Freedom251 › Dynamic Application Security Testing Software
Checkmarx DAST
What Checkmarx DAST is
Checkmarx DAST tests live web applications and APIs by simulating attacks. It is positioned for enterprise teams within the Checkmarx One application security platform. Scans can run automatically on each build in development and pre-production, with results surfaced in the CI/CD pipeline. Built-in tunnelling lets teams scan internal applications without firewall exceptions or network reconfiguration. For authenticated coverage, the tool supports browser-recorded login flows, two-factor authentication, and instant verification.
DAST tests REST, SOAP, and gRPC endpoints in live environments. API findings from SAST and DAST can be brought together in one inventory, and findings can be mapped to affected compliance frameworks to help prioritize remediation. Listed CI/CD integrations include Jenkins, TeamCity, GitHub Actions, Azure DevOps, Maven, Bitbucket Pipelines, CircleCI, GitLab CI, Bamboo, AWS CodeBuild, and SonarQube. Checkmarx One is offered as cloud SaaS and supports self-hosted and on-premises deployment, including air-gapped environments. DAST is an add-on, not a standalone product: access requires Checkmarx One Professional or higher. There is no self-serve free trial; Checkmarx offers personalized demos instead. Pricing is by custom quote.
Who it suits
Checkmarx DAST suits enterprise teams testing live web applications and APIs as part of their application security work. It is relevant to teams that need authenticated scanning, CI/CD pipeline scanning, or SaaS and self-hosted deployment options within Checkmarx One.
What it does well
- Scans live REST, SOAP, and gRPC endpoints.
- Supports browser-recorded login flows and two-factor authentication.
- Can scan internal applications through built-in tunnelling.
- Runs in CI/CD pipelines on each build.
- Offers SaaS, self-hosted, and on-premises deployment.
What to know first
- DAST is only available as an add-on within Checkmarx One Professional or higher.
- There is no self-serve free trial or free plan.
- Pricing requires a custom quote.
Limits
DAST is an add-on rather than a standalone product, and it is available within Checkmarx One Professional or higher. The Essentials plan lists DAST as an add-on; the Professional plan includes it. Both plans use custom quotes.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Essentials | DAST is an add-on · custom quote based on modules, deployment model, and developer count · SaaS or self-hosted deployment | On request |
| Professional | Includes DAST · custom quote based on modules, deployment model, and developer count · SaaS or self-hosted deployment | On request |
As checkmarx.com lists them, read 3 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the Checkmarx DAST website.
- Request a personalized demo from Checkmarx.
- Ask for a custom quote based on modules, deployment model, and developer count.
- Choose Checkmarx One Professional or higher to include DAST.
- Select SaaS or a supported self-hosted deployment model.
Verdict
Choose Checkmarx DAST if your enterprise team needs to scan live applications and APIs within Checkmarx One, including authenticated and internal targets. Its availability depends on a Professional or higher plan, and pricing requires a custom quote. Look elsewhere if you need a standalone scanner or a self-serve free trial.
Questions
Does Checkmarx DAST have a free plan or trial?
No free plan or self-serve free trial is listed. Checkmarx offers personalized demos.
How is Checkmarx DAST priced?
Pricing is by custom quote based on modules, deployment model, and developer count.
Can I buy DAST on its own?
No. It is an add-on within Checkmarx One Professional or higher.
Which APIs can it test?
It tests REST, SOAP, and gRPC endpoints in live environments.
Which deployment options are available?
Checkmarx One is offered as cloud SaaS and supports self-hosted and on-premises deployment, including air-gapped environments.
Which CI/CD tools are listed as integrations?
The list includes Jenkins, TeamCity, GitHub Actions, Azure DevOps, Maven, Bitbucket Pipelines, CircleCI, GitLab CI, Bamboo, AWS CodeBuild, and SonarQube.
Facts from Checkmarx DAST's own pages
- API coverage
- DAST tests REST, SOAP, and gRPC endpoints in live environments and centralizes SAST and DAST API findings in one inventory. · checkmarx.com, 3 Oct 2026
- Authentication
- DAST supports browser-recorded login flows, two-factor authentication, and instant verification for application coverage. · checkmarx.com, 3 Oct 2026
- CI/CD scanning
- DAST can run automatically on every build in development and pre-production, with results surfaced in the pipeline. · checkmarx.com, 3 Oct 2026
- Compliance
- Findings can be mapped to the compliance frameworks they affect to help teams prioritize remediation for audit readiness. · checkmarx.com, 3 Oct 2026
- Compliance certifications
- Checkmarx states that it is ISO/IEC 27001:2022 certified and undergoes an annual independent SOC 2 Type II audit. · checkmarx.com, 3 Oct 2026
- Deployment
- Checkmarx One is offered as cloud SaaS and supports self-hosted and on-premises deployments, including for air-gapped environments. · checkmarx.com, 3 Oct 2026
- Founded
- 2006 · checkmarx.com, 28 Sept 2026
- Integrations
- Checkmarx lists CI/CD integrations including Jenkins, TeamCity, GitHub Actions, Azure DevOps, Maven, Bitbucket Pipelines, CircleCI, GitLab CI, Bamboo, AWS CodeBuild, and SonarQube. · checkmarx.com, 3 Oct 2026
- Intended users
- Checkmarx describes DAST as a tool for enterprise teams and positions it within the Checkmarx One application security platform. · checkmarx.com, 3 Oct 2026
- Internal apps
- Built-in tunnelling lets teams scan internal applications without firewall exceptions or network reconfiguration. · checkmarx.com, 3 Oct 2026
- Pricing limit
- DAST is not sold as a standalone product and is available as an add-on within Checkmarx One Professional or higher. · checkmarx.com, 3 Oct 2026
- Purpose
- Checkmarx DAST is a language-agnostic tool that tests live web applications and APIs by simulating real-world attacks. · docs.checkmarx.com, 3 Oct 2026
- Security
- Checkmarx says customer data is encrypted at rest using protocols such as AES-256 and that service communications use HTTPS, with data to and from S3 encrypted using TLS 1.2. · checkmarx.com, 3 Oct 2026
- Support
- Premium Support includes 24/7 coverage and a two-hour response time for critical P1 issues; Standard Support lists six hours for P1 issues during working hours on business days. · checkmarx.com, 3 Oct 2026
- Trial and demo
- Checkmarx says it does not offer a self-serve free trial and offers personalized demos instead. · checkmarx.com, 3 Oct 2026