# Best Dynamic Application Security Testing (DAST) Software - Page 4 *By [Lauren Worth](https://research.g2.com/insights/author/lauren-worth)* Dynamic application security testing (DAST) tools automate security tests for a variety of real-world threats. These tools typically test HTTP and HTML interfaces of web applications. DAST is a black-box testing method, meaning it is performed from the outside. Companies use these tools to identify vulnerabilities in their applications from an external perspective to better simulate threats most easily accessed by hackers outside their organization. There are similarities between DAST tools and other application security and vulnerability management solutions, but most other technologies perform internal tests and code analysis instead of focusing on black-box testing. [SAST vs DAST](https://research.g2.com/blog/sast-vs-dast) — Learn the difference To qualify for inclusion in the Dynamic Application Security Testing (DAST) category, a product must: - Test applications in their operational state - Perform external black-box security tests - Trace penetrations and exploits to their sources ## Top Dynamic Application Security Testing (DAST) Software at a Glance | # | Product | Rating | Best For | What Users Say | |---|---------|--------|----------|----------------| | 1 | [Aikido Security](https://www.g2.com/products/aikido-security/reviews) | 4.6/5.0 (145 reviews) | Low-noise DAST with unified AppSec scanning | "[Effortless Security Testing with Comprehensive Coverage](https://www.g2.com/survey_responses/aikido-security-review-12747129)" | | 2 | [Astra Pentest](https://www.g2.com/products/astra-pentest/reviews) | 4.6/5.0 (212 reviews) | Validated DAST with human-verified remediation workflows | "[Smooth Onboarding, Responsive Support, and Strong Pentest Lifecycle Controls](https://www.g2.com/survey_responses/astra-pentest-review-13001206)" | | 3 | [Burp Suite](https://www.g2.com/products/burp-suite/reviews) | 4.8/5.0 (126 reviews) | Proxy-intercept DAST with manual exploit depth | "[Complete Control Over Web Requests with Burp Suite](https://www.g2.com/survey_responses/burp-suite-review-12677559)" | | 4 | [Invicti (formerly Netsparker)](https://www.g2.com/products/invicti-formerly-netsparker/reviews) | 4.5/5.0 (68 reviews) | Proof-based DAST with CI/CD integration | "[Accurate, Actionable Scans with Minimal Noise](https://www.g2.com/survey_responses/invicti-formerly-netsparker-review-13079965)" | | 5 | [Qodex.ai](https://www.g2.com/products/qodex-ai/reviews) | 4.9/5.0 (60 reviews) | AI-automated API security testing with self-healing | "[Effortless AI Testing Automation That Accelerates Development](https://www.g2.com/survey_responses/qodex-ai-review-12088697)" | | 6 | [Tenable Nessus](https://www.g2.com/products/tenable-nessus/reviews) | 4.5/5.0 (289 reviews) | Credentialed network vulnerability scanning with remediation guidance | "[Self-Contained Nessus Scanning with Full Control in Offline Environments](https://www.g2.com/survey_responses/tenable-nessus-review-12937668)" | | 7 | [GitLab](https://www.g2.com/products/gitlab/reviews) | 4.5/5.0 (881 reviews) | Pipeline-embedded DAST with unified DevSecOps | "[GitLab’s All-in-One DevOps Platform with CI/CD and Security Scanning](https://www.g2.com/survey_responses/gitlab-review-12864830)" | | 8 | [Harness Platform](https://www.g2.com/products/harness-platform/reviews) | 4.6/5.0 (300 reviews) | — | "[Best tool for cost optimization and Repository](https://www.g2.com/survey_responses/harness-platform-review-11543262)" | | 9 | [Intruder](https://www.g2.com/products/intruder/reviews) | 4.8/5.0 (206 reviews) | Continuous external attack surface scanning with auto-remediation | "[Intruder: Insightful Vulnerability Management Platform That Strengthens Security Operation](https://www.g2.com/survey_responses/intruder-review-12395645)" | | 10 | [Pynt - API Security Testing](https://www.g2.com/products/pynt-api-security-testing/reviews) | 4.8/5.0 (44 reviews) | API-first DAST with CI/CD-native discovery | "[Comprehensive Review of Pynt Tool](https://www.g2.com/survey_responses/pynt-api-security-testing-review-10046930)" | --- ## What Are the Most Common Questions About Dynamic Application Security Testing (DAST) Software? *AI-generated · Last updated: May 26, 2026* ### Which DAST tool offers the most comprehensive testing coverage? Based on G2 reviews, Aikido Security stands out in this category because reviewers consistently describe broad coverage across application and related security testing workflows. According to verified users, it combines DAST with capabilities such as SAST, SCA, container scanning, cloud and infrastructure visibility, and vulnerability management in one place. G2 reviewers mention that this wider coverage helps teams reduce tool sprawl, centralize findings, and speed remediation. Reviewers also repeatedly call out straightforward setup, repository integrations, and developer-friendly workflows. While some users note that certain advanced enterprise controls are still maturing, recent feedback most often highlights Aikido Security for comprehensive, all-in-one testing breadth. ### What best DAST solutions for continuous security integration? Based on G2 reviews, buyers looking for continuous security integration often prioritize products that fit naturally into development pipelines, automate recurring scans, and reduce operational overhead. G2 reviewers mention that Aikido Security is commonly used inside DevSecOps workflows with repository integrations and automatic scanning, while Invicti is frequently praised for CI/CD integrations and proof-based testing in ongoing web application programs. According to verified users, GitLab is also valued when teams want security checks embedded directly into broader development and deployment workflows. Across recent reviews, the common buying themes are automation, clear reporting, faster remediation, and easier adoption by both security and engineering teams. **Here are some of the top-rated products on G2:** - [Aikido Security](https://www.g2.com/products/aikido-security/reviews) – used for automated security scanning inside developer and repository workflows with minimal setup - [Invicti (formerly Netsparker)](https://www.g2.com/products/invicti-formerly-netsparker/reviews) – chosen for ongoing web app scanning with CI/CD integrations and proof-based validation - [GitLab](https://www.g2.com/products/gitlab/reviews) – fits teams that want security checks embedded into pipelines, merge requests, and delivery workflows ### What best tools for combining DAST with SAST? Based on G2 reviews, teams that want DAST and SAST together often favor platforms that reduce tool switching and present findings in one workflow. According to verified users, Aikido Security is repeatedly described as an all-in-one platform that brings together DAST, SAST, SCA, and other security checks, which helps smaller teams and fast-moving engineering groups centralize remediation. G2 reviewers mention that Invicti is also used for combining DAST with SAST and SCA in a more unified process, especially for organizations managing