Freedom251 › Dynamic Application Security Testing Software
Offensive360 DAST
What Offensive360 DAST is
Offensive360 DAST scans live web applications and APIs with a headless browser, more than 40 active exploit checks, and 19 passive analyzers. Its coverage includes injection, cross-site scripting, authentication and access-control issues, SSRF, API flaws, and known CVEs in listed technologies and frameworks. Scans can use form authentication, tokens, cookies, multi-step logins, and role-based testing. Findings include request and response evidence, severity, CWE and OWASP mappings, remediation guidance, and post-scan validation. Safe mode is enabled by default; denial-of-service techniques are disabled in every mode. It also tests AI applications for issues such as prompt injection, jailbreaks, and system prompt leakage under the OWASP Top 10 for LLM Applications (2025). Reports, exports, syslog forwarding, and a REST API support review and automation. Deployment options include cloud SaaS and virtual appliances for OVA or Azure VHD, including offline use in air-gapped networks. Pricing is on request; evaluation offers free scans and a personalized demo, but there is no free DAST plan.
Who it suits
It suits teams assessing live web applications, APIs, and AI applications, including those needing authenticated scans or offline deployment. Pipeline automation and several report formats are also available.
What it does well
- More than 40 active checks and 19 passive analyzers
- Authenticated scans include multi-step and role-based testing
- Safe mode uses non-destructive payloads by default
- Supports air-gapped deployment and cloud SaaS
- REST API and syslog forwarding support automation
What to know first
- Pricing is available only on request
- No free DAST plan is described
Limits
There is no free DAST plan. The commercial annual license is custom-priced, with scan scope and support options set in a proposal.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Application Security | Custom annual license · SAST and DAST product options · supported languages and frameworks · scan scope agreed in proposal · support options | On request |
| On-Premise | Custom annual license · Selected security products · OVA virtual appliance · optional air-gapped deployment · infrastructure deployment · support terms and service levels in proposal | On request |
As offensive360.com lists them, read 8 Oct 2026. The maker's own page has the final word.
Getting started
- Visit https://offensive360.com/products/dast/.
- Request free scans for evaluation or a personalized demo.
- Ask for pricing and agree scan scope and support options in a proposal.
- Choose cloud SaaS or a virtual appliance delivered as OVA or Azure VHD.
- Arrange infrastructure deployment for an on-premise or air-gapped setup.
Verdict
Offensive360 DAST combines broad live-application checks with authenticated scanning, evidence-rich findings, and deployment choices that include air-gapped use. Buyers need to request pricing, though free scans and a personalized demo are offered for evaluation.
Questions
How much does Offensive360 DAST cost?
Pricing is on request. The Application Security and On-Premise plans are custom annual licenses.
Is there a free plan or evaluation?
There is no free DAST plan. The pricing page offers free scans for evaluation and a personalized demo.
Where can Offensive360 DAST run?
It is offered as cloud SaaS or as a virtual appliance delivered as OVA or Azure VHD. It can also run fully offline in air-gapped networks.
Can it test authenticated applications and APIs?
Yes. It supports API testing and form-based authentication, tokens, cookies, multi-step logins, and role-based testing.
Does it test AI applications?
Yes. It tests against the OWASP Top 10 for LLM Applications (2025), including prompt injection, jailbreaks, and system prompt leakage.
What deployment is included in the On-Premise plan?
The plan lists selected security products and an OVA virtual appliance, with optional air-gapped deployment. Infrastructure deployment, support terms, and service levels are set in the proposal.
Facts from Offensive360 DAST's own pages
- AI application testing
- The product tests AI applications against the OWASP Top 10 for LLM Applications (2025), including prompt injection, jailbreaks, and system prompt leakage. · offensive360.com, 8 Oct 2026
- Authenticated scans
- Supports form-based authentication, token and cookie sessions, multi-step logins, and role-based testing. · offensive360.com, 8 Oct 2026
- Company background
- Offensive360 says it was founded by offensive security professionals and builds its scanning engines in-house. · offensive360.com, 8 Oct 2026
- Data controls
- The security page states TLS 1.2 or higher in transit, encryption at rest for stored artefacts, role-based access, scoped API tokens, and logged customer access. · offensive360.com, 8 Oct 2026
- Deployment
- DAST is available as part of a virtual appliance delivered as OVA or Azure VHD, can run fully offline in air-gapped networks, and is also offered as cloud SaaS. · offensive360.com, 8 Oct 2026
- Evaluation
- The pricing page offers free scans for evaluation and a personalized demo; it does not specify a trial duration. · offensive360.com, 8 Oct 2026
- Evidence and validation
- Findings include request and response evidence, severity, CWE and OWASP mapping, remediation steps, and post-scan validation. · offensive360.com, 8 Oct 2026
- Free tier limit
- The open-source program provides free SAST only; DAST is listed as a commercial product, so the page does not describe a free DAST plan. · offensive360.com, 8 Oct 2026
- Headquarters
- Amsterdam, The Netherlands · offensive360.com, 28 Sept 2026
- Integration example
- The DAST page says syslog forwarding was validated end to end with FortiSIEM. · offensive360.com, 8 Oct 2026
- Purpose
- DAST tests live web applications and APIs using a headless browser, more than 40 active exploit checks, and 19 passive analyzers. · offensive360.com, 8 Oct 2026
- Reports and automation
- DAST offers four report templates, five export formats, syslog forwarding, and a REST API for pipelines and automation. · offensive360.com, 8 Oct 2026
- Safe scanning
- Safe mode is on by default with non-destructive validation payloads, and denial-of-service techniques are force-disabled across every mode. · offensive360.com, 8 Oct 2026
- Security certification
- O360 B.V. says it operates an information security management system certified against ISO/IEC 27001. · offensive360.com, 8 Oct 2026
- Vulnerability coverage
- Checks include injection, cross-site scripting, authentication, access control, SSRF, API flaws, and known CVEs in listed technologies and frameworks. · offensive360.com, 8 Oct 2026