No. 11 of 35 ·Penetration Testing Software

Burp Suite DAST

Web · Windows · Linux · Self-hosted · API

Freedom report

Two barsScore 5.6

Free tierNo free tier on record
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

Burp Suite DAST is ranked #11 of 35 in penetration testing software on Freedom251. It runs on API, Linux, Self-hosted, Web, Windows. A free trial is offered.

Burp Suite DAST plans and pricing

All plans

Burp Suite DAST Not published Tailored solution; pricing depends on portfolio; contact PortSwigger portswigger.net · 4 Oct 2026

Compared on penetration testing software

Authenticated scanning: Yes
API testing: Yes
Browser-based scanning: Yes
CI/CD integration: Yes
Deployment model: hybrid

Best Burp Suite DAST alternatives

See all 20

Two bars Caido Free tier No. 1Free6.7 Two bars Dradis Free tier No. 2$300/mo6.7 Two bars Pentesterra Free tier No. 3€23/mo6.7 Two bars Kali Linux Free tier No. 4Free6.6 Two bars OWASP Amass Free tier No. 5Free6.6 Two bars RedAmon Free tier No. 6Free6.6

The record

Purpose: Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.
Modern web scanning: Its Chromium-based crawler handles JavaScript single-page apps, dynamic forms, GraphQL endpoints, and asynchronous loads, with parallel crawl and audit.
API coverage: It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication.
Custom checks: BChecks authored for Burp Suite Professional run unchanged in Burp Suite DAST.
Access controls: The product supports role-based access control, site groups, audit trails, SAML single sign-on, and scan policy templates that can be locked per group.
Deployment: Burp Suite DAST is available as managed cloud service or self-hosted software, including Windows and Linux installers and a Helm deployment for Kubernetes.
Air-gapped use: The self-hosted deployment supports air-gapped environments and can use PostgreSQL or Oracle for production.
Integrations: Named CI/CD integrations include Jenkins, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, CircleCI, and TeamCity; findings can be delivered to Jira, ServiceNow, Azure Boards, and GitHub Issues.
API automation: A GraphQL API can trigger scans, fetch findings, manage sites, and send results to internal tools.
AI features: Optional Burp AI features include AI-enhanced issue investigation and AI-generated recorded logins; DAST administrators must enable the features for an instance.
AI data handling: The maker says AI request data is not stored by its AI providers and that Burp AI communications use TLS 1.2 or later; the AI documentation says the service is covered by PortSwigger’s ISO 27001 certification.
Support: The product page describes technical support from specialists, SLA-backed support for enterprise, onboarding, and a named solutions architect for the enterprise tier.
Pricing availability: The official pricing page displays a plans heading but no plan prices or limits in its readable page content; the product page directs buyers to request a demo or talk to sales.
API scanning: It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication.

Where it ranks on Freedom251

Best Penetration Testing Software in 2026#11 of 35
Best Web Application Security Scanners in 2026#10 of 31
Best Dynamic Application Security Testing Software in 2026#6 of 28

Is Burp Suite DAST yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Burp Suite DAST

Sources

portswigger.net/burp/dast· checked 4 Oct 2026
portswigger.net/burp/documentation/dast/user-guide/usin· checked 4 Oct 2026
portswigger.net/burp/documentation/ai-features/trust· checked 4 Oct 2026
portswigger.net/burp/dast/pricing· checked 4 Oct 2026
portswigger.net/burp/documentation/dast/user-guide/refe· checked 4 Oct 2026
portswigger.net/burp/dast/trial· checked 4 Oct 2026
portswigger.net/about· checked 4 Oct 2026