larger portfolios. GitLab reviews similarly point to built-in security scanning within pipelines, making it useful for teams that want code and application testing closer to delivery processes. **Here are some of the top-rated products on G2:** - [Aikido Security](https://www.g2.com/products/aikido-security/reviews) – suited for teams wanting DAST, SAST, and related scanning in one developer-friendly platform - [Invicti (formerly Netsparker)](https://www.g2.com/products/invicti-formerly-netsparker/reviews) – useful for organizations seeking DAST plus SAST and SCA within a centralized workflow - [GitLab](https://www.g2.com/products/gitlab/reviews) – helps embed multiple application security checks into CI/CD and merge request processes ### Which DAST software integrates with CI/CD pipelines? Based on G2 reviews, Invicti is the strongest fit for this question because reviewers frequently highlight its integrations with CI/CD tools and automated testing workflows. According to verified users, it connects with tools such as Jenkins, GitLab, and Jira, and helps teams move security checks earlier into delivery cycles. G2 reviewers mention that its automation, proof-based validation, and reporting make it easier for development and security teams to focus on real issues instead of manually sorting through excessive noise. Recent feedback also notes that setup can require tuning for more complex environments, but the integration story appears consistently in the review data and is a key reason teams adopt it. ### Which is the best DAST tool for web application security? Based on G2 reviews, Burp Suite is the clearest answer for web application security use cases. According to verified users, it is widely valued for intercepting, modifying, and replaying web requests, which helps security teams uncover issues in application logic, authentication flows, and input handling. G2 reviewers mention Repeater, Proxy, Intruder, and the broader extension ecosystem as major strengths for deep hands-on testing. Recent reviews also describe Burp Suite as especially effective for web, API, and mobile dynamic testing, with strong support for both manual and automated workflows. Some users note pricing and resource usage concerns, but reviewers consistently position it as a leading tool for web application testing depth. ### What top DAST solutions for cloud-native applications? Based on G2 reviews, cloud-native buyers tend to favor products that can scan applications while also fitting modern DevSecOps and infrastructure-heavy workflows. G2 reviewers mention that Aikido Security is used across repositories, cloud environments, and container-related security checks, which makes it appealing for teams trying to consolidate tooling. According to verified users, Intruder is also used to monitor vulnerabilities across both cloud resources and applications from a single view. GitLab reviews similarly point to integrated pipelines, automation, and built-in security checks that support cloud-native development practices. Across the recent review set, buyers emphasize ease of setup, workflow integration, and the ability to reduce noise while keeping developers moving quickly. **Here are some of the top-rated products on G2:** - [Aikido Security](https://www.g2.com/products/aikido-security/reviews) – works well for teams combining application scans with repository, container, and cloud-focused workflows - [Intruder](https://www.g2.com/products/intruder/reviews) – fits organizations that want vulnerability visibility across cloud infrastructure and applications in one place - [GitLab](https://www.g2.com/products/gitlab/reviews) – supports cloud-native delivery with integrated pipelines, automation, and embedded security checks ### What best tools for detecting runtime security issues? Based on G2 reviews, buyers discussing runtime or live-application risk tend to value products that validate findings in running environments and reduce noisy results. According to verified users, Aikido Security is noted for helping teams connect code and external application risk, and one reviewer specifically highlighted its in-app protection capability for mitigating issues in legacy applications. G2 reviewers also describe Veracode Dynamic Analysis as useful for finding runtime vulnerabilities that static tools can miss, while Burp Suite is frequently used to inspect and manipulate live traffic during testing. The strongest common themes in recent feedback are actionable findings, clearer prioritization, and support for testing realistic application behavior. **Here are some of the top-rated products on G2:** - [Aikido Security](https://www.g2.com/products/aikido-security/reviews) – useful for teams wanting live application visibility alongside broader application security workflows - [Veracode Dynamic Analysis](https://www.g2.com/products/veracode-dynamic-analysis/reviews) – highlighted for identifying runtime vulnerabilities that static tools may miss - [Burp Suite](https://www.g2.com/products/burp-suite/reviews) – strong for analyzing live web traffic and validating exploitable issues during active testing ### What top platforms for automated application vulnerability testing? Based on G2 reviews, automated application vulnerability testing buyers often look for products that are easy to deploy, fast to scan, and clear in how they present findings. G2 reviewers mention that Intruder is valued for automated scanning, continuous updates, and low operational overhead, while Aikido Security is praised for automatic scans, developer-friendly workflows, and centralized issue management. According to verified users, Invicti also stands out for proof-based scanning and automation that supports earlier detection in development processes. Across the recent review data, the products most often associated with automation success are the ones that balance broad visibility, manageable noise levels, and integrations that help teams remediate quickly. **Here are some of the top-rated products on G2:** - [Intruder](https://www.g2.com/products/intruder/reviews) – designed for automated scanning, continuous monitoring, and straightforward remediation tracking - [Aikido Security](https://www.g2.com/products/aikido-security/reviews) – automates security scanning and helps developers prioritize and resolve issues faster - [Invicti (formerly Netsparker)](https://www.g2.com/products/invicti-formerly-netsparker/reviews) – supports automated web application scanning with validated findings and detailed reporting ### What top-rated DAST platforms for enterprise applications? Based on G2 reviews, enterprise buyers generally look for scalable scanning, centralized reporting, and support for more complex environments. According to verified users, Invicti is often chosen for larger application portfolios because of endpoint discovery, CI/CD integrations, proof-based validation, and reporting suited to both technical and executive audiences. G2 reviewers also point to Burp Suite for deep testing depth in professional security teams and to GitLab when enterprises want security controls embedded into a broader DevSecOps