Top Free Dynamic Application Security Testing (DAST) Software - Page 3

OX Security

OX rewires your security program for the Mythos Age: the era where AI writes the code, chains the exploits, and moves faster than human-built defenses can track. OX is an AI Native Application Protection Platform (AINAPP) unifying security from Prompt to Runtime. It moves your control surface upstream to the prompt, preventing and governing risk at the source instead of chasing it downstream in runtime. OX Mind and OX AI Context Lake connect AI-user governance, code security, cloud and runtime enforcement, and agentic pentesting into one system that shares context across the entire Agentic Development Lifecycle (ADLC), replacing fragmented point tools with a single platform. The platform runs on four connected pillars: OX VibeSec: Prevents unsafe AI decisions at the point of creation and governs every AI user in the organization, not just developers using coding assistants. Full visibility into which agents, MCPs, skills, and packages run, with what permissions, against what data. OX Code: Separates exploitable risk from theoretical noise using evidence from your actual deployment, threat model, and threat intelligence. OX Cloud: Prevents misconfigurations and enforces runtime boundaries that code and agents cannot cross, watching what actually runs in production. OX Agentic Pentester: Continuously simulates adversarial agent behavior to prove exploit paths back to their exact source, feeding what it finds back into OX VibeSec to sharpen governance. OX connects to your existing stack and traces every finding back to its origin (the prompt, the AI user, or the endpoint that created it), then fixes issues at the source rather than flagging them after the fact. For new deployments, OX consolidates governance, code security, cloud enforcement, and pentesting into one platform. For existing stacks, OX layers governance on top and makes current tools smarter through continuous learning, so the same issue never gets created twice. Visit https://ox.security for more information.

Average Rating: 4.8/5.0

Total Reviews: 51

Cyber Chief

Cyber Chief is a vulnerability scanner & issue management tool that helps you ship software with zero known security vulnerabilities. It gives your software team the power to find and fix thousands of vulnerabilities in your web applications and cloud infrastructure. With its one-click vulnerability scanning and smart vulnerability management features, Cyber Chief will help your software team secure their applications abs infrastructure, even if there is zero application security qualifications or experience on the team. Cyber Chief is cloud-based and has military-grade security controls so that your security secrets are kept safe.

Average Rating: 4.5/5.0

Total Reviews: 7

ZeroThreat

ZeroThreat Inc. is an AI-driven cybersecurity innovator dedicated to transforming how modern enterprises protect their web applications and APIs through its advanced platform. We empower organizations, from fast-growing startups to global enterprises, to stay ahead of evolving threats by delivering continuous, attacker-style penetration testing at the speed of modern development. Our mission is to eliminate the noise and complexity of traditional application security. By pioneering an Agentic AI engine and automated penetration testing platform, ZeroThreat.ai enables security teams to automate complex manual processes, reducing manual pentesting effort by 90% while achieving a 99.9% accuracy rate. It doesn't just scan for vulnerabilities. It validates real-world attack paths and provides audit-ready evidence, ensuring that organizations in highly regulated sectors such as Fintech, Healthcare, and Government can scale securely and maintain compliance. ZeroThreat.ai bridges the gap between developers and security teams by providing proof-based findings and actionable remediation guidance. We are committed to restoring developer trust through non-destructive, intelligent validation that focuses exclusively on exploitable risks, allowing businesses to ship software up to 10x faster without compromising security.

Average Rating: 4.8/5.0

Total Reviews: 10

Siemba

Siemba is an AI-driven Continuous Threat Exposure Management (CTEM) platform that helps enterprises, government agencies, and growing organizations discover, prioritize, and fix critical vulnerabilities across their entire attack surface. Security teams use Siemba to build and mature CTEM programs without requiring deep hacking expertise or constant human intervention. The platform brings together four integrated capabilities on a single unified interface: Penetration Testing as a Service (PTaaS) for expert-led manual pen testing on demand; GenPT for AI-native Dynamic Application Security Testing (DAST) that simulates real-world attack techniques against web applications and APIs; GenVA for AI-driven vulnerability assessment that continuously scans and scores risks across your environment; and EASM for External Attack Surface Management that maps and monitors all external-facing assets, including shadow IT and exposed infrastructure. Together these capabilities deliver actionable intelligence across the full CTEM lifecycle, from asset discovery and attack surface mapping through to risk prioritization, validation, and remediation guidance. Security leaders gain the visibility, speed, and scalability needed to run continuous offensive security programs and generate strategic insights that maximize Return on Mitigation. Siemba is trusted by enterprises, global systems integrators, and government agencies looking to consolidate their offensive security tooling, reduce exposure windows, and demonstrate measurable security improvement over time.

