Freedom251 › Dynamic Application Security Testing Software
Burp Suite DAST
What Burp Suite DAST is
Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional. Its Chromium-based crawler handles JavaScript single-page apps, dynamic forms, GraphQL endpoints, and asynchronous loads, with parallel crawling and auditing. Session-aware scanning maintains authenticated state using username and password pairs or recorded login sequences. The scanner accepts API definitions from Postman Collections, OpenAPI, SOAP, and GraphQL, with Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication. Teams can schedule portfolio scans from a dashboard or run them in CI pipelines, including on pull requests and merges. Deployment options include managed cloud service and self-hosted software, including Windows and Linux installers and a Kubernetes Helm deployment. Self-hosted use supports air-gapped environments. Access controls include role-based access, site groups, audit trails, SAML single sign-on, and group-locked scan policies. Findings include the captured request and confirming response. Pricing is available on request and depends on the portfolio. PortSwigger offers a guided proof-of-concept trial after a tailored demo and discovery call; documentation also describes a self-hosted trial setup.
Who it suits
Burp Suite DAST suits teams scanning modern web applications and APIs, including teams that want to schedule scans or run them in CI pipelines. Its cloud and self-hosted options also serve teams with air-gapped environments.
What it does well
- Scans modern web apps and APIs.
- Supports authenticated, scheduled, and CI pipeline scans.
- Offers managed cloud and self-hosted deployment.
- Includes role-based access controls and audit trails.
- Findings include captured requests and confirming responses.
What to know first
- Pricing is available only on request.
- Trial follows a tailored demo and discovery call.
- Self-hosted deployment requires managing the software.
Limits
Pricing is tailored to the portfolio and available by request. The guided proof-of-concept trial is offered after a tailored demo and a 30-minute discovery call.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Burp Suite DAST | Tailored solution; pricing depends on portfolio; contact PortSwigger | On request |
As portswigger.net lists them, read 4 Oct 2026. The maker's own page has the final word.
Getting started
- Visit https://portswigger.net/burp/dast.
- Request a demo or talk to sales about portfolio pricing.
- Arrange a tailored demo and 30-minute discovery call for a guided proof-of-concept trial.
- Choose managed cloud or self-hosted deployment.
- For self-hosting, use a Windows or Linux installer or deploy with Helm on Kubernetes.
- Set up sites, roles and scan policy templates for the team.
Verdict
Burp Suite DAST covers web applications and APIs, with scan automation, access controls, and cloud or self-hosted deployment. Buyers need to contact PortSwigger for portfolio-based pricing and arrange a demo for the guided trial.
Questions
How much does Burp Suite DAST cost?
Pricing depends on the portfolio and requires contacting PortSwigger.
Is there a free trial?
PortSwigger offers a guided proof-of-concept trial after a tailored demo and a 30-minute discovery call. Documentation also describes a self-hosted trial setup.
Which APIs can Burp Suite DAST scan?
It scans APIs defined by Postman Collections, OpenAPI, SOAP and GraphQL.
What deployment options are available?
It is available as a managed cloud service or self-hosted software, including Windows and Linux installers and Helm deployment for Kubernetes.
Which CI/CD tools does it integrate with?
Named integrations include Jenkins, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, CircleCI and TeamCity.
What authentication methods does API scanning support?
Native methods include Basic, Bearer Token, API Key and OAuth 2.0 Client Credentials.
Facts from Burp Suite DAST's own pages
- Access controls
- The product supports role-based access control, site groups, audit trails, SAML single sign-on, and scan policy templates that can be locked per group. · portswigger.net, 4 Oct 2026
- AI data handling
- The maker says AI request data is not stored by its AI providers and that Burp AI communications use TLS 1.2 or later; the AI documentation says the service is covered by PortSwigger’s ISO 27001 certification. · portswigger.net, 4 Oct 2026
- AI features
- Optional Burp AI features include AI-enhanced issue investigation and AI-generated recorded logins; DAST administrators must enable the features for an instance. · portswigger.net, 4 Oct 2026
- Air-gapped use
- The self-hosted deployment supports air-gapped environments and can use PostgreSQL or Oracle for production. · portswigger.net, 4 Oct 2026
- API
- A GraphQL API can trigger scans, fetch findings, manage sites, and send results to internal tools. · portswigger.net, 4 Oct 2026
- API automation
- A GraphQL API can trigger scans, fetch findings, manage sites, and send results to internal tools. · portswigger.net, 4 Oct 2026
- API coverage
- It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication. · portswigger.net, 4 Oct 2026
- API scanning
- It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication. · portswigger.net, 4 Oct 2026
- Authenticated scanning
- Session-aware scanning maintains authenticated state, and supported login methods include username and password pairs or recorded login sequences. · portswigger.net, 4 Oct 2026
- Company
- PortSwigger describes itself as a web security company whose mission is to enable the world to secure the web. · portswigger.net, 4 Oct 2026
- Custom checks
- BChecks authored for Burp Suite Professional run unchanged in Burp Suite DAST. · portswigger.net, 4 Oct 2026
- Deployment
- Burp Suite DAST is available as managed cloud service or self-hosted software, including Windows and Linux installers and a Helm deployment for Kubernetes. · portswigger.net, 4 Oct 2026
- Evidence and reporting
- Findings include the captured request and confirming response, and compliance reports cover OWASP Top 10 2025 and PCI DSS v4.0.1; PortSwigger says these reports do not guarantee compliance. · portswigger.net, 4 Oct 2026
- Founded
- 2008 · portswigger.net, 23 Sept 2026
- Headquarters
- Knutsford, Cheshire, UK · portswigger.net, 23 Sept 2026
- Integrations
- Named CI/CD integrations include Jenkins, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, CircleCI, and TeamCity; findings can be delivered to Jira, ServiceNow, Azure Boards, and GitHub Issues. · portswigger.net, 4 Oct 2026
- Modern web scanning
- Its Chromium-based crawler handles JavaScript single-page apps, dynamic forms, GraphQL endpoints, and asynchronous loads, with parallel crawl and audit. · portswigger.net, 4 Oct 2026
- Pricing availability
- The official pricing page displays a plans heading but no plan prices or limits in its readable page content; the product page directs buyers to request a demo or talk to sales. · portswigger.net, 4 Oct 2026
- Purpose
- Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional. · portswigger.net, 4 Oct 2026
- Scan management
- Teams can schedule portfolio scans from a dashboard or run scans in CI pipelines, including on pull requests and merges. · portswigger.net, 4 Oct 2026
- Support
- The product page describes technical support from specialists, SLA-backed support for enterprise, onboarding, and a named solutions architect for the enterprise tier. · portswigger.net, 4 Oct 2026
- Trial
- PortSwigger offers a guided proof-of-concept trial license after a tailored demo and a 30-minute discovery call; its documentation also describes a self-hosted trial setup. · portswigger.net, 4 Oct 2026
Where Burp Suite DAST stands on Freedom251
- Dynamic Application Security Testing Software#6 of 26
- Vulnerability Scanner Software#10 of 29
- Web Application Security Scanners#10 of 29
- Penetration Testing Software#20 of 34