platform. Recent reviews suggest the best enterprise fit depends on whether the priority is scalable automated scanning, practitioner-led testing depth, or consolidating security within software delivery operations. **Here are some of the top-rated products on G2:** - [Invicti (formerly Netsparker)](https://www.g2.com/products/invicti-formerly-netsparker/reviews) – well suited for enterprise portfolios needing scalable scanning and centralized reporting - [Burp Suite](https://www.g2.com/products/burp-suite/reviews) – fits enterprise security teams that need deep manual and automated web testing capability - [GitLab](https://www.g2.com/products/gitlab/reviews) – useful for enterprises embedding security and compliance checks into a unified DevSecOps workflow ### Which DAST tool offers AI-driven vulnerability detection? Based on G2 reviews, Aikido Security is the strongest grounded answer because multiple reviewers reference AI-related capabilities alongside its broader application security workflow. According to verified users, the platform offers AI-generated pull request fixes and GitHub-related AI features that help teams move from detection to remediation faster. G2 reviewers mention that its developer-friendly design, automated scanning, and prioritization reduce noise and help smaller teams stay productive. Reviewers also note some AI limitations, including cases where GitHub AI suggestions were not always accurate, but the recent review data still shows more direct AI-driven workflow mentions for Aikido Security than for most other products in this category. ## G2 Grid® for Dynamic Application Security Testing (DAST) Software ![G2 Grid® for Dynamic Application Security Testing (DAST) Software plotting products by satisfaction and market presence](https://www.g2.com/categories/dynamic-application-security-testing-dast/grids.png?focus%5B%5D=1259627&focus%5B%5D=154599&focus%5B%5D=32486&focus%5B%5D=1332841&focus%5B%5D=32484&focus%5B%5D=32494&focus%5B%5D=19003&focus%5B%5D=100655) Highlighted products: Aikido Security, Astra Pentest, Burp Suite, Qodex.ai, Invicti (formerly Netsparker), Tenable Nessus, GitLab, and Harness Platform. Underlying data: [Grid® JSON](https://www.g2.com/categories/dynamic-application-security-testing-dast/grids.json?focus%5B%5D=aikido-security&focus%5B%5D=astra-pentest&focus%5B%5D=burp-suite&focus%5B%5D=qodex-ai&focus%5B%5D=invicti-formerly-netsparker&focus%5B%5D=tenable-nessus&focus%5B%5D=gitlab&focus%5B%5D=harness-platform) ## How Many Dynamic Application Security Testing (DAST) Software Products Does G2 Track? **Total Products under this Category:** 94 ### Category Stats (Jul 2026) - **Average Rating**: 4.56/5 The average rating of products in this category, based on all submitted ratings - **Top Trending Product**: Checkmarx (+0.84%) - Among all products in this category, Checkmarx recorded the largest rating increase compared to last month *Last updated: July 13, 2026* ## How Does G2 Rank Dynamic Application Security Testing (DAST) Software Products? **Why You Can Trust G2's Software Rankings:** - 30 Analysts and Data Experts - 3,900+ Authentic Reviews - 94+ Products - Unbiased Rankings G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category. ## Which Dynamic Application Security Testing (DAST) Software Is Best for Your Use Case? - **Leader:** [Aikido Security](https://www.g2.com/products/aikido-security/reviews) - **Highest Performer:** [Qodex.ai](https://www.g2.com/products/qodex-ai/reviews) - **Easiest to Use:** [Qodex.ai](https://www.g2.com/products/qodex-ai/reviews) - **Top Trending:** [Aikido Security](https://www.g2.com/products/aikido-security/reviews) - **Best Free Software:** [Tenable Nessus](https://www.g2.com/products/tenable-nessus/reviews) --- **Sponsored** ### Aikido Security Aikido Security is the developer-first security platform that unifies code, cloud, protection, and attack testing in one suite of best-in-class products. Built by developers for developers, Aikido helps teams of any size ship secure software faster, automate protection, and simulate real-world attacks with AI-driven precision. The platform’s proprietary AI cuts noise by 95%, delivers one-click fixes, and saves developers 10+ hours per week. Aikido Intel proactively uncovers vulnerabilities in open source packages before disclosure, helping secure more than 50,000 organizations worldwide, including Revolut, Niantic, Visma, Montblanc, and GoCardless. [Visit website](https://www.g2.com/external_clickthroughs/record?secure%5Bad_program%5D=ppc&secure%5Bad_slot%5D=category_product_list&secure%5Bcategory_id%5D=1521&secure%5Bchosen_at%5D=2026-07-14T01%3A52%3A51Z&secure%5Bdisplayable_resource_id%5D=1521&secure%5Bdisplayable_resource_type%5D=Category&secure%5Bmedium%5D=sponsored&secure%5Bplacement_reason%5D=page_category&secure%5Bplacement_resource_ids%5D%5B%5D=1521&secure%5Bprioritized%5D=false&secure%5Bproduct_id%5D=1259627&secure%5Bresource_id%5D=1521&secure%5Bresource_type%5D=Category&secure%5Bsource_type%5D=category_page&secure%5Bsource_url%5D=https%3A%2F%2Fwww.g2.com%2Fcategories%2Fdynamic-application-security-testing-dast%3Fopen_modal_url%3D%252Fproducts%252Fopentext-opentext-core-application-security%252Fwishlists%253Fhost_path%253D%25252Fcategories%25252Fdynamic-application-security-testing-dast%2526source%253Dcategory&secure%5Btoken%5D=61e963724f9508adf1ca5e5f2efac328094b2b9a95d792b1d972a058cd28ded0&secure%5Burl%5D=https%3A%2F%2Fwww.aikido.dev%2Fattack%2Fsurface-monitoring-dast%3Futm_source%3Dg2%26utm_campaign%3Dg2-promoted-listing-dast%26utm_medium%3Dcpc&secure%5Burl_type%5D=custom_url) --- ## What Are the Top-Rated Dynamic Application Security Testing (DAST) Software Products in 2026? ### 1. [Proscan](https://www.g2.com/products/proscan/reviews) Proscan is a unified application security platform designed to help organizations streamline the management of their security tools. By integrating multiple standalone solutions into a single cohesive experience, Proscan provides comprehensive security visibility across the entire software stack. This platform replaces the complexity of managing various tools for static analysis, dynamic testing, and dependency scanning, allowing teams to focus on building secure applications without the hassle of juggling disparate systems. The platform is particularly beneficial for security teams, developers, and engineering leaders who require a consolidated view of application security risks. Proscan combines nine specialized security scanners, including Static Application Security Testing (SAST), which analyzes source code in over 30 programming languages using advanced detection methods. Dynamic Application Security Testing (DAST) further enhances security by testing live applications, identifying vulnerabilities that may only become apparent during runtime. Additionally, Software Composition Analysis (SCA) evaluates open-source dependencies across 196 package ecosystems, helping organizations detect known vulnerabilities before they can impact production environments. Proscan's capabilities extend beyond code analysis. It includes scanning for hardcoded secrets, misconfigurations in