Average Rating: 4.7/5.0

Total Reviews: 5

Semgrep

Semgrep is a modern static analysis (SAST), software composition analysis (SCA), and secrets detection platform designed for both developers and security teams. It combines fast, deterministic analysis with context-aware AI that triages findings like a senior security engineer. The AI Assistant helps reduce false positives, prioritize meaningful results, and offers clear remediation guidance. Its “Memories” feature learns from past decisions to further reduce triage noise over time. Semgrep also supports deep analysis of transitive dependencies, not just direct ones, helping teams surface and address hidden risks in their supply chain. It integrates well into modern development workflows and is easy to customize across environments.

Average Rating: 4.6/5.0

Total Reviews: 56

Crashtest Security

Crashtest Security is a SaaS-based security vulnerability scanner allowing agile development teams to ensure continuous security before every release. Our state-of-the-art dynamic application security testing (DAST) solution integrates seamlessly with your dev environment and protects multi-page and JavaScript apps, as well as microservices and APIs. Set up Crashtest Security Suite in minutes, get advanced crawling options, and automate your security. Whether you want to see vulnerabilities within the OWASP Top 10 or you want to go for deep scans, Crashtest Security is here to help you stay on top of your security and protect your code and customers.

Average Rating: 5.0/5.0

Total Reviews: 2

esChecker MAST (SAST, DAST & IAST)

esChecker combines many years of penetration testing experience with a unique dynamic engine simulating attack techniques, such as reverse-engineering or code tampering. No source code is needed, only the app binary (Android apk or iOS ipa). esChecker provides immediate feedback about the way your app reacts against many hacking techniques. You can now spare your pentest budget for in-depth vulnerability analyses.

Average Rating: 4.3/5.0

Total Reviews: 2

Bugsmirror MASST (Mobile Application Security Suite & Tools)

Bugsmirror Mobile Application Security Suite & Tools (MASST) is designed specifically for your business, providing scalable, end-to-end security for your mobile app. From detection to protection, MASST ensures your app is safeguarded against evolving security threats. With MASST, you can focus on growing your business, knowing your app is fully protected at every stage.

Oversecured

Enterprise vulnerability scanner for Android and iOS apps. It offers app owners and developers the ability to secure each new version of a mobile app by integrating Oversecured into the development process.

Panoptic Scans - Network and Application Vulnerability Scans

Panoptic Scans is a hosted vulnerability scanning platform designed to bolster cybersecurity for businesses by offering automated, comprehensive network and application vulnerability scans. Our platform empowers users to schedule vulnerability scans - daily, weekly, monthly, or annually - to ensure compliance with stringent regulations like SOC 2, HIPAA, ISO 27001, NIST 800-53, CMMC, and GDPR. Leveraging powerful tools such as OpenVAS for network vulnerabilities, OWASP ZAP for application security, and Nmap for port scanning, Panoptic Scans identifies weaknesses like unpatched software, misconfigurations, and open ports that could be exploited by cyber threats. With features like email notifications, detailed scan reports, and a user-friendly API, it simplifies vulnerability management, making it ideal for SaaS companies, security teams, and agile development environments aiming to safeguard sensitive data and maintain robust compliance effortlessly.

