DAST Tools
Dynamic application security testing (DAST) software helps businesses find vulnerabilities in web applications. +Show More
| Products | Position | Free Trial | SIEM integrations | Ticketing | |
|---|---|---|---|---|---|
Invicti |
Leader
|
✅
|
Splunk
|
Built-in, Jira, ServiceNow
|
|
|
Invicti is an automated application security testing solution. Enterprises secure thousands of websites and dramatically reduce the risk of attack thanks to Invicti's DAST + IAST scanning capabilities. Invicti automates web security organizations with complicated environments.
Using Invicti, security teams can:
- Automate security tasks
- Gain visibility into all applications including lost, forgotten, or hidden apps
- Automatically give developers rapid feedback that trains them to write more secure code with fewer vulnerabilities
Basis for EvaluationWe made these evaluations based on the following parameters; Customer satisfaction
Average rating
Market presence
Company's number of employees
300-400 employees
Company's social media followers
20k-30k followers
Features
SIEM integrations
Splunk
Ticketing
Built-in
Jira ServiceNow
OAuth 2.0 Integration
✅
XSS Detection
✅
SQL injection detection
✅
|
|||||
GitLab |
Leader
|
✅
|
-
|
Clickup, Jira, ServiceNow
|
|
|
GitLab is the most comprehensive AI-Powered DevSecOps platform that enables software innovation by empowering development, security, and operations teams to build better software, faster. With GitLab, teams can create, deliver, and manage code quickly and continuously instead of managing disparate tools and scripts. GitLab helps your teams across the complete DevSecOps lifecycle, from developing, securing, and deploying software. What makes us truly different? - Flexibility: Consume as a service or manage your own deployment - Cloud-Agnostic: Deploy anywhere with no vendor lock-in - No rip and replace: Scale to a platform approach at your own pace
Basis for EvaluationWe made these evaluations based on the following parameters; Customer satisfaction
Average rating
Market presence
Number of case studies
50-100 case studies
Company's number of employees
2k-3k employees
Company's social media followers
1m-2m followers
Features
Ticketing
Clickup
Jira ServiceNow
OAuth 2.0 Integration
✅
XSS Detection
✅
SQL injection detection
✅
|
|||||
Nessus |
Leader
|
✅
|
IBM Security QRadar, MCafee ESM, RSA, Splunk
|
Built-in, Jira, ServiceNow
|
|
|
Built for security practitioners, by security professionals, Nessus products by Tenable are the de-facto industry standard for vulnerability assessment. Nessus performs point-in-time assessments to help security professionals quickly and easily identify and fix vulnerabilities, including software flaws, missing patches, malware, and misconfigurations - across a variety of operating systems, devices, and applications. With features such as pre-built policies and templates, customizable reporting, group “snooze” functionality, and real-time updates, Nessus is designed to make vulnerability assessment simple, easy, and intuitive. The result: less time and effort to assess, prioritize, and remediate issues.
Basis for EvaluationWe made these evaluations based on the following parameters; Customer satisfaction
Average rating
Market presence
Company's number of employees
2k-3k employees
Company's social media followers
100k-1m followers
Total funding
$1-1bn
# of funding rounds
5
Latest funding date
July 29, 2020
Last funding amount
$250-500m
Features
SIEM integrations
IBM Security QRadar
MCafee ESM RSA Splunk
Ticketing
Built-in
Jira ServiceNow
OAuth 2.0 Integration
❌
XSS Detection
✅
SQL injection detection
✅
Company
Type of company
public
Founding year
2002
|
|||||
Burp Suite |
Leader
|
✅
|
-
|
Built-in, Jira
|
|
|
PortSwigger Web Security is a global leader in the creation of software tools for the security testing of web applications. The software (Burp Suite) is well established as the de facto standard toolkit used by web security professionals. Burp Suite is used by more than 70,000 individuals at over 16,000 organisations, in over 160 countries. Used across the majority of industry sectors, in organisations both large and small. Burp Suite Professional is an advanced set of tools for finding and exploiting vulnerabilities in web applications - all within a single product. From a basic intercepting proxy to a cutting edge vulnerability scanner. Burp Suite can be used to test and report on a large number of vulnerabilities including SQLi, XSS and the whole OWASP top 10. PortSwigger pioneered out-of-band security testing (OAST) and Burp scanner was the first product to make OAST available out-of-the-box with zero configuration and to apply it to a wide range of vulnerability types. The Burp Suite Enterprise Edition enables businesses to secure their entire web portfolio with simple, scalable, scanning using the same cutting-edge Burp scanner technology. The Enterprise Edition performs recurring, scheduled scans across thousands of applications, with intuitive reporting dashboards, role-based access control and scan reports. It can provide out-of-the- box integration with ready made CI plugins, native Jira support and rich API's to enable security incorporation into existing software development processes.