Infrastructure-as-Code, and vulnerabilities in container images. The platform also offers API security testing that validates endpoints against the OWASP API Security Top 10, ensuring robust protection for applications that leverage APIs. For organizations developing AI-powered applications, Proscan features a dedicated AI and LLM security scanner that identifies potential risks associated with prompt injections and other vulnerabilities, utilizing over 4,600 techniques mapped to the OWASP LLM Top 10. Artificial intelligence plays a crucial role in enhancing Proscan's efficiency and accuracy. The platform employs machine-learning algorithms to reduce false positives and prioritize vulnerabilities based on their potential impact. This intelligent approach allows teams to focus on the most critical security issues while providing clear explanations and actionable remediation guidance. Proscan integrates seamlessly into existing development workflows, offering IDE plugins and native CI/CD integrations that ensure security checks are part of the development process without causing disruptions. Compliance readiness is another key feature of Proscan, as it generates audit-ready reports aligned with major security standards, including OWASP Top 10, PCI DSS, HIPAA, and GDPR. This automated evidence collection simplifies the compliance process, providing organizations with the necessary documentation in various formats. Proscan is designed for security teams looking to consolidate fragmented toolchains, developers needing quick feedback, and managed security service providers managing multiple client environments, making it a versatile solution for modern application security challenges. **Who Is the Company Behind Proscan?** - **Seller:** [Proscan](https://www.g2.com/sellers/proscan) - **HQ Location:** N/A - **LinkedIn® Page:** https://www.linkedin.com/company/No-Linkedin-Presence-Added-Intentionally-By-DataOps (1 employees on LinkedIn®) ### 2. [ProtoCrawler](https://www.g2.com/products/protocrawler/reviews) ProtoCrawler is an intelligent fuzz testing solution, used to identify security weaknesses and implementation bugs. **Who Is the Company Behind ProtoCrawler?** - **Seller:** [Cytal](https://www.g2.com/sellers/cytal) - **Year Founded:** 2020 - **HQ Location:** Peterborough, GB - **Twitter:** @CyTAL_UK (36 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/cytal-uk-ltd/ (13 employees on LinkedIn®) ### 3. [PT Application Inspector](https://www.g2.com/products/pt-application-inspector/reviews) PT Application Inspector™ (PT AI™) is a comprehensive source code analysis tool that offers protection for web applications of any scale. Its holistic approach combines the advantages of static, dynamic, and interactive analysis to maintain application security throughout every stage of development—from the very first line of code to the go-live. **Average Rating:** 5.0/5.0 **Total Reviews:** 2 **How Do G2 Users Rate PT Application Inspector?** - **Has the product been a good partner in doing business?:** 10.0/10 (Category avg: 9.2/10) **Who Is the Company Behind PT Application Inspector?** - **Seller:** [Positive Technologies](https://www.g2.com/sellers/positive-technologies) - **HQ Location:** N/A - **Twitter:** @PTsecurity_UK (6 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/positivetechnologies/ (776 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 67% Enterprise, 33% Small-Business #### What Are Recent G2 Reviews of PT Application Inspector? **"[We chose PT AI for SDL](https://www.g2.com/survey_responses/pt-application-inspector-review-3356602)"** **Rating:** 5.0/5.0 stars *— Verified User in Information Technology and Services* [Read full review](https://www.g2.com/survey_responses/pt-application-inspector-review-3356602) --- **"[Nice source code analyzer ](https://www.g2.com/survey_responses/pt-application-inspector-review-3394127)"** **Rating:** 5.0/5.0 stars *— Verified User in Banking* [Read full review](https://www.g2.com/survey_responses/pt-application-inspector-review-3394127) --- #### What Are G2 Users Discussing About PT Application Inspector? - [What is PT Application Inspector used for?](https://www.g2.com/discussions/what-is-pt-application-inspector-used-for) ### 4. [Quokka Q-mast](https://www.g2.com/products/quokka-q-mast/reviews) Designed for app development, Q-mast embeds security directly into your workflow to identify security, privacy, and compliance risks before the mobile app is released. With a design tailored for DevSecOps workflows, Q-mast supports continuous, automated security testing that aligns with tools like Jenkins, GitLab, and GitHub. Q-mast capabilities: • Automated scanning in minutes, no source code needed • Analysis of compiled app binary, regardless of in-app or run-time obfuscations • Precise SBOM generation and analysis for vulnerability reporting to specific library version, including embedded libraries • Comprehensive static (SAST), dynamic (DAST), interactive (IAST), and forced-path execution app analysis • Malicious behavior profiling, including app collusion • Checks against privacy & security standards: NIAP, NIST, MASVS **Who Is the Company Behind Quokka Q-mast?** - **Seller:** [Quokka (formerly Kryptowire)](https://www.g2.com/sellers/quokka-formerly-kryptowire) - **Year Founded:** 2011 - **HQ Location:** San Jose, US - **LinkedIn® Page:** https://www.linkedin.com/company/quokka-io/ (53 employees on LinkedIn®) ### 5. [Red Cloud](https://www.g2.com/products/red-cloud/reviews) With prooV Red Cloud, you can assess how technologies will react in the case of a cyberattack before you implement them It is a tailored, cloud-based environment that gives you the flexibility to carry out complex cybersecurity attacks on any type of software you are testing. You can use Red Cloud with the PoC Platform to include red team testing in your initial software testing and evaluation process, or you can use it on its own. **Who Is the Company Behind Red Cloud?** - **Seller:** [prooV](https://www.g2.com/sellers/proov) - **HQ Location:** Herzaliya Pituach, IL - **Twitter:** @prooV_inc (839 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/proov-inc/ (9 employees on LinkedIn®) ### 6. [SECURITY by HTTPCS](https://www.g2.com/products/security-by-httpcs/reviews) Detect security flaws in your website or web application and avoid being hacked. HTTPCS Security puts Machine Learning at the service of your cyber security to protect your site against hacking and data leaks. **Who Is the Company Behind SECURITY by HTTPCS?** - **Seller:** [HTTPCS by Ziwit](https://www.g2.com/sellers/httpcs-by-ziwit) - **Year Founded:** 2011 - **HQ Location:** Montpellier, FR - **Twitter:** @httpcs (2,812 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/ziwit/ (27 employees on LinkedIn®) ### 7. [SmartScanner](https://www.g2.com/products/smartscanner/reviews) SmartScanner is an AI-powered web vulnerability scanner designed to enhance the security of websites and applications. It offers features such as comprehensive vulnerability detection, support for various technologies, and a user-friendly interface that automates dynamic application security testing (DAST). Targeting a wide range of clients needing web security, SmartScanner provides detailed reports and flexible pricing options, making it a budget-friendly choice for organizations of all sizes. With its adaptive intelligence, it ensures optimal results tailored to the unique characteristics of each website. **Who Is the Company Behind SmartScanner?