Container Registry, AWS ECR, JFrog Artifactory, Red Hat Quay, Azure Container Registry, Amazon Web Services, Microsoft Azure, Kubernetes

#### Before you buy

Where it is strong:

- Recorded logins for complex authentication
- One API inventory from code and live scans
- Shared risk scores with Checkmarx's other scanners

Ask in the demo:

- Ask whether DAST is sold alone or only within Checkmarx One
- Ask how much scripting complex logins need
- Ask for references that use the DAST module

### 7. Snyk API & Web

**[Snyk](https://mandos.io/data/companies/snyk?utm_source=cybersectools.com&utm_medium=shortlist-md&utm_campaign=explore-in-mandos)**. DAST scanner for APIs and web apps with AI-powered testing and low FP rate

Boston, United States · Founded 2015 · $1.3B raised · Momentum 65/100 (Mandos)

Certifications: SOC 2, ISO 27001, ISO 27017, FedRAMP, PCI DSS, HIPAA

**Best for:** Developer teams adding DAST to a Snyk setup

Product page: https://cybersectools.com/tools/snyk-api-and-web

#### At a glance

- Vendor: Snyk
- Headquarters: Boston, United States
- Founded: 2015
- Deployment: Cloud
- Company size: Startup, SMB, Mid-Market, Enterprise
- NIST CSF: Identify
- Pricing: Contact sales

#### Our take

Snyk API & Web scans live web apps and APIs. An API testing engine maps your API attack surface, and a Headless Chrome spider crawls JavaScript apps and single-page apps. It finds assets in your infrastructure, scans behind single sign-on and OpenID Connect, runs behind the firewall and offers blackout periods. Findings come with fix instructions and compliance reports.

It connects to Jira Server, Azure DevOps, DefectDojo, Shortcut, GitHub, Jenkins and Slack, among others.

It earns a place because it covers both APIs and JavaScript apps, can run behind the firewall, and gives developers fix steps with each finding. It fits teams from startups to large companies, and most naturally developer teams that already use Snyk. If that is you, ask how these findings sit next to your current Snyk results before you buy.

#### Snyk API & Web main features

- API vulnerability scanning
- Web application scanning
- Authenticated scans (SSO and OpenID Connect)
- Asset discovery
- Headless-Chrome spider for JavaScript apps and SPAs
- Scheduled and partial scans
- Scanning behind the firewall
- Blackout scanning periods

#### Snyk API & Web main integrations

Jira Server, DefectDojo, Azure DevOps, Shortcut, AWS, GitHub, Jenkins, Slack, CI/CD tools

#### Before you buy

Where it is strong:

- API attack surface mapping
- Scans behind single sign-on
- Fix instructions with every finding

Ask in the demo:

- Ask how it is licensed alongside other Snyk products
- Test API scans on your own APIs
- Ask for references that use the DAST product itself

## How they fit your cybersecurity program (NIST CSF)

NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. The grid shows which functions each pick maps to in our record, so you can see where a solution sits in your program and what it leaves to other controls.

All 7 solutions map to Identify. 5 of 7 map to Protect. 2 of 7 map to Detect. None map to Govern, Respond or Recover.

| Solution | Govern | Identify | Protect | Detect | Respond | Recover |
| --- | --- | --- | --- | --- | --- | --- |
| All solutions on this list | 0 of 7 | 7 of 7 | 5 of 7 | 2 of 7 | 0 of 7 | 0 of 7 |
| PortSwigger Burp Suite DAST | – | 1 of 3 (Risk Assessment) | 1 of 5 (Platform Security) | 1 of 2 (Continuous Monitoring) | – | – |
| Invicti DAST | – | 1 of 3 (Risk Assessment) | 1 of 5 (Platform Security) | – | – | – |
| Rapid7 InsightAppSec | – | 1 of 3 (Risk Assessment) | 1 of 5 (Platform Security) | – | – | – |
| Qualys TotalAppSec | – | 2 of 3 (Asset Management, Risk Assessment) | – | 2 of 2 (Continuous Monitoring, Adverse Event Analysis) | – | – |
| Tenable One Web App Scanning | – | 1 of 3 (Risk Assessment) | 1 of 5 (Platform Security) | – | – | – |
| Checkmarx One DAST | – | 2 of 3 (Asset Management, Risk Assessment) | 1 of 5 (Platform Security) | – | – | – |
| Snyk API & Web | – | 1 of 3 (Asset Management) | – | – | – | – |

Each cell shows how many of the function's NIST CSF 2.0 categories the solution maps to, with the category names.

A product helps you reach these outcomes, but it does not make you compliant on its own. Your people and processes do the rest.

## CISO checklist for selecting a Dynamic Application Security Testing product

Work through these steps in order to go from untested apps to a contract you can defend.

