# Best Dynamic Application Security Testing (DAST) Software - Page 3 *By [Lauren Worth](https://research.g2.com/insights/author/lauren-worth)* Dynamic application security testing (DAST) tools automate security tests for a variety of real-world threats. These tools typically test HTTP and HTML interfaces of web applications. DAST is a black-box testing method, meaning it is performed from the outside. Companies use these tools to identify vulnerabilities in their applications from an external perspective to better simulate threats most easily accessed by hackers outside their organization. There are similarities between DAST tools and other application security and vulnerability management solutions, but most other technologies perform internal tests and code analysis instead of focusing on black-box testing. [SAST vs DAST](https://research.g2.com/blog/sast-vs-dast) — Learn the difference To qualify for inclusion in the Dynamic Application Security Testing (DAST) category, a product must: - Test applications in their operational state - Perform external black-box security tests - Trace penetrations and exploits to their sources ## How Many Dynamic Application Security Testing (DAST) Software Products Does G2 Track? **Total Products under this Category:** 93 ## How Does G2 Rank Dynamic Application Security Testing (DAST) Software Products? **Why You Can Trust G2's Software Rankings:** - 30 Analysts and Data Experts - 3,500+ Authentic Reviews - 93+ Products - Unbiased Rankings G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category. ## Which Dynamic Application Security Testing (DAST) Software Is Best for Your Use Case? - **Leader:** [Aikido Security](https://www.g2.com/products/aikido-security/reviews) - **Highest Performer:** [Qodex.ai](https://www.g2.com/products/qodex-ai/reviews) - **Easiest to Use:** [Qodex.ai](https://www.g2.com/products/qodex-ai/reviews) - **Top Trending:** [Aikido Security](https://www.g2.com/products/aikido-security/reviews) - **Best Free Software:** [Tenable Nessus](https://www.g2.com/products/tenable-nessus/reviews) --- **Sponsored** ### Proscan Proscan is a unified application security platform designed to help organizations streamline the management of their security tools. By integrating multiple standalone solutions into a single cohesive experience, Proscan provides comprehensive security visibility across the entire software stack. This platform replaces the complexity of managing various tools for static analysis, dynamic testing, and dependency scanning, allowing teams to focus on building secure applications without the hassle of juggling disparate systems. The platform is particularly beneficial for security teams, developers, and engineering leaders who require a consolidated view of application security risks. Proscan combines nine specialized security scanners, including Static Application Security Testing (SAST), which analyzes source code in over 30 programming languages using advanced detection methods. Dynamic Application Security Testing (DAST) further enhances security by testing live applications, identifying vulnerabilities that may only become apparent during runtime. Additionally, Software Composition Analysis (SCA) evaluates open-source dependencies across 196 package ecosystems, helping organizations detect known vulnerabilities before they can impact production environments. Proscan's capabilities extend beyond code analysis. It includes scanning for hardcoded secrets, misconfigurations in Infrastructure-as-Code, and vulnerabilities in container images. The platform also offers API security testing that validates endpoints against the OWASP API Security Top 10, ensuring robust protection for applications that leverage APIs. For organizations developing AI-powered applications, Proscan features a dedicated AI and LLM security scanner that identifies potential risks associated with prompt injections and other vulnerabilities, utilizing over 4,600 techniques mapped to the OWASP LLM Top 10. Artificial intelligence plays a crucial role in enhancing Proscan's efficiency and accuracy. The platform employs machine-learning algorithms to reduce false positives and prioritize vulnerabilities based on their potential impact. This intelligent approach allows teams to focus on the most critical security issues while providing clear explanations and actionable remediation guidance. Proscan integrates seamlessly into existing development workflows, offering IDE plugins and native CI/CD integrations that ensure security checks are part of the development process without causing disruptions. Compliance readiness is another key feature of Proscan, as it generates audit-ready reports aligned with major security standards, including OWASP Top 10, PCI DSS, HIPAA, and GDPR. This automated evidence collection simplifies the compliance process, providing organizations with the necessary documentation in various formats. Proscan is designed for security teams looking to consolidate fragmented toolchains, developers needing quick feedback, and managed security service providers managing multiple client environments, making it a versatile solution for modern application security challenges. [Visit website](https://www.g2.com/external_clickthroughs/record?secure%5Bad_program%5D=ppc&secure%5Bad_slot%5D=category_product_list&secure%5Bcategory_id%5D=1521&secure%5Bdisplayable_resource_id%5D=1521&secure%5Bdisplayable_resource_type%5D=Category&secure%5Bmedium%5D=sponsored&secure%5Bplacement_reason%5D=page_category&secure%5Bplacement_resource_ids%5D%5B%5D=1521&secure%5Bprioritized%5D=false&secure%5Bproduct_id%5D=1777455&secure%5Bresource_id%5D=1521&secure%5Bresource_type%5D=Category&secure%5Bsource_type%5D=category_page&secure%5Bsource_url%5D=https%3A%2F%2Fwww.g2.com%2Fcategories%2Fdynamic-application-security-testing-dast%3Fpage%3D4&secure%5Btoken%5D=a79f2ac41b847aa1803fd5eddf7212eaf69a321a5e28d7a00713464115c985f3&secure%5Burl%5D=https%3A%2F%2Fwww.proscan.one%2Fdownload&secure%5Burl_type%5D=free_trial) --- ## What Are the Top-Rated Dynamic Application Security Testing (DAST) Software Products in 2026? ### 1. [Semgrep](https://www.g2.com/products/semgrep/reviews) Semgrep is a modern static analysis (SAST), software composition analysis (SCA), and secrets detection platform designed for both developers and security teams. It combines fast, deterministic analysis with context-aware AI that triages findings like a senior security engineer. The AI Assistant helps reduce false positives, prioritize meaningful results, and offers clear remediation guidance. Its “Memories” feature learns from past decisions to further reduce triage noise over time. Semgrep also supports deep analysis of transitive dependencies, not just direct ones, helping teams surface and address hidden risks in their supply chain. It integrates well into modern development workflows and is easy to customize across environments. **Average Rating:** 4.6/5.0 **Total Reviews:** 55 **How Do G2 Users Rate Semgrep?