** - **Seller:** [Smart Web Security](https://www.g2.com/sellers/smart-web-security) - **HQ Location:** N/A - **LinkedIn® Page:** https://www.linkedin.com/company/No-Linkedin-Presence-Added-Intentionally-By-DataOps (1 employees on LinkedIn®) ### 8. [Sn1per Professional](https://www.g2.com/products/sn1persecurity-llc-sn1per-professional/reviews) Sn1per Professional is an all-in-one offensive security platform that provides a comprehensive view of your internal and external attack surface and offers an asset risk scoring system to prioritize, reduce, and manage risk. With Sn1per Professional, you can discover the attack surface and continuously monitor it for changes. It integrates with the leading open source and commercial security testing tools for a unified view of your data. **Average Rating:** 4.5/5.0 **Total Reviews:** 1 **Who Is the Company Behind Sn1per Professional?** - **Seller:** [Sn1perSecurity](https://www.g2.com/sellers/sn1persecurity) - **HQ Location:** Scottsdale, US - **LinkedIn® Page:** https://www.linkedin.com/company/sn1persecurity/ (1 employees on LinkedIn®) **Who Uses This Product?** - **Company Size:** 100% Enterprise #### What Are Recent G2 Reviews of Sn1per Professional? **"[Sn1per Professional review](https://www.g2.com/survey_responses/sn1per-professional-review-7540683)"** **Rating:** 4.5/5.0 stars *— Verified User in Military* [Read full review](https://www.g2.com/survey_responses/sn1per-professional-review-7540683) --- ### 9. [Sparrow DAST](https://www.g2.com/products/sparrow-dast/reviews) Sparrow DAST is a dynamic application security testing solution designed to identify and address security vulnerabilities in web applications. By automatically crawling subdirectories from a web application's URL, it detects potential security flaws, ensuring comprehensive coverage. The solution adheres to global security compliance standards such as OWASP Top 10 and CWE, enhancing software security and quality. Through event-based attack process simulations, Sparrow DAST enables users to quickly understand and mitigate web hacking processes, thereby preventing potential breaches. Key Features: - Automated Vulnerability Detection: Automatically crawls web application URLs to detect security vulnerabilities. - Comprehensive Coverage: Ensures compliance with global security standards like OWASP Top 10 and CWE. - Attack Process Simulation: Reproduces vulnerability attack processes through events, aiding in quick identification and understanding of web hacking methods. - Web-Based User Interface: Eliminates the need for installation, offering easy access via a web browser and centralized management of analysis results. - Powerful Analysis: Utilizes browser event replay technology to detect security vulnerabilities and analyzes open-source web libraries for potential issues. - Integration Support: Overcomes limitations of dynamic analysis through interaction with Sparrow SAST and RASP, providing IAST capability via the TrueScan function. - Detailed Analysis Reports: Provides clear vulnerability information, trends, and detailed reports with analysis methods, results, and solutions for each vulnerability. - Support for Latest Web Technologies: Analyzes web applications using technologies like HTML5 and AJAX, detecting vulnerabilities by reproducing various browser events. - Multi-User Optimization: Allows setting permissions and roles per user, with centralized management and sharing of analysis results among users. Primary Value and User Solutions: Sparrow DAST offers continuous protection of web applications from external attacks by thoroughly analyzing and identifying security vulnerabilities. Its automated detection and comprehensive coverage ensure that applications comply with global security standards, enhancing both security and quality. The solution's user-friendly interface and detailed reporting facilitate quick understanding and remediation of vulnerabilities, empowering organizations to maintain robust and secure web applications. **Who Is the Company Behind Sparrow DAST?** - **Seller:** [Sparrow Co., Ltd](https://www.g2.com/sellers/sparrow-co-ltd) - **Year Founded:** 2018 - **HQ Location:** Seoul, SK - **LinkedIn® Page:** https://www.linkedin.com/company/thesparrow/ (48 employees on LinkedIn®) ### 10. [SWAT](https://www.g2.com/products/swat/reviews) SWAT (the Secure Web Application Tactics) is a continuous vulnerability management solution. Continuous penetration testing and scanning Combine automated application security scanning with CREST certified manual testing to  identify software vulnerabilities and protect your critical web applications 24/7 Regular web app pen tests are expensive whilst automated application security scanners are not sufficient to identify advanced vulnerabilities like business logic errors. Business critical applications and the vulnerabilities associated with them are highly dynamic and need to be monitored continuously. When cost and time matters, our hybrid application security testing solution SWAT combines the best of both worlds from automated scanner and experienced pen testers to provide the most accurate and complete assessment of software vulnerabilities from SQL injections, XSS to OWASP top 10 and CVE in the infrastructure layer. **Who Is the Company Behind SWAT?** - **Seller:** [Outpost24](https://www.g2.com/sellers/outpost24) - **HQ Location:** Karlskrona, SE - **LinkedIn® Page:** http://www.linkedin.com/company/outpost24 (252 employees on LinkedIn®) ### 11. [Synopsys DAST](https://www.g2.com/products/synopsys-dast/reviews) Dynamic Application Security Testing (DAST) uses penetration testing while web applications are running to simulate an attack by a skilled and motivated attacker. **Who Is the Company Behind Synopsys DAST?** - **Seller:** [Synopsys](https://www.g2.com/sellers/synopsys-53e76f66-bf39-4c28-b0f2-97178ec8ddfd) - **Year Founded:** 1986 - **HQ Location:** Mountain View, CA - **Twitter:** @synopsys (24,435 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/2457/ (27,920 employees on LinkedIn®) - **Ownership:** NASDAQ:SNPS ### 12. [Traceable AI](https://www.g2.com/products/traceable-ai/reviews) Traceable is the industry’s leading API Security company that helps organizations protect their digital systems and assets in a cloud-first world where everything is interconnected. Traceable is the only intelligent and context-aware platform that powers complete API security. Security Posture Management: Traceable helps organizations dramatically improve their security posture with a real time, risk ranked catalog of all APIs in their ecosystem, conformance analysis, identification of shadow and orphaned APIs, and visibility of sensitive data flows. RunTime Threat Protection: Traceable observes user level transactions and applies mature machine learning algorithms to discover anomalous transactions, alert the security team, and block attacks at the user level. Threat management and analytics: Traceable helps organizations analyze attacks and incidents with its API data lake, which provides rich historical data of nominal and malicious traffic. API Security Testing throughout the SDLC: Traceable connects the security lifecycle together with the DevOps lifecycle providing automated API Security tests to be run within the CI pipeline. Digital Fraud Prevention: Traceable brings together its broad and deep data collection over time and cutting edge machine learning to identify fraud across all API transactions **Who Is the Company Behind Traceable AI?