Basis for EvaluationWe made these evaluations based on the following parameters; Customer satisfaction
Average rating
Market presence
Company's number of employees
200-300 employees
Company's social media followers
100k-1m followers
Features
Ticketing
Built-in
Jira
OAuth 2.0 Integration
❌
XSS Detection
✅
SQL injection detection
✅
Company
Type of company
private
Founding year
2008
|
|||||
InsightVM (Nexpose) |
Leader
|
✅
|
MCAFEE ESM, SPLUNK
|
BUILT-IN, JIRA, SERVICENOW
|
|
|
InsightVM is Rapid7’s vulnerability risk management offering that advances security through cross-department clarity, a deeper understanding of risk, and measurable progress. By informing and aligning technical teams, security teams can remediate vulnerabilities and build Security into the core of the organization. With InsightVM, security teams can: Gain Clarity Into Risk and Across Teams Better understand the risk in your modern environment so you can work in lockstep with technical teams. Extend Security’s Influence Align traditionally siloed teams and drive impact with the shared view and common language of InsightVM. See Shared Progress Take a proactive approach to security with tracking and metrics that create accountability and recognize progress.
Basis for EvaluationWe made these evaluations based on the following parameters; Customer satisfaction
Average rating
Market presence
Company's number of employees
3k-4k employees
Company's social media followers
100k-1m followers
Total funding
$250-500m
# of funding rounds
8
Latest funding date
June 26, 2024
Features
SIEM integrations
MCAFEE ESM
SPLUNK
Ticketing
BUILT-IN
JIRA SERVICENOW
OAuth 2.0 Integration
❌
XSS Detection
✅
SQL injection detection
✅
Company
Type of company
public
Founding year
2000
|
|||||
APPCHECK |
Challenger
|
-
|
-
|
-
|
|
Basis for EvaluationWe made these evaluations based on the following parameters; Customer satisfaction
Average rating
Market presence
Company's number of employees
50-100 employees
Company's social media followers
5k-10k followers
Company
Type of company
private
Founding year
2009
|
|||||
Indusface WAS |
Challenger
|
✅
|
MCafee ESM, RSA, Splunk, Sumo Logic
|
-
|
|
|
Indusface WAS (Web Application Scanner) provides comprehensive managed dynamic application security testing (DAST) solution. It is a zero-touch, non-intrusive cloud-based solution that provides daily monitoring for web applications, checking for systems and application vulnerabilities, and malware. Indusface WAS with its automated scans & manual pentesting done by certified security experts ensures none of the OWASP Top10, business logic vulnerabilities, and malware go unnoticed. With zero false-positive guarantee and comprehensive reporting with remediation guidance, Indusface web app scanning ensures developers to quickly fix vulnerabilities seamlessly.
Basis for EvaluationWe made these evaluations based on the following parameters; Customer satisfaction
Average rating
Market presence
Number of case studies
5-10 case studies
Company's number of employees
100-200 employees
Company's social media followers
10k-20k followers
Total funding
$5-10m
# of funding rounds
1
Latest funding date
April 23, 2020
Last funding amount
$5-10m
Features
SIEM integrations
MCafee ESM
RSA Splunk Sumo Logic
OAuth 2.0 Integration
❌
XSS Detection
✅
SQL injection detection
✅
Company
Type of company
private
Founding year
2012
|
|||||
Veracode Application Security Platform |
Challenger
|
✅
|
-
|
Jira, ServiceNow
|
|
|
Veracode helps companies that innovate through software deliver secure code on time. Unlike on-premise solutions that are hard to scale and focused on finding rather than fixing, Veracode comprises a unique combination of SaaS technology and on-demand expertise that enables DevSecOps through integration with your pipeline,empower developers to fix security defects, and scales your program through best practices to achieve your desired outcomes. Veracode covers your all your AppSec needs in one solution through a combination of five analysis types available for 24 programming languages, 77 frameworks, and application types as varied as microservices, mainframe and mobile apps.