** - **Has the product been a good partner in doing business?:** 9.6/10 (Category avg: 9.2/10) **Who Is the Company Behind Semgrep?** - **Seller:** [Semgrep](https://www.g2.com/sellers/semgrep) - **Company Website:** https://semgrep.dev - **Year Founded:** 2017 - **HQ Location:** San Francisco, US - **Twitter:** @semgrep (4,304 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/returntocorp (238 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Information Technology and Services, Computer Software - **Company Size:** 45% Enterprise, 42% Mid-Market #### What Are Semgrep's Pros and Cons? **Pros:** - Ease of Use (16 reviews) - Features (14 reviews) - Vulnerability Detection (13 reviews) - Scanning Efficiency (12 reviews) - Security (12 reviews) **Cons:** - Not User-Friendly (7 reviews) - Limited Features (6 reviews) - Difficult Learning (5 reviews) - Lack of Guidance (5 reviews) - Learning Curve (5 reviews) ### 2. [TASKING Test & Verification Tools](https://www.g2.com/products/tasking-test-verification-tools/reviews) TASKING Test & Verification Tools combine software analysis, verification, and compliance capabilities for safety- and security-critical software development. Products: LDRA tool suite and LDRA Productivity Packages. **Average Rating:** 4.3/5.0 **Total Reviews:** 2 **How Do G2 Users Rate TASKING Test & Verification Tools?** - **Test Automation:** 10.0/10 (Category avg: 8.7/10) **Who Is the Company Behind TASKING Test & Verification Tools?** - **Seller:** [TASKING](https://www.g2.com/sellers/tasking) - **Company Website:** https://www.tasking.com - **Year Founded:** 1977 - **HQ Location:** Munich, Bavaria - **LinkedIn® Page:** https://www.linkedin.com/company/tasking-inc/ (190 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 50% Enterprise, 50% Mid-Market ### 3. [beSTORM](https://www.g2.com/products/bestorm/reviews) beSTORM is an intelligent black box fuzzer that ensures the security of products, including software and applications, before they are deployed. This easy-to-use dynamic application security testing (DAST) tool offers: -- All-in-one platform -- Real-time fuzzing and protocol description -- More than 200 pre-built protocol modules -- Capabilities to add custom and proprietary modules -- Accurate testing without accessing source code. beSTORM provides your team with a single source for tests and attacks that replaces hundreds of unsupported, open source tools. **Average Rating:** 4.5/5.0 **Total Reviews:** 1 **How Do G2 Users Rate beSTORM?** - **API / Integrations:** 8.3/10 (Category avg: 8.6/10) - **Detection Rate:** 8.3/10 (Category avg: 8.7/10) - **Test Automation:** 10.0/10 (Category avg: 8.7/10) **Who Is the Company Behind beSTORM?** - **Seller:** [Fortra](https://www.g2.com/sellers/fortra) - **Year Founded:** 1982 - **HQ Location:** Eden Prairie, Minnesota - **Twitter:** @fortraofficial (2,766 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/fortra (1,738 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 100% Small-Business ### 4. [Com Olho](https://www.g2.com/products/com-olho/reviews) At Com Olho, we are at the forefront of cybersecurity innovation, bringing together ethical hackers, security researchers, and organisations to strengthen digital defenses. Our platform provides a dynamic space where security experts can identify, report, and remediate vulnerabilities across a diverse range of systems. Com Olho is the first company to be granted a patent for system and method to detect advertising fraud at the Indian Patent Office, Government of India. The company also have patent for digital governance of online digital asset. Com Olho is incubated at NASSCOM 10000 Startups and part of NASSCOM DeepTech Club. The company was a recipient of a cash grant from Facebook for Business under Small Business Grant program. Com Olho is a registered name under Com Olho IT Private Limited. Com Olho has been recognized by Department for Promotion of Industry and Internal Trade, Ministry of Commerce and Industry, Government of India vide certificate number : DIPP45326. Com Olho is a Registered Trademark. **Average Rating:** 4.8/5.0 **Total Reviews:** 3 **How Do G2 Users Rate Com Olho?** - **Has the product been a good partner in doing business?:** 8.3/10 (Category avg: 9.2/10) **Who Is the Company Behind Com Olho?** - **Seller:** [Com Olho](https://www.g2.com/sellers/com-olho) - **Year Founded:** 2019 - **HQ Location:** Gurugram, IN - **Twitter:** @com_olho (78 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/com-olho (52 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 33% Enterprise, 33% Mid-Market #### What Are Com Olho's Pros and Cons? **Pros:** - Dashboard Usability (1 reviews) - Time Saving (1 reviews) - Tracking (1 reviews) **Cons:** - Difficult Setup (1 reviews) - Implementation Complexity (1 reviews) ### 5. [Crashtest Security](https://www.g2.com/products/crashtest-security/reviews) Crashtest Security is a SaaS-based security vulnerability scanner allowing agile development teams to ensure continuous security before every release. Our state-of-the-art dynamic application security testing (DAST) solution integrates seamlessly with your dev environment and protects multi-page and JavaScript apps, as well as microservices and APIs. Set up Crashtest Security Suite in minutes, get advanced crawling options, and automate your security. Whether you want to see vulnerabilities within the OWASP Top 10 or you want to go for deep scans, Crashtest Security is here to help you stay on top of your security and protect your code and customers. **Average Rating:** 5.0/5.0 **Total Reviews:** 2 **How Do G2 Users Rate Crashtest Security?