** - **Seller:** [Harness](https://www.g2.com/sellers/harness-25016f40-e80f-4417-bea8-39412055d17a) - **Year Founded:** 2018 - **HQ Location:** San Francisco - **Twitter:** @HarnessWealth (1,389 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/harnessinc/ (1,701 employees on LinkedIn®) **Who Uses This Product?** - **Top Industries:** Financial Services - **Company Size:** 5% Enterprise #### What Are Traceable AI's Pros and Cons? **Pros:** - Customer Support (11 reviews) - Security (8 reviews) - Setup Ease (4 reviews) - API Management (3 reviews) - Customization (2 reviews) **Cons:** - Limited Features (3 reviews) - False Positives (2 reviews) - Inefficiency (2 reviews) - Poor Documentation (2 reviews) - Poor Reporting (2 reviews) ### What Do G2 Reviewers Say About Traceable AI? *AI-generated summary from verified user reviews* **Pros:** - Users commend the **impressive customer support** of Traceable AI, highlighting their quick responses and helpful guidance. - Users commend the **robust security features** of Traceable AI, effectively protecting APIs from potential vulnerabilities and threats. - Users value the **setup ease** of Traceable AI, emphasizing quick deployment and immediate insights into API vulnerabilities. - Users value the **insightful API management** capabilities of Traceable AI, enhancing understanding and protection of their APIs. - Users appreciate the **customization options** of Traceable AI, allowing tailored solutions for diverse API security needs. **Cons:** - Users find **limited features** in Traceable AI, lacking essential options like saving queries and customizing the UI. - Users struggle with **false positives** in Traceable AI, finding it challenging to configure and customize threat management. - Users report **inefficiency** in Traceable AI's update process, leading to complications and increased costs due to data handling. - Users find the **poor documentation** of Traceable AI lacking, leading to challenges in deployment and integrations. - Users face **poor reporting** issues with Traceable AI, especially concerning historical data and scalability challenges. ### 13. [Trickest Platform](https://www.g2.com/products/trickest-platform/reviews) Trickest provides an innovative approach to offensive cybersecurity automation, assets, and vulnerability discovery. The platform combines extensive adversary tactics and techniques with full transparency, hypercustomization, and hyperscalability, making it the go-to platform for offensive security operations. The Trickest platform comes with comprehensive tooling, scripting, managed infrastructure, scaling, ready-to-go solutions, and analytics, serving as a collaborative command center for Offensive Security, Penetration testing, Red teams, Security Analysts, and Security Service providers (MSSPs). What makes us different? Easy customization of logic, inputs, outputs, and integrations, making them adaptable to specific needs and thus producing superior-quality data compared to others. Some of the automation workflows and solutions that our customers deploy and execute: - Attack Surface Discovery - Vulnerability Scanning - Dynamic Application Security Testing (DAST) - Recon/Information Gathering (Passive & Active) - Organization OSINT - CVE scanning - Cloud Scanning - DNS recon & research - Subdomain Enumeration - Subdomain Takeover - Custom Security Automation and Orchestration Main components of the Trickest platform include: Solutions & Analytics - Ready-to-go and transparent solutions for Attack Surface Discovery, Vulnerability Scanning, Dynamic Application Security Testing (DAST), and Open-source intelligence OSINT, offering insight into every step of the process, easy customization, and Analytics on the top. The Builder - Access to 90+ workflow templates, 300+ open-source tools, Bash & Python scripting, CLI for building custom workflows to discover asset, vulnerabilities, scan network & apps, crawl, spider, enumerate, fuzz, bruteforce and much more. Hyperscalability - Whether scanning regional infrastructures with 100s of 1000s of assets or smaller organizational scopes, Trickest supports it all without per-asset costs. **Who Is the Company Behind Trickest Platform?** - **Seller:** [Trickest](https://www.g2.com/sellers/trickest) - **Year Founded:** 2020 - **HQ Location:** Dover, US - **LinkedIn® Page:** https://www.linkedin.com/company/trickest/ (12 employees on LinkedIn®) ### 14. [TruStacks](https://www.g2.com/products/trustacks/reviews) TruStacks is a software delivery engine that offers standardized, efficient DevOps workflows to help teams ship products faster and more frequently. **Who Is the Company Behind TruStacks?** - **Seller:** [Cornerstone Technical Solutions](https://www.g2.com/sellers/cornerstone-technical-solutions) - **Year Founded:** 2012 - **HQ Location:** Wake Forest, US - **LinkedIn® Page:** https://www.linkedin.com/company/cornerstone-technical-solutions-llc (5 employees on LinkedIn®) ### 15. [Uleska](https://www.g2.com/products/uleska/reviews) Uleska helps security and development teams manage application security at scale by automating and orchestrating their preferred security tools within CI/CD. With Uleska, teams can confidently start an AppSec program using open-source, commercial, and custom tools and then quickly change, add or scale tools as the technology and business needs evolve. Uleska also brings speed and scale when integrating into development tools, and reporting of metrics and risk. By bringing security, DevOps and development teams together, we help reduce manual tasks so application security takes less time, cost and can scale, allowing teams to focus resources on the issues and metrics that matter. **Who Is the Company Behind Uleska?** - **Seller:** [Uleska](https://www.g2.com/sellers/uleska) - **HQ Location:** BELFAST, GB - **LinkedIn® Page:** http://www.linkedin.com/company/uleska-ltd (1 employees on LinkedIn®) ### 16. [Vector](https://www.g2.com/products/zauth-vector/reviews) Vector is an AI-powered black-box vulnerability scanner. Point it at any web application and it autonomously discovers attack surfaces, tests for vulnerabilities across multiple categories, and generates detailed security reports with proof-of-concept exploits. **Who Is the Company Behind Vector?