Average Rating: 5.0/5.0

Total Reviews: 1

Proscan

Proscan is a unified application security platform designed to help organizations streamline the management of their security tools. By integrating multiple standalone solutions into a single cohesive experience, Proscan provides comprehensive security visibility across the entire software stack. This platform replaces the complexity of managing various tools for static analysis, dynamic testing, and dependency scanning, allowing teams to focus on building secure applications without the hassle of juggling disparate systems. The platform is particularly beneficial for security teams, developers, and engineering leaders who require a consolidated view of application security risks. Proscan combines nine specialized security scanners, including Static Application Security Testing (SAST), which analyzes source code in over 30 programming languages using advanced detection methods. Dynamic Application Security Testing (DAST) further enhances security by testing live applications, identifying vulnerabilities that may only become apparent during runtime. Additionally, Software Composition Analysis (SCA) evaluates open-source dependencies across 196 package ecosystems, helping organizations detect known vulnerabilities before they can impact production environments. Proscan's capabilities extend beyond code analysis. It includes scanning for hardcoded secrets, misconfigurations in Infrastructure-as-Code, and vulnerabilities in container images. The platform also offers API security testing that validates endpoints against the OWASP API Security Top 10, ensuring robust protection for applications that leverage APIs. For organizations developing AI-powered applications, Proscan features a dedicated AI and LLM security scanner that identifies potential risks associated with prompt injections and other vulnerabilities, utilizing over 4,600 techniques mapped to the OWASP LLM Top 10. Artificial intelligence plays a crucial role in enhancing Proscan's efficiency and accuracy. The platform employs machine-learning algorithms to reduce false positives and prioritize vulnerabilities based on their potential impact. This intelligent approach allows teams to focus on the most critical security issues while providing clear explanations and actionable remediation guidance. Proscan integrates seamlessly into existing development workflows, offering IDE plugins and native CI/CD integrations that ensure security checks are part of the development process without causing disruptions. Compliance readiness is another key feature of Proscan, as it generates audit-ready reports aligned with major security standards, including OWASP Top 10, PCI DSS, HIPAA, and GDPR. This automated evidence collection simplifies the compliance process, providing organizations with the necessary documentation in various formats. Proscan is designed for security teams looking to consolidate fragmented toolchains, developers needing quick feedback, and managed security service providers managing multiple client environments, making it a versatile solution for modern application security challenges.

PT Application Inspector

PT Application Inspector™ (PT AI™) is a comprehensive source code analysis tool that offers protection for web applications of any scale. Its holistic approach combines the advantages of static, dynamic, and interactive analysis to maintain application security throughout every stage of development—from the very first line of code to the go-live.

Average Rating: 5.0/5.0

Total Reviews: 2

Sn1per Professional

Sn1per Professional is an all-in-one offensive security platform that provides a comprehensive view of your internal and external attack surface and offers an asset risk scoring system to prioritize, reduce, and manage risk. With Sn1per Professional, you can discover the attack surface and continuously monitor it for changes. It integrates with the leading open source and commercial security testing tools for a unified view of your data.

Average Rating: 4.5/5.0

Total Reviews: 1

Topscan

Topscan is a continuous security monitoring platform for the DevOps engineer or CTO who owns security among other things. It covers the whole delivery pipeline in one subscription — static analysis in your code, dynamic scanning of live applications and infrastructure, and continuous monitoring of everything you expose to the internet — instead of three separate vendors for SAST, DAST and attack surface management. Perimeter. External infrastructure scanning reports open ports, service versions and known server vulnerabilities matched against CVE databases, with unlimited scheduled rescans. Asset discovery maps the subdomains and hosts you forgot about — the Grafana, the Sentry, the staging box nobody remembers deploying — and new hosts arrive with a review prompt: you confirm ownership before anything is scanned. Attack surface monitoring keeps every exposed service inventoried, and certificate watch catches TLS/SSL expiry weeks early instead of on the Friday night it happens. Applications and code. Web application scanning runs OWASP-class checks against live apps: SQL injection, XSS, exposed admin panels, default credentials, missing headers. Static application security testing covers three kinds of risk in one scan — vulnerable code patterns, committed secrets and keys, and known CVEs in dependencies (software composition analysis) — on every commit, pointing at the exact file and line. Pipeline and cloud. A CI/CD webhook gives you a unique event link to call from the last step of your deploy script: no API keys, no agent, nothing installed on your servers. AWS connects with keys you issue to discover EC2 and Route 53 resources, which are added to monitoring and rescanned when they change. Workflow. Findings are deduplicated and carry severity in your context, CVSS, a first-seen date and an SLA clock with overdue flags. Snooze what you accept, mark false positives and they stop resurfacing, and work through a large backlog in triage mode. Informational findings stay out of the feed and never touch your score. One security score tracks the whole estate over time — the number you show yourself, your CEO or an auditor. Alerts reach the team in Slack or Microsoft Teams and turn into Jira tickets; chat and tracker routing starts on the Advanced plan. Audit and compliance. Auditors ask for evidence of regular scanning and an inventory of what is exposed: scan history with downloadable reports and an exportable asset inventory answer both, which is what most teams use Topscan for ahead of SOC 2, ISO 27001 or a customer security review. Auditor seats are free and read-only, and users are unlimited on every plan. Pricing starts at $129 per month and is published on the site — no demo call required to see it — with a 14-day free trial of the full plan and no credit card. Add a domain and the first map of your perimeter arrives in five to ten minutes.

Average Rating: 4.9/5.0

Total Reviews: 5