** - **Has the product been a good partner in doing business?:** 10.0/10 (Category avg: 9.2/10) - **API / Integrations:** 10.0/10 (Category avg: 8.6/10) - **Test Automation:** 10.0/10 (Category avg: 8.7/10) **Who Is the Company Behind Crashtest Security?** - **Seller:** [Crashtest Security](https://www.g2.com/sellers/crashtest-security) - **Year Founded:** 2006 - **HQ Location:** Burlington, Massachusetts, United States - **LinkedIn® Page:** https://www.linkedin.com/company/veracode (541 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 50% Mid-Market, 50% Small-Business ### 6. [Data Theorem](https://www.g2.com/products/data-theorem-data-theorem/reviews) RamQuest’s solutions include our fully integrated closing, escrow accounting, imaging, transaction management, esigning, and digital marketplace solutions and are available on-premise or in a hosted environment **Average Rating:** 4.0/5.0 **Total Reviews:** 1 **Who Is the Company Behind Data Theorem?** - **Seller:** [Data Theorem](https://www.g2.com/sellers/data-theorem) - **Year Founded:** 2013 - **HQ Location:** Palo Alto, California, United States - **LinkedIn® Page:** https://www.linkedin.com/company/datatheorem/ (94 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 100% Enterprise ### 7. [esChecker MAST (SAST, DAST & IAST)](https://www.g2.com/products/eschecker-mast-sast-dast-iast/reviews) esChecker combines many years of penetration testing experience with a unique dynamic engine simulating attack techniques, such as reverse-engineering or code tampering. No source code is needed, only the app binary (Android apk or iOS ipa). esChecker provides immediate feedback about the way your app reacts against many hacking techniques. You can now spare your pentest budget for in-depth vulnerability analyses. **Average Rating:** 4.3/5.0 **Total Reviews:** 2 **Who Is the Company Behind esChecker MAST (SAST, DAST & IAST)?** - **Seller:** [eShard](https://www.g2.com/sellers/eshard) - **Year Founded:** 2015 - **HQ Location:** Pessac, FR - **LinkedIn® Page:** https://www.linkedin.com/company/eshard (47 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 100% Small-Business ### 8. [Nexora Cyber](https://www.g2.com/products/nexora-cyber/reviews) Nexora is an automated Dynamic Application Security Testing platform designed to help you find web vulnerabilities before they become real incidents. You scan your web applications and APIs continuously. Nexora identifies security risks based on OWASP Top 10, assigns clear risk scores, and shows you what needs to be fixed first. **Average Rating:** 4.5/5.0 **Total Reviews:** 1 **How Do G2 Users Rate Nexora Cyber?** - **Has the product been a good partner in doing business?:** 10.0/10 (Category avg: 9.2/10) - **Test Automation:** 10.0/10 (Category avg: 8.7/10) **Who Is the Company Behind Nexora Cyber?** - **Seller:** [Nexora](https://www.g2.com/sellers/nexora) - **HQ Location:** N/A - **LinkedIn® Page:** https://www.linkedin.com/company/No-Linkedin-Presence-Added-Intentionally-By-DataOps (1 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 100% Small-Business #### What Are Nexora Cyber's Pros and Cons? **Pros:** - Easy Setup (1 reviews) ### 9. [ProjectDiscovery](https://www.g2.com/products/projectdiscovery/reviews) ProjectDiscovery Cloud is a highly customizable vulnerability management platform built for the modern internet. ProjectDiscovery combines exploitable vulnerability detection with exposure management, powered by open-source technology, to provide security teams with a proactive and scalable vulnerability management solution without false positives. At our core is Nuclei, one of the fastest-growing open-source security tools with over 22k GitHub stars. Nuclei uses YAML-based detection templates to simulate real-world attack techniques, delivering highly accurate results with minimal false positives. Our global community of 100,000+ security professionals actively contributes to our suite of open-source tools and maintains nearly 10,000 Nuclei templates, often developing new vulnerability detection templates within hours of discovery. The platform integrates industry-leading asset discovery and reconnaissance capabilities to map both external and internal attack surfaces. It automatically enriches assets with critical attributes like HTTP status codes, detected technologies, and screenshots, providing real-time alerts for suspicious changes and a unified view of security exposure. Our AI-powered automation streamlines security workflows through AI-generated Nuclei templates, enabling rapid creation of custom security checks based on penetration tests, bug bounty findings, and internal red team discoveries. This innovation significantly reduces time to discovery while enabling continuous vulnerability monitoring and regression detection. ProjectDiscovery Cloud includes comprehensive internal scanning, reporting, and enterprise capabilities to meet compliance requirements. Organizations can replace traditional vulnerability scanners with our solution, leveraging current security budgets while gaining enhanced value. By combining community-driven intelligence, AI automation, and enterprise-grade capabilities, ProjectDiscovery Cloud delivers the speed, accuracy, and insights security teams need to build a modern and effective vulnerability management program. **Average Rating:** 5.0/5.0 **Total Reviews:** 4 **How Do G2 Users Rate ProjectDiscovery?** - **Has the product been a good partner in doing business?:** 9.4/10 (Category avg: 9.2/10) - **API / Integrations:** 10.0/10 (Category avg: 8.6/10) - **Detection Rate:** 10.0/10 (Category avg: 8.7/10) - **Test Automation:** 10.0/10 (Category avg: 8.7/10) **Who Is the Company Behind ProjectDiscovery?