** - **Seller:** [Zauth](https://www.g2.com/sellers/zauth) - **HQ Location:** N/A - **LinkedIn® Page:** https://www.linkedin.com/company/No-Linkedin-Presence-Added-Intentionally-By-DataOps (1 employees on LinkedIn®) ### 17. [we45](https://www.g2.com/products/we45/reviews) AppSec Testing(AST) - Whatever your motivation, a proactive security push or a compliance compulsion, our AST service can help keep your application secure against external threats. Security Automation - Secure your agile Software Development Life Cycle(SDLC) without compromising on quality or time. AppSec Training - Our numerous/variegated training offerings help product teams gain the security understanding necessary to keep their deployments secure. Orchestron - Make Application Security efficient with one of the most integral parts of a modern DevSecOps toolchain - An AVC engine. Threat PlayBook - A (relatively) Unopinionated framework that faciliates Threat Modeling as Code married with Application Security Automation on a single Fabric. Perform Iterative Threat Modeling in an Agile Environment with Threat Playbook. **Who Is the Company Behind we45?** - **Seller:** [we45](https://www.g2.com/sellers/we45) - **Year Founded:** 2019 - **HQ Location:** San Jose, US - **LinkedIn® Page:** https://www.linkedin.com/company/1155059 (37 employees on LinkedIn®) ### 18. [Web Application Scanning](https://www.g2.com/products/web-application-scanning/reviews) A Key Part of Fortra (the new face of HelpSystems) Digital Defense is proud to be part of Fortra’s comprehensive cybersecurity portfolio. Fortra simplifies today’s complex cybersecurity landscape by bringing complementary products together to solve problems in innovative ways. These integrated, scalable solutions address the fast-changing challenges you face in safeguarding your organization. With the help of the powerful protection from Frontline Web Application Scanning and others, Fortra is your relentless ally, here for you every step of the way throughout your cybersecurity journey. **Who Is the Company Behind Web Application Scanning?** - **Seller:** [Fortra](https://www.g2.com/sellers/fortra) - **Year Founded:** 1982 - **HQ Location:** Eden Prairie, Minnesota - **Twitter:** @fortraofficial (2,773 Twitter followers) - **LinkedIn® Page:** https://www.linkedin.com/company/fortra (1,755 employees on LinkedIn®) ### 19. [ZeroNorth](https://www.g2.com/products/zeronorth/reviews) Continuous security delivery fabric for modern enterprise infrastructure. **Who Is the Company Behind ZeroNorth?** - **Seller:** [ZeroNorth](https://www.g2.com/sellers/zeronorth) - **Year Founded:** 2015 - **HQ Location:** Boston, US - **LinkedIn® Page:** https://www.linkedin.com/company/10284735/admin/ (4 employees on LinkedIn®) ## What Is Dynamic Application Security Testing (DAST) Software? [DevSecOps Software](https://www.g2.com/categories/devsecops) ## What Software Categories Are Similar to Dynamic Application Security Testing (DAST) Software? - [Vulnerability Scanner Software](https://www.g2.com/categories/vulnerability-scanner) - [Penetration Testing Tools](https://www.g2.com/categories/penetration-testing-tools) - [API Security Tools](https://www.g2.com/categories/api-security) --- ## How Do You Choose the Right Dynamic Application Security Testing (DAST) Software? ### What You Should Know About Dynamic Application Security Testing (DAST) Software ### What is Dynamic Application Security Testing (DAST) Software? Dynamic application security testing (DAST) is one of the many technology groupings of security testing solutions. DAST is a form of black-box security testing, meaning it simulates realistic threats and attacks. This differs from other forms of testing such as static application security testing (SAST), a white-box testing methodology used to examine the source code of an application. DAST includes a number of testing components that operate while an application is running. Security professionals simulate real-world functionality through testing the application for vulnerabilities and then evaluate the effects on application performance. The methodology is often used to find issues near the end of the software development lifecycle. These issues may be tougher to fix than early flaws and bugs are, but those flaws pose a larger threat to critical components of an application. DAST can also be thought of as a methodology. It’s a different approach than traditional security testing because once a test is completed, there are still tests to be done. It involves periodic inspections as updates are pushed live or changes are made before release. While a penetration test or code scan might serve as a one-off test for specific vulnerabilities or bugs, dynamic testing can be performed continually throughout the lifecycle of an application. Key Benefits of Dynamic Application Security Testing (DAST) Software - Simulate realistic attacks and threats - Discover vulnerabilities not found in source code - Flexible and customizable testing options - Comprehensive assessment and scalable testing ### Why Use Dynamic Application Security Testing (DAST) Software? There are a number of testing solutions necessary for an all-encompassing approach to security testing and vulnerability discovery. Most start in the early stages of software development and help programmers discover bugs in the code and issues with the underlying framework or design. These tests require access to source code and are often used during development and quality assurance (QA) processes. While early testing solutions approach testing from the standpoint of the developer, DAST approaches testing from the standpoint of a hacker. These tools simulate real threats to a functional, running application. Security professionals can simulate common attacks such as SQL injection and cross-site scripting or customize tests to threats specific to their product. These tools offer a highly customizable solution for testing during the later stages of development and while applications are deployed. **Flexibility —** Users can schedule tests as they please or perform them continuously throughout an application’s or website’s lifecycle. Security professionals can modify environments to simulate their resources and infrastructure to ensure a realistic test and evaluation. They’re often scalable, as well, to see if increased traffic or usage would affect vulnerabilities and protection. Industries with more specific threats may require more specific testing. Security professionals may identify a threat specific to the health care industry or financial sector and alter tests to simulate the threats most common to them. If performed correctly, these tools offer some of the most realistic and customizable solutions to the threats present in real-world situations. **Comprehensiveness —** Threats are continuously evolving and expanding, making the ability to simulate multiple tests more necessary. DAST offers a versatile approach to testing, wherein security professionals can simulate and analyze each threat or attack type individually. These tests deliver comprehensive feedback and actionable insights that security and development teams use to remediate any issues, flaws, and vulnerabilities. These tools will first perform