1. **List your web apps, APIs and test environments.** You can only scan what you know about.
2. **Decide who runs scans: security or developers.** This decides whether you need pipeline scans or scheduled scans.
3. **Test a scan behind your own login flow.** Login handling is where scanners fail most often.
4. **Scan one single-page app.** JavaScript-heavy apps need a modern crawler to find every page.
5. **Test API scanning with your own API definitions.** API coverage varies a lot between products.
6. **Count false positives in the trial.** Unconfirmed findings waste developer time.
7. **Time a full scan of your largest site.** Long scans can delay releases.
8. **Check links to your CI/CD and ticketing systems.** Findings only get fixed when they reach the right team.
9. **Ask how pricing scales.** Prices often grow with apps, sites or domains.
10. **Ask for references with apps like yours.** Results differ by app type and size.

**Compare Dynamic Application Security Testing solutions side by side**

Features, integrations, NIST coverage and deployment for every Dynamic Application Security Testing solution we list, in one table.

[Compare Dynamic Application Security Testing solutions →](https://cybersectools.com/compare)

## Other solutions we considered for this shortlist

We looked at 43 products for this list. These did not make the 7 above but are worth a look for the right team.

1. [Aikido DAST Scanner](https://cybersectools.com/tools/aikido-dast-scanner) · Aikido Security
   DAST scanner that identifies web app vulnerabilities and attack surfaces
2. [Astra Security DAST Scanner](https://cybersectools.com/tools/astra-security-dast-scanner) · Astra Security
   DAST scanner for web apps & APIs with CI/CD integration & 15k+ test cases.
3. [ImmuniWeb® Neuron](https://cybersectools.com/tools/immuniwebr-neuron) · ImmuniWeb
   AI-enhanced web app vulnerability scanner with zero false-positive SLA
4. [Siemba GenPT](https://cybersectools.com/tools/siemba-genpt) · Siemba
   AI-driven DAST tool for automated vulnerability testing of web applications
5. [Mend DAST](https://cybersectools.com/tools/mend-dast) · Mend.io
   Dynamic application security testing tool for runtime vulnerability detection
6. [Fluid Attacks Dynamic Application Security Testing (DAST)](https://cybersectools.com/tools/fluid-attacks-dynamic-application-security-testing-dast) · Fluid Attacks
   DAST tool for continuous automated security testing of web and mobile apps
7. [Wallarm API Security Testing](https://cybersectools.com/tools/wallarm-api-security-testing) · Wallarm
   Automated API security testing tool integrated into CI/CD pipelines
8. [Cobalt DAST](https://cybersectools.com/tools/cobalt-dast) · Cobalt
   Automated DAST tool for continuous web app and API vulnerability scanning.
9. [AppCheck DAST Tool](https://cybersectools.com/tools/appcheck-dast-tool) · AppCheck
   DAST tool for automated web app and API vulnerability scanning
10. [Escape DAST](https://cybersectools.com/tools/escape-dast) · Escape Technologies
   AI-powered DAST tool for business logic security testing of web apps and APIs

Explore all Dynamic Application Security Testing solutions: https://cybersectools.com/categories/dast

## Conclusion

Start with who runs the scans. If your security team runs scheduled scans across many apps, PortSwigger Burp Suite DAST and Invicti are strong choices, and Invicti confirms each flaw before you act. Rapid7 InsightAppSec suits teams that want a quick start and a clear dashboard.

If you already use Qualys, Tenable, Checkmarx or Snyk, their DAST products share results with what you run today. Test each one behind your own login and on your own APIs before you decide.

## Frequently Asked Questions

### What is the difference between DAST and SAST?

SAST reads your source code to find flaws before the app runs. DAST tests the running app from the outside, the way an attacker would. Most teams use both, because each catches problems the other misses.

### Can DAST scan behind a login?

Yes. Most products here record a login or accept a script so the scanner can stay signed in. Complex logins with two-factor or single sign-on take more setup, so test yours during a trial.

### Does DAST test APIs?

Most modern DAST products test REST APIs, and many also test GraphQL and SOAP. They usually need an API definition, such as an OpenAPI file, to know what to test.

### Is DAST safe to run on production?

DAST sends attack payloads, which can create junk data or slow an app. Many teams scan a test copy of the app, or scan production with safe settings and blackout windows.

### How do I reduce false positives?

Choose a product that confirms findings, for example by safely exploiting them or replaying the attack. Then tune scan settings for each app. Confirmed findings save developers the most time.

### Why do some products have no customer section?

We only summarize customer views when we find enough first-hand reviews from more than one place. If a product has too few public reviews, ask that vendor for references.

## Sources

These are the pages we reviewed for each pick: the vendor's own product page and website, its market data on Mandos, and every review page we read for customer feedback.