** - **Seller:** [ProjectDiscovery](https://www.g2.com/sellers/projectdiscovery) - **Year Founded:** 2020 - **HQ Location:** San Francisco, US - **Twitter:** @pdiscoveryio (41,470 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/projectdiscovery/ (45 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 75% Enterprise, 25% Mid-Market #### What Are ProjectDiscovery's Pros and Cons? **Pros:** - Customer Support (2 reviews) - Ease of Use (2 reviews) - Onboarding (2 reviews) - Accuracy of Results (1 reviews) - Cloud Integration (1 reviews) **Cons:** - Dashboard Issues (1 reviews) - Inadequate Analytics (1 reviews) - Integration Issues (1 reviews) - Lacking Features (1 reviews) - Limited Features (1 reviews) ### 10. [SAMI](https://www.g2.com/products/autnhive-sami/reviews) Assisted by AI, SAMI (Security Automated by Machine Intelligence) simplifies cyber related financial and operational risk management. Demonstrably reducing risk, saving cost, enhancing ROI, streamlining process and increasing revenue for our customers. **Average Rating:** 5.0/5.0 **Total Reviews:** 1 **Who Is the Company Behind SAMI?** - **Seller:** [Autnhive](https://www.g2.com/sellers/autnhive) - **Year Founded:** 2018 - **HQ Location:** West Bloomfeild, US - **LinkedIn® Page:** http://www.linkedin.com/company/autnhive (26 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 100% Small-Business ### 11. [VulnSign](https://www.g2.com/products/vulnsign/reviews) VulnSign is help to organizations enhance their cybersecurity posture and protect their web applications from potential threats. Our intuitive, user-friendly platform allows users to quickly and easily scan their web applications for vulnerabilities that could be exploited by cybercriminals. VulnSign is designed to easy to use, yet powerful enough to identify potential vulnerabilities in your web-based systems. Our team of security experts is constantly working to improve and update our DAST application, ensuring that it stays at the forefront of the cybersecurity industry. **Average Rating:** 5.0/5.0 **Total Reviews:** 1 **Who Is the Company Behind VulnSign?** - **Seller:** [VulnSign](https://www.g2.com/sellers/vulnsign) - **Year Founded:** 2022 - **HQ Location:** West Hollywood, US - **LinkedIn® Page:** http://www.linkedin.com/company/vulnsign (1 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 100% Small-Business ### 12. [AppScanOnline](https://www.g2.com/products/appscanonline/reviews) AppScanOnline is the leading provider of mobile app security software for today's developers. AppScanOnline's automated static vulnerability testing service quickly provides security teams with a detailed report compliant with both OWASP Top 10 and Industrial Development App standards, allowing developers to bring their application to market sooner. **Who Is the Company Behind AppScanOnline?** - **Seller:** [AppScanOnline](https://www.g2.com/sellers/appscanonline) - **Year Founded:** 2018 - **HQ Location:** Taipei, TW - **Twitter:** @AppScanOnline (26 Twitter followers) - **LinkedIn® Page:** http://www.linkedin.com/company/appscanonline (2 employees on LinkedIn®) ### 13. [Appvigil](https://www.g2.com/products/appvigil/reviews) Appvigil is a completely automated Mobile Reputation Protection Suite for Mobile Apps.Powered by patent pending technology, Appvigil employs intensive static, dynamic & stringent network analysis. **Who Is the Company Behind Appvigil?** - **Seller:** [Appvigil](https://www.g2.com/sellers/appvigil) - **HQ Location:** Seattle, US - **Twitter:** @appvigil_co (438 Twitter followers) - **LinkedIn® Page:** http://www.linkedin.com/company/fresh-help (1 employees on LinkedIn®) ### 14. [Bugsmirror MASST (Mobile Application Security Suite & Tools)](https://www.g2.com/products/bugsmirror-masst-mobile-application-security-suite-tools/reviews) Bugsmirror Mobile Application Security Suite & Tools (MASST) is designed specifically for your business, providing scalable, end-to-end security for your mobile app. From detection to protection, MASST ensures your app is safeguarded against evolving security threats. With MASST, you can focus on growing your business, knowing your app is fully protected at every stage. **Who Is the Company Behind Bugsmirror MASST (Mobile Application Security Suite & Tools)?** - **Seller:** [Bugsmirror](https://www.g2.com/sellers/bugsmirror) - **Year Founded:** 2021 - **HQ Location:** Indore, IN - **LinkedIn® Page:** https://www.linkedin.com/company/bugsmirror/ (17 employees on LinkedIn®) ### 15. [Conviso](https://www.g2.com/products/conviso/reviews) The Conviso Platform is a complete Application Security Posture Management (ASPM) solution that centralizes visibility, correlation, and prioritization of vulnerabilities across the software development lifecycle. It integrates with your existing SAST, DAST, SCA, IaC, and CI/CD tools, automates triage, and provides a unified view of risk — helping security and development teams work together to reduce complexity and strengthen AppSec maturity. **Who Is the Company Behind Conviso?** - **Seller:** [Conviso Application Security](https://www.g2.com/sellers/conviso-application-security) - **Year Founded:** 2008 - **HQ Location:** Curitiba, BR - **LinkedIn® Page:** https://www.linkedin.com/company/convisoappsec (81 employees on LinkedIn®) ### 16. [Enso Security](https://www.g2.com/products/enso-security/reviews) Enso Application Security Posture is a platform for AppSec teams to manage their day-to-day work, implement their security strategy into an AppSec organizational program, enforce it and automate it. And all of that in a scalable rapidly changing environment. AppSec teams struggle with prioritization - they may have a vision and concept of how to handle AppSec, but they don’t know where to invest and what actions to take. To keep up with R&D velocity and scale, Enso provides full visibility on the application inventory, focuses the AppSec teams on the most important tasks and insights, and takes a policy-based “call to action” approach so that the AppSec professionals won’t waste their time looking for application changes, prioritizing, or doing manual work. **Who Is the Company Behind Enso Security?