an initial crawl, or examination, of applications and websites from a third-party perspective. They interact with applications using HTTP, allowing the tools to examine applications built with any programming language or on any framework. The tool will then test for misconfigurations, which expose a greater attack surface than internal vulnerabilities. Additional tests can be run, depending on the solution, but all the results and discoveries can be stored for actionable remediation. **Continuous assessment —** Agile teams and other companies relying on frequent updates to applications should use DAST products with continuous assessment capabilities. SAST tools will provide more direct solutions for issues related to continuous integration processes, but DAST tools will provide a better view of how updates and changes will be seen from an outside perspective. Each new update may pose a new threat or unveil a new vulnerability; it is therefore crucial to continue testing even after applications have been completed and deployed. Unlike SAST, DAST also requires less access to potentially sensitive source code within the application. DAST approaches the situation from an outside perspective as simulated threats attempt to gain access to vulnerable systems or sensitive information. This can make it easier to perform tests continuously without requiring individuals to access source code or other internal systems. ### What are the Common Features of Dynamic Application Security Testing (DAST) Software? Standard functionality is included in most dynamic application security testing (DAST) solutions: **Compliance testing —** Compliance testing gives users the ability to test for various requirements from regulatory bodies. This can help ensure information is stored securely and protected from hackers. **Test automation —** Test automation is the feature powering continuous testing processes. This functionality operates by running prescripted tests as frequently as required without the need for hands-on or manual testing. **Manual testing —** Manual testing gives the user complete control over individual tests. These features allow users to perform hands-on live simulations and penetration tests. **Command-line tools —** The command-line interface (CLI) is the language interpreter of a computer. CLI capabilities will allow security testers to simulate threats directly from the terminal host system and input command sequences. **Static code analysis —** Static code analysis and static security testing is used to test from the inside out. These tools help security professionals examine application source code for security flaws without executing it. **Issue tracking —** Issue tracking helps security professionals and developers document flaws or vulnerabilities as they are discovered. Proper documentation will make it easier to organize the actionable insights provided by the DAST tool. **Reporting and analytics —** Reporting capabilities are important to DAST tools because they provide the information necessary to remediate any recently discovered vulnerabilities. Reporting and analytics features can also give teams a better idea of how attacks may affect application availability and performance. **Extensibility —** Many applications offer the ability to expand functionality through the use of integrations, APIs, and plugins. These extensible components provide the ability to extend the platform beyond its native feature set to include additional features and functionalities. ### Potential Issues with Dynamic Application Security Testing (DAST) Software **Testing coverage —** While DAST technologies have come a long way, DAST tools alone are unable to discover the majority of vulnerabilities. This is why most experts suggest pairing them with SAST solutions. Combining the two can decrease the rate at which false positives occur. They can also be used to simplify the continuous testing process for agile teams. While no tool will detect every vulnerability, DAST may be less efficient than other testing tools if used alone. **Late-stage issues —** DAST tools will require code to be compiled for each individual test because they rely on simulated functionality to test responses. This can be a roadblock for agile teams constantly integrating new code into an application. Reports are usually static and result from single tests. For agile teams, those reports can become outdated and lose value very quickly. This is just one more reason DAST tools should be used as a component of an all-encompassing security testing stack rather than a standalone solution. **Testing capabilities —** Because DAST tools do not access an application's underlying source code, there are a number of flaws DAST tools will be unable to detect. For example, DAST tools are most effective at simulating reflection, or call-and-response, attacks where they can simulate an input and receive a response. They are not, however, highly effective in discovering smaller vulnerabilities or flaws in areas of the application that are rarely touched by users. These issues, as well as vulnerabilities in the original source code, will need to be addressed by additional security testing technologies. ### Software and Services Related to Dynamic Application Security Testing (DAST) Software Most security software focuses on the vulnerabilities of networks and devices. Not all, but some, are used specifically for testing. But there are many different ways to tackle the topic, and using a combination of tools and testing methods is always more effective than relying on one tool alone. These are a few security tools used for various testing purposes. [**Static application security testing (SAST) software**](https://www.g2.com/categories/static-application-security-testing-sast) **—** SAST tools are used to inspect the underlying source code of an application, making them the perfect complement to DAST tools. Using the tools in tandem is often referred to as interactive application security testing (IAST). This can help combine the black-box nature of DAST and the white-box nature of SAST to both find errors in source code as well as errors in functionality and third-party components of an application. [**Vulnerability scanners**](https://www.g2.com/categories/vulnerability-scanner) **—** Some people use the term vulnerability scanner to describe DAST tools, but in reality DAST is just one component of most vulnerability scanners. DAST tools are application-specific, while vulnerability scanners typically provide a larger set of features for vulnerability management, risk assessment, and continuous testing. [**Static code analysis software**](https://www.g2.com/categories/static-code-analysis) **—** Static code analysis tools are more similar to SAST than DAST, in that they’re used to evaluate an application’s source code. These tools are less directed towards security but may provide SAST capabilities. They’re typically used to scan code for a number of flaws that include bugs, security vulnerabilities, performance issues, and any other issue that may present itself if source code is not tested and optimized.