1. **PortSwigger Burp Suite DAST** · PortSwigger Ltd.: [Product page](https://portswigger.net/burp/dast) · [PortSwigger Ltd. website](https://portswigger.net/) · [Market data on Mandos](https://mandos.io/data/companies/portswigger-ltd?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos) · [Gartner Peer Insights](https://www.gartner.com/reviews/product/burp-suite-enterprise-edition) · [PeerSpot](https://www.peerspot.com/products/portswigger-burp-suite-enterprise-edition-reviews)
2. **Invicti DAST** · Invicti: [Product page](https://invicti.com/product/dast/) · [Invicti website](https://www.invicti.com/) · [Market data on Mandos](https://mandos.io/data/companies/invicti?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos) · [G2](https://www.g2.com/products/invicti/reviews) · [Gartner Peer Insights](https://www.gartner.com/reviews/product/invicti-1) · [PeerSpot](https://www.peerspot.com/products/invicti-reviews) · [Reddit: any recommendation for a good invicti replacement](https://www.reddit.com/r/devsecops/comments/1idrxl6/any_recommendation_for_a_good_invicti_replacement/) · [Reddit: dast scanning apis](https://www.reddit.com/r/devsecops/comments/1ox2gbm/dast_scanning_apis/) · [Reddit: modern dast tooling](https://www.reddit.com/r/cybersecurity/comments/1fk7f42/modern_dast_tooling/) · [Reddit: whats the best practice for dast software thats](https://www.reddit.com/r/cybersecurity/comments/usy769/whats_the_best_practice_for_dast_software_thats/)
3. **Rapid7 InsightAppSec** · Rapid7: [Product page](https://www.rapid7.com/products/insightappsec/) · [Rapid7 website](https://www.rapid7.com/) · [Market data on Mandos](https://mandos.io/data/companies/rapid7?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos) · [Gartner Peer Insights](https://www.gartner.com/reviews/product/insightappsec) · [PeerSpot](https://www.peerspot.com/products/rapid7-insightappsec-reviews)
4. **Qualys TotalAppSec** · Qualys: [Product page](https://www.qualys.com/apps/totalappsec) · [Qualys website](https://www.qualys.com/) · [Market data on Mandos](https://mandos.io/data/companies/qualys?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos) · [Gartner Peer Insights](https://www.gartner.com/reviews/product/qualys-totalappsec) · [Reddit: anyone using qualys for application security](https://www.reddit.com/r/cybersecurity/comments/1vti314/anyone_using_qualys_for_application_security/) · [Reddit: inventory of all potential web applications and](https://www.reddit.com/r/qualys/comments/1kyqz1b/inventory_of_all_potential_web_applications_and/) · [Reddit: issues with api discovery in totalappsec](https://www.reddit.com/r/qualys/comments/1nmlcdq/issues_with_api_discovery_in_totalappsec/) · [Reddit: exporting was totalappsec data for greater context](https://www.reddit.com/r/qualys/comments/1sx1me1/exporting_was_totalappsec_data_for_greater_context/)
5. **Tenable One Web App Scanning** · Tenable: [Product page](https://www.tenable.com/products/web-app-scanning) · [Tenable website](https://www.tenable.com/) · [Market data on Mandos](https://mandos.io/data/companies/tenable?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos) · [G2](https://www.g2.com/products/tenable-one-exposure-management-platform/reviews) · [Gartner Peer Insights](https://www.gartner.com/reviews/product/tenable-web-app-scanning) · [Reddit: does tenable offer a product comparable to](https://www.reddit.com/r/nessus/comments/186s8k9/does_tenable_offer_a_product_comparable_to/) · [Reddit: tenable nessus vs rapid7 insightvm vulnerability](https://www.reddit.com/r/cybersecurity/comments/1h4bcjr/tenable_nessus_vs_rapid7_insightvm_vulnerability/) · [Reddit: web application vulnerability program](https://www.reddit.com/r/cybersecurity/comments/p5zl2w/web_application_vulnerability_program/)
6. **Checkmarx One DAST** · Checkmarx: [Product page](https://checkmarx.com/checkmarx-dast/) · [Checkmarx website](https://checkmarx.com/) · [Market data on Mandos](https://mandos.io/data/companies/checkmarx?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos) · [Reddit: any recommendation for a good invicti replacement](https://www.reddit.com/r/devsecops/comments/1idrxl6/any_recommendation_for_a_good_invicti_replacement/) · [Reddit: checkmarx vs semgrep for a team that is mostly](https://www.reddit.com/r/devsecops/comments/1v1vkp1/checkmarx_vs_semgrep_for_a_team_that_is_mostly/)
7. **Snyk API & Web** · Snyk: [Product page](https://snyk.io/product/dast-api-web/) · [Snyk website](https://snyk.io/) · [Market data on Mandos](https://mandos.io/data/companies/snyk?utm_source=cybersectools.com&utm_medium=shortlist-md-sources&utm_campaign=explore-in-mandos)

---

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md.

More on the vendors on this list: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=shortlist-md