** - **Seller:** [Enso Security](https://www.g2.com/sellers/enso-security) - **HQ Location:** Boston, Massachusetts, United States - **LinkedIn® Page:** https://www.linkedin.com/company/enso-security/ (1,331 employees on LinkedIn®) ### 17. [Fluid Attacks Continuous Hacking](https://www.g2.com/products/fluid-attacks-continuous-hacking/reviews) Implement Fluid Attacks' comprehensive, AI-powered solution into your SDLC and develop secure software without delays. As an all-in-one solution, Fluid Attacks accurately finds and helps you remediate vulnerabilities throughout the SDLC and ensures secure software development. The solution integrates its AI, automated tool, and team of pentesters to perform SAST, SCA, DAST, CSPM, SCR, PtaaS and RE to help you improve your security posture. This way, Fluid Attacks delivers accurate knowledge of the security status of your application. This means security goes alongside innovation without hindering your speed. Fluid Attacks provides you with expert knowledge about vulnerabilities and support options that enable you to remediate the security issues in your application. **Who Is the Company Behind Fluid Attacks Continuous Hacking?** - **Seller:** [Fluid Attacks](https://www.g2.com/sellers/fluid-attacks) - **Year Founded:** 2001 - **HQ Location:** San Francisco, US - **LinkedIn® Page:** https://www.linkedin.com/company/fluidattacks/ (136 employees on LinkedIn®) - **Phone:** +14154042154 ### 18. [Hexway ASOC](https://www.g2.com/products/hexway-asoc/reviews) Universal DevSecOps platform to simplify vulnerability management. Assess, analyze, and assign vulnerabilities, ensuring a secure and controlled environment. **Who Is the Company Behind Hexway ASOC?** - **Seller:** [Hexway](https://www.g2.com/sellers/hexway) - **HQ Location:** N/A - **LinkedIn® Page:** https://www.linkedin.com/company/hexway (2 employees on LinkedIn®) ### 19. [MeshaSec](https://www.g2.com/products/meshasec/reviews) Product Overview: The Autonomous Evolution of DAST MeshaSec is an autonomous DAST (Dynamic Application Security Testing) tool that scans web applications, APIs, and SPAs behind MFA, SSO, and TOTP authentication — without manual configuration. Built for DevSecOps teams and security engineers who need authenticated coverage with zero false positives. In 2026, security is no longer about just "finding bugs"—it’s about established Protocol Truth. MeshaSec orchestrates the identity handshake natively, treating your complex React/Vue/Angular applications as dynamic state machines rather than static pages. The result? 99.9% noise reduction, 100% authenticated coverage, and deterministic evidence fragments that your developers can act on instantly. Core Value Proposition: Why MeshaSec? 1. Identity-Aware Orchestration (Bypassing the Moat) Legacy scanners bounce off the entrance. MeshaSec natively orchestrates complex identity sessions, including: Enterprise SSO: Microsoft Entra ID (Azure AD), Okta, PingFederate, and Google Workspace. Adaptive MFA: Native TOTP/MFA fulfillment during scan execution. Session Continuity: Protocol-level heartbeats that detect 401/403 errors and silently re-authenticate to maintain continuous discovery. 2. Autonomous Discovery Nodes (Thinking Like an Attacker) Our discovery engine doesn't just crawl links; it understands application states. SPA Mastery: Native navigation of JS-rich environments (React, Vue, etc.). Shadow API Discovery: Uncovering private, undocumented endpoints hidden within client-side state transitions. Deep Business Logic Paths: Mapping every potential user journey to ensure no attack vector is left unverified. 3. Deterministic Protocol Truth (Ending the Triage War) Security teams are drowning in "Possible XSS" alerts. MeshaSec delivers Deterministic Verification: Raw Evidence Fragments: Every finding includes the raw HTTP Request and Response that triggered the flaw. 99.9% Deduplication: We correlate thousands of vectors into a single, irrefutable source of truth. Zero-Guessing Triage: If MeshaSec reports it, it exists. No probability scores—just proof. Technical Specifications & Standards Alignment MeshaSec is engineered to align with global security frameworks, making it the preferred choice for compliance-driven enterprises: OWASP Top 10 Mapping: Every vulnerability is automatically categorized under current OWASP standards. MITRE ATT&CK Integration: Specifically mapped to initial access and credential access techniques. Federal & Global Compliance: Native reporting for NIST 800-53, WASC v2.0, and SOC2 Readiness. Intelligence Isolation: AES-256 encryption-at-rest with total environment separation between scans. Use Cases: Industry Focus FinTech & Banking Secure portals protected by strict MFA and rotating session tokens. MeshaSec fulfills the identity handshake and audits deep behind the boundary without manual intervention. Enterprise SaaS Continuously map and secure multi-tenant dashboards and complex API surfaces that change daily. Our autonomous nodes scale with your deployment frequency About MeshaSec Headquartered in the global technology hub of Bengaluru, India. MeshaSec is committed to engineering the future of autonomous, identity-aware AppSec. We believe that security should be as agile as your code, and as deterministic as your logic. MeshaSec: Precision DAST for the Global Elite **Who Is the Company Behind MeshaSec?** - **Seller:** [MeshaSec](https://www.g2.com/sellers/meshasec) - **HQ Location:** Bengaluru, Karnataka, India - **LinkedIn® Page:** https://linkedin.com/company/meshasec (1 employees on LinkedIn®) ### 20. [Mobix](https://www.g2.com/products/mobix/reviews) Mobix is a SaaS mobile application testing platform that reduces application analysis costs and time, making tests creation and finding vulnerabilities effortless. Mobix's unique characteristics include: - Non-invasive tool, which augments existing SDLC (Software Development Life Cycle) - Automates 90% of the entire test coverage for dynamic and static analysis - No code, plug and play analysis - Automated recording of tests - Machine Learning to automatically adapt auto-tests - Scalable multithread testing, custom scan rules - Compliance to all major mobile security standards **Who Is the Company Behind Mobix?** - **Seller:** [Swordfish Security](https://www.g2.com/sellers/swordfish-security) - **HQ Location:** N/A - **LinkedIn® Page:** https://www.linkedin.com/company/No-Linkedin-Presence-Added-Intentionally-By-DataOps (1 employees on LinkedIn®) ### 21. [Nullify](https://www.g2.com/products/nullify/reviews) Get autonomous AppSec engineers with one click. We build AI agents that autonomously perform the first level of application security in developer environments. **Who Is the Company Behind Nullify?