Basis for EvaluationWe made these evaluations based on the following parameters; Customer satisfaction
Average rating
Market presence
Company's number of employees
400-1k employees
Company's social media followers
50k-100k followers
Total funding
$100-250m
# of funding rounds
7
Latest funding date
December 1, 2014
Features
Ticketing
Jira
ServiceNow
OAuth 2.0 Integration
✅
XSS Detection
✅
SQL injection detection
✅
Company
Type of company
private
Founding year
2006
|
|||||
Appknox |
Challenger
|
✅
|
-
|
JIRA
|
|
Basis for EvaluationWe made these evaluations based on the following parameters; Customer satisfaction
Average rating
Market presence
Number of case studies
5-10 case studies
Company's number of employees
50-100 employees
Company's social media followers
5k-10k followers
Total funding
$1-1m
# of funding rounds
3
Latest funding date
August 16, 2016
Last funding amount
$1-1m
Features
Ticketing
JIRA
OAuth 2.0 Integration
❌
XSS Detection
✅
SQL injection detection
✅
Company
Type of company
private
Founding year
2014
|
|||||
HCL AppScan |
Challenger
|
✅
|
IBM Security QRadar
|
Jira, ServiceNow
|
|
|
HCL AppScan is a comprehensive suite of market-leading application security testing solutions (SAST, DAST, IAST, SCA, API), available on-premises and on-cloud. These powerful DevSecOps tools pinpoint application vulnerabilities, allowing for quick remediation in every phase of the software development lifecycle. Fast and Accurate Scanning for Secure DevOps Developers and DevOps teams can quickly and accurately scan code, applications, and APIs for security vulnerabilities while applications are being developed. This allows companies to fix issues at the earliest stages of the software development lifecycle, when it is least costly to the business. Focus on the Fix Continuous monitoring with IAST, along with auto issue correlation with DAST and SAST scan results allows DevOps teams to group and prioritize findings for faster, more streamlined remediation. Enterprise Management for Security Teams Centralized, easy-to-use dashboards provide visibility and oversight of all security scanning and remediation, and allow users to set scan parameters and compliance policies.
Basis for EvaluationWe made these evaluations based on the following parameters; Customer satisfaction
Average rating
Market presence
Company's number of employees
100k-1m employees
Company's social media followers
7m-8m followers
Features
SIEM integrations
IBM Security QRadar
Ticketing
Jira
ServiceNow
OAuth 2.0 Integration
✅
XSS Detection
✅
SQL injection detection
✅
|
|||||
“-”: AIMultiple team has not yet verified that vendor provides the specified feature. AIMultiple team focuses on feature verification for top 10 vendors.
Sources
AIMultiple uses these data sources for ranking solutions and awarding badges in DAST tools:
DAST Leaders
According to the weighted combination of 4 metrics
What are DAST
customer satisfaction leaders?
Taking into account the latest metrics outlined below, these are the current DAST customer satisfaction leaders:
Which DAST solution provides the most customer satisfaction?
AIMultiple uses product and service reviews from multiple review platforms in determining customer satisfaction.
While deciding a product's level of customer satisfaction, AIMultiple takes into account its number of reviews, how reviewers rate it and the recency of reviews.
- Number of reviews is important because it is easier to get a small number of high ratings than a high number of them.
- Recency is important as products are always evolving.
- Reviews older than 5 years are not taken into consideration
- older than 12 months have reduced impact in average ratings in line with their date of publishing.
What are DAST
market leaders?
Taking into account the latest metrics outlined below, these are the current DAST market leaders:
Which one has collected the most reviews?
AIMultiple uses multiple datapoints in identifying market leaders:
- Product line revenue (when available)
- Number of reviews
- Number of case studies
- Number and experience of employees
- Social media presence and engagement
What are DAST feature leaders?
Taking into account the latest metrics outlined below, these are the current rpa software feature leaders.
Which one offers the most features?
Nessus, InsightVM (Nexpose), Indusface WAS offer the most feature complete products.
What are the most mature DAST tools?
Which one has the most employees?
Which DAST companies have the most employees?
214 employees work for a typical company in this solution category which is 191 more than the number of employees for a typical company in the average solution category.
In most cases, companies need at least 10 employees to serve other businesses with a proven tech product or service. 22 companies with >10 employees are offering dast tools. Top 3 products are developed by companies with a total of 200k employees. The largest company in this domain is HCL Digital Experience with more than 200,000 employees. HCL Digital Experience provides the DAST solution: HCL AppScan
Insights
What are the most common words describing DAST tools?
This data is collected from customer reviews for all DAST companies. The most positive word describing DAST tools is “Easy to use” that is used in 9% of the reviews. The most negative one is “Difficult” with which is used in 4% of all the DAST reviews.
What is the average customer size?
According to customer reviews, most common company size for DAST customers is 51-1,000 employees. Customers with 51-1,000 employees make up 38% of DAST customers. For an average Cybersecurity solution, customers with 51-1,000 employees make up 15% of total customers.
Customer Evaluation
These scores are the average scores collected from customer reviews for all DAST tools. DAST Tools are most positively evaluated in terms of "Overall" but falls behind in "Customer Service".
Where are DAST vendors' HQs located?
Trends
What is the level of interest in DAST tools?
This category was searched on average for 4.5k times per month on search engines in 2024. This number has decreased to 0 in 2025. If we compare with other cybersecurity solutions, a typical solution was searched 918 times in 2024 and this decreased to 0 in 2025.