** - **Seller:** [Nullify](https://www.g2.com/sellers/nullify) - **HQ Location:** San Francisco, US - **LinkedIn® Page:** http://www.linkedin.com/company/nullifyai (27 employees on LinkedIn®) ### 22. [Outpost24 Scale](https://www.g2.com/products/outpost24-scale/reviews) Dynamic Application Security Testing for DevOps Frequent changes to applications, whether built by in-house DevOps teams or outsourced from commercial suppliers, means risk evaluation must shift towards continuous testing. Our Dynamic Application Security Testing (DAST) solution, provides critical assessments during the SDLC rapidly and efficiently with quick-and-easy configuration assessments. With an accessible REST API, Selenium integration, and automated reporting, Scale is designed to deliver the high-quality vulnerability findings needed to enable each iteration of the SDLC to confidently address issues before they are released to the next phase.  **Who Is the Company Behind Outpost24 Scale?** - **Seller:** [Outpost24](https://www.g2.com/sellers/outpost24) - **HQ Location:** Karlskrona, SE - **LinkedIn® Page:** http://www.linkedin.com/company/outpost24 (252 employees on LinkedIn®) ### 23. [Oversecured](https://www.g2.com/products/oversecured/reviews) Enterprise vulnerability scanner for Android and iOS apps. It offers app owners and developers the ability to secure each new version of a mobile app by integrating Oversecured into the development process. **Who Is the Company Behind Oversecured?** - **Seller:** [Oversecured](https://www.g2.com/sellers/oversecured) - **Year Founded:** 2020 - **HQ Location:** Dover, US - **LinkedIn® Page:** http://www.linkedin.com/company/oversecured (8 employees on LinkedIn®) ### 24. [Panoptic Scans](https://www.g2.com/products/panoptic-scans/reviews) Panoptic Scans is a hosted vulnerability scanning platform designed to bolster cybersecurity for businesses by offering automated, comprehensive network and application vulnerability scans. Our platform empowers users to schedule vulnerability scans - daily, weekly, monthly, or annually - to ensure compliance with stringent regulations like SOC 2, HIPAA, ISO 27001, NIST 800-53, CMMC, and GDPR. Leveraging powerful tools such as OpenVAS for network vulnerabilities, OWASP ZAP for application security, and Nmap for port scanning, Panoptic Scans identifies weaknesses like unpatched software, misconfigurations, and open ports that could be exploited by cyber threats. With features like email notifications, detailed scan reports, and a user-friendly API, it simplifies vulnerability management, making it ideal for SaaS companies, security teams, and agile development environments aiming to safeguard sensitive data and maintain robust compliance effortlessly. **Average Rating:** 5.0/5.0 **Total Reviews:** 1 **How Do G2 Users Rate Panoptic Scans?** - **Has the product been a good partner in doing business?:** 10.0/10 (Category avg: 9.2/10) - **API / Integrations:** 10.0/10 (Category avg: 8.6/10) - **Detection Rate:** 8.3/10 (Category avg: 8.7/10) - **Test Automation:** 8.3/10 (Category avg: 8.7/10) **Who Is the Company Behind Panoptic Scans?** - **Seller:** [Panoptic Scans](https://www.g2.com/sellers/panoptic-scans) - **Year Founded:** 2019 - **HQ Location:** N/A - **LinkedIn® Page:** https://www.linkedin.com/company/panoptic-scans (2 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 100% Mid-Market #### What Are Panoptic Scans's Pros and Cons? **Pros:** - Automated Scanning (1 reviews) - Automation (1 reviews) - Automation Testing (1 reviews) - Dashboard Usability (1 reviews) - Ease of Use (1 reviews) ### 25. [Proscan](https://www.g2.com/products/proscan/reviews) Proscan is a unified application security platform designed to help organizations streamline the management of their security tools. By integrating multiple standalone solutions into a single cohesive experience, Proscan provides comprehensive security visibility across the entire software stack. This platform replaces the complexity of managing various tools for static analysis, dynamic testing, and dependency scanning, allowing teams to focus on building secure applications without the hassle of juggling disparate systems. The platform is particularly beneficial for security teams, developers, and engineering leaders who require a consolidated view of application security risks. Proscan combines nine specialized security scanners, including Static Application Security Testing (SAST), which analyzes source code in over 30 programming languages using advanced detection methods. Dynamic Application Security Testing (DAST) further enhances security by testing live applications, identifying vulnerabilities that may only become apparent during runtime. Additionally, Software Composition Analysis (SCA) evaluates open-source dependencies across 196 package ecosystems, helping organizations detect known vulnerabilities before they can impact production environments. Proscan's capabilities extend beyond code analysis. It includes scanning for hardcoded secrets, misconfigurations in Infrastructure-as-Code, and vulnerabilities in container images. The platform also offers API security testing that validates endpoints against the OWASP API Security Top 10, ensuring robust protection for applications that leverage APIs. For organizations developing AI-powered applications, Proscan features a dedicated AI and LLM security scanner that identifies potential risks associated with prompt injections and other vulnerabilities, utilizing over 4,600 techniques mapped to the OWASP LLM Top 10. Artificial intelligence plays a crucial role in enhancing Proscan's efficiency and accuracy. The platform employs machine-learning algorithms to reduce false positives and prioritize vulnerabilities based on their potential impact. This intelligent approach allows teams to focus on the most critical security issues while providing clear explanations and actionable remediation guidance. Proscan integrates seamlessly into existing development workflows, offering IDE plugins and native CI/CD integrations that ensure security checks are part of the development process without causing disruptions. Compliance readiness is another key feature of Proscan, as it generates audit-ready reports aligned with major security standards, including OWASP Top 10, PCI DSS, HIPAA, and GDPR. This automated evidence collection simplifies the compliance process, providing organizations with the necessary documentation in various formats. Proscan is designed for security teams looking to consolidate fragmented toolchains, developers needing quick feedback, and managed security service providers managing multiple client environments, making it a versatile solution for modern application security challenges. **Who Is the Company Behind Proscan?** - **Seller:** [Proscan](https://www.g2.com/sellers/proscan) - **HQ Location:** N/A - **LinkedIn® Page:** https://www.linkedin.com/company/No-Linkedin-Presence-Added-Intentionally-By-DataOps (1 employees on LinkedIn®) ## What Is Dynamic Application Security Testing (DAST) Software? [DevSecOps Software](https://www.g2.com/categories/devsecops) ## What Software Categories Are Similar to Dynamic Application Security Testing (DAST) Software? - [Vulnerability Scanner Software](https://www.g2.com/categories/vulnerability-scanner) - [Penetration Testing Tools](https://www.g2.com/categories/penetration-testing-tools) - [Static Application Security Testing (SAST) Software](https://www.g2.com/categories/static-application-security-testing-sast) --- ## How Do You Choose the Right Dynamic Application Security Testing (DAST) Software? ### What You Should Know About Dynamic Application Security Testing (DAST) Software ### What is Dynamic Application Security Testing (DAST) Software? Dynamic application security testing (DAST) is one of the many technology groupings of security testing solutions. DAST is a form of black-box security testing, meaning it simulates realistic threats and attacks. This differs from other forms of testing such as static application security testing (SAST), a white-box testing methodology used to examine the source code of an application. DAST includes a number of testing components that operate while an application is running. Security professionals simulate real-world functionality through testing the application for vulnerabilities and then evaluate the effects on application performance. The methodology is often used to find issues near the end of the software development lifecycle. These issues may be tougher to fix than early flaws and bugs are, but those flaws pose a larger threat to critical components of an application. DAST can also be thought of as a methodology. It’s a different approach than traditional security testing because once a test is completed, there are still tests to be done. It involves periodic inspections as updates are pushed live or changes are made before release. While a penetration test or code scan might serve as a one-off test for specific vulnerabilities or bugs, dynamic testing can be performed continually throughout the lifecycle of an application. Key Benefits of Dynamic Application Security Testing (DAST) Software - Simulate realistic attacks and threats - Discover vulnerabilities not found in source code - Flexible and customizable testing options - Comprehensive assessment and scalable testing ### Why Use Dynamic Application Security Testing (DAST) Software? There are a number of testing solutions necessary for an all-encompassing approach to security testing and vulnerability discovery. Most start in the early stages of software development and help programmers discover bugs in the code and issues with the underlying framework or design. These tests require access to source code and are often used during development and quality assurance (QA) processes. While early testing solutions approach testing from the standpoint of the developer, DAST approaches testing from the standpoint of a hacker. These tools simulate real threats to a functional, running application. Security professionals can simulate common attacks such as SQL injection and cross-site scripting or customize tests to threats specific to their product. These tools offer a highly customizable solution for testing during the later stages of development and while applications are deployed. **Flexibility —** Users can schedule tests as they please or perform them continuously throughout an application’s or website’s lifecycle. Security professionals can modify environments to simulate their resources and infrastructure to ensure a realistic test and evaluation. They’re often scalable, as well, to see if increased traffic or usage would affect vulnerabilities and protection. Industries with more specific threats may require more specific testing. Security professionals may identify a threat specific to the health care industry or financial sector and alter tests to simulate the threats most common to them. If performed correctly, these tools offer some of the most realistic and customizable solutions to the threats present in real-world situations. **Comprehensiveness —** Threats are continuously evolving and expanding, making the ability to simulate multiple tests more necessary. DAST offers a versatile approach to testing, wherein security professionals can simulate and analyze each threat or attack type individually. These tests deliver comprehensive feedback and actionable insights that security and development teams use to remediate any issues, flaws, and vulnerabilities. These tools will first perform an initial crawl, or examination, of applications and websites from a third-party perspective. They interact with applications using HTTP, allowing the tools to examine applications built with any programming language or on any framework. The tool will then test for misconfigurations, which expose a greater attack surface than internal vulnerabilities. Additional tests can be run, depending on the solution, but all the results and discoveries can be stored for actionable remediation. **Continuous assessment —** Agile teams and other companies relying on frequent updates to applications should use DAST products with continuous assessment capabilities. SAST tools will provide more direct solutions for issues related to continuous integration processes, but DAST tools will provide a better view of how updates and changes will be seen from an outside perspective. Each new update may pose a new threat or unveil a new vulnerability; it is therefore crucial to continue testing even after applications have been completed and deployed. Unlike SAST, DAST also requires less access to potentially sensitive source code within the application. DAST approaches the situation from an outside perspective as simulated threats attempt to gain access to vulnerable systems or sensitive information. This can make it easier to perform tests continuously without requiring individuals to access source code or other internal systems. ### What are the Common Features of Dynamic Application Security Testing (DAST) Software? Standard functionality is included in most dynamic application security testing (DAST) solutions: **Compliance testing —** Compliance testing gives users the ability to test for various requirements from regulatory bodies. This can help ensure information is stored securely and protected from hackers. **Test automation —** Test automation is the feature powering continuous testing processes. This functionality operates by running prescripted tests as frequently as required without the need for hands-on or manual testing. **Manual testing —** Manual testing gives the user complete control over individual tests. These features allow users to perform hands-on live simulations and penetration tests. **Command-line tools —** The command-line interface (CLI) is the language interpreter of a computer. CLI capabilities will allow security testers to simulate threats directly from the terminal host system and input command sequences. **Static code analysis —** Static code analysis and static security testing is used to test from the inside out. These tools help security professionals examine application source code for security flaws without executing it. **Issue tracking —** Issue tracking helps security professionals and developers document flaws or vulnerabilities as they are discovered. Proper documentation will make it easier to organize the actionable insights provided by the DAST tool. **Reporting and analytics —** Reporting capabilities are important to DAST tools because they provide the information necessary to remediate any recently discovered vulnerabilities. Reporting and analytics features can also give teams a better idea of how attacks may affect application availability and performance. **Extensibility —** Many applications offer the ability to expand functionality through the use of integrations, APIs, and plugins. These extensible components provide the ability to extend the platform beyond its native feature set to include additional features and functionalities. ### Potential Issues with Dynamic Application Security Testing (DAST) Software **Testing coverage —** While DAST technologies have come a long way, DAST tools alone are unable to discover the majority of vulnerabilities. This is why most experts suggest pairing them with SAST solutions. Combining the two can decrease the rate at which false positives occur. They can also be used to simplify the continuous testing process for agile teams. While no tool will detect every vulnerability, DAST may be less efficient than other testing tools if used alone. **Late-stage issues —** DAST tools will require code to be compiled for each individual test because they rely on simulated functionality to test responses. This can be a roadblock for agile teams constantly integrating new code into an application. Reports are usually static and result from single tests. For agile teams, those reports can become outdated and lose value very quickly. This is just one more reason DAST tools should be used as a component of an all-encompassing security testing stack rather than a standalone solution. **Testing capabilities —** Because DAST tools do not access an application's underlying source code, there are a number of flaws DAST tools will be unable to detect. For example, DAST tools are most effective at simulating reflection, or call-and-response, attacks where they can simulate an input and receive a response. They are not, however, highly effective in discovering smaller vulnerabilities or flaws in areas of the application that are rarely touched by users. These issues, as well as vulnerabilities in the original source code, will need to be addressed by additional security testing technologies. ### Software and Services Related to Dynamic Application Security Testing (DAST) Software Most security software focuses on the vulnerabilities of networks and devices. Not all, but some, are used specifically for testing. But there are many different ways to tackle the topic, and using a combination of tools and testing methods is always more effective than relying on one tool alone. These are a few security tools used for various testing purposes. [**Static application security testing (SAST) software**](https://www.g2.com/categories/static-application-security-testing-sast) **—** SAST tools are used to inspect the underlying source code of an application, making them the perfect complement to DAST tools. Using the tools in tandem is often referred to as interactive application security testing (IAST). This can help combine the black-box nature of DAST and the white-box nature of SAST to both find errors in source code as well as errors in functionality and third-party components of an application. [**Vulnerability scanners**](https://www.g2.com/categories/vulnerability-scanner) **—** Some people use the term vulnerability scanner to describe DAST tools, but in reality DAST is just one component of most vulnerability scanners. DAST tools are application-specific, while vulnerability scanners typically provide a larger set of features for vulnerability management, risk assessment, and continuous testing. [**Static code analysis software**](https://www.g2.com/categories/static-code-analysis) **—** Static code analysis tools are more similar to SAST than DAST, in that they’re used to evaluate an application’s source code. These tools are less directed towards security but may provide SAST capabilities. They’re typically used to scan code for a number of flaws that include bugs, security vulnerabilities, performance issues, and any other issue that may present itself if source code is not tested and optimized.