Veracode DAST

Veracode DAST is a cloud-delivered dynamic application security testing service for live web applications and REST APIs. It fits security and development teams that need recurring runtime scans across many environments, with authenticated coverage and pipeline integration. Choose it when configurable, scalable DAST matters more than self-service pricing; API work depends on maintaining a compatible OpenAPI document.

Overview

Veracode DAST tests running applications rather than source alone, supporting authenticated and unauthenticated analysis and targets located behind firewalls. Its hybrid deployment model combines SaaS delivery with an agent, making it suitable for organizations that need cloud operation while reaching protected environments. The cloud-native engine is designed for hundreds of assets across environments, and Veracode reports a false-positive rate below 5%.

The product comes from Veracode, founded in 2006 and headquartered in Burlington, Massachusetts. Its cloud application-security platform reports SOC 2 Type II attestation and a FedRAMP Moderate Authority to Operate. The United States Federal Region is not supported for DAST, which is a decisive limitation for teams operating there.

Key features

Configurable runtime scanning

Scans can run automatically or on a schedule, with controls for depth, speed and accuracy. A Quick scan takes approximately three to five minutes and uses non-invasive scanners to identify basic misconfigurations. It is a useful rapid check, but its narrow scope should not be treated as a replacement for deeper assessments.

Web and API coverage

DAST probes API endpoints and complete workflows, including business-logic validation rather than isolated-route checks. API scans require an OpenAPI 2.0 or 3.0 specification in JSON or YAML; HAR files are not supported. Teams without a maintained specification in one of those formats will have to address that prerequisite before API coverage is practical.

Development workflow connections

Webhooks and the Veracode CLI connect scans to CI/CD pipelines. Reports can be exported in PDF, JUnit or CSV, supporting both management reporting and automated build handling. Documented ticketing workflows cover Jira, DefectDojo and Asana. Pull-request scans, IDE support, custom security rules, automated fixes, SBOM generation and reachability analysis extend the wider platform's developer and software-composition coverage. Technical Support handles DAST integration assistance.

Pricing

Veracode DAST is a paid product with custom pricing. The DAST plan covers web applications and APIs and is sold through a live demo or sales contact rather than a published rate. There is no free plan. A 14-day free trial is offered through the Veracode Platform, giving teams a short evaluation window before a commercial commitment.

Custom pricing suits organizations that need a quote based on their application estate, but it makes direct cost comparison difficult. The trial is long enough for a focused proof of concept; teams should use it to verify OpenAPI readiness, firewall reachability, scan scheduling and pipeline reporting before purchase.

Platforms

Veracode DAST supports web, API, Linux, macOS and Windows environments. Browser-based, authenticated and API testing are supported, with cloud deployment and a hybrid model. Its language-agnostic agent is intended to reach applications regardless of implementation language; specific supported languages are not defined for the DAST service.

Who it's for

It is a strong fit for security programs scanning numerous live applications, including internal or firewall-protected assets, and for engineering organizations that want scheduled checks and CI/CD gates. Teams that need API workflow and business-logic testing will value the endpoint-plus-workflow approach. It is less suitable for buyers requiring transparent subscription pricing, a permanent free tier, Federal Region support or API testing without OpenAPI 2.0/3.0 JSON or YAML documentation.

Pros and cons

• Pro: Authenticated and unauthenticated scanning reaches live applications and assets behind firewalls.
• Pro: Scheduling, adjustable scan depth, speed and accuracy, and a Quick scan support different assessment rhythms.
• Pro: API workflow and business-logic testing goes beyond checking individual endpoints.
• Pro: Webhooks, CLI integration and PDF, JUnit and CSV reports connect findings to delivery processes.
• Con: Custom pricing and a sales-led purchase prevent straightforward budget comparison.
• Con: API scans require OpenAPI 2.0 or 3.0 JSON/YAML; HAR input is unavailable.
• Con: DAST does not support the United States Federal Region.
• Con: The 14-day trial and lack of a free plan limit long-term no-cost use.

Alternatives

Consider Aikido CSPM if a freemium option and a free Developer plan are more important than Veracode's custom DAST model; its free tier includes two users, 10 repositories, two container images, one domain and one cloud account.

HCL AppScan is a better starting point when you want a free CodeSweep download, an on-premises GitHub extension and SAST coverage for more than 35 languages, plus a free trial.

Choose Waratek IAST when runtime analysis is the priority and a free trial limited to one application per organization is acceptable.

DongTai IAST suits teams seeking free, open-source self-hosted deployment through Docker Compose or Kubernetes.

New Relic IAST is worth considering if a free tier with 100 GB of monthly data ingest, one full platform user and more than 50 capabilities fits your monitoring model.

Contrast Assess is a paid alternative for API, desktop and self-hosted environments.

NowSecure Platform is a paid option spanning Android, iOS, web and API targets, with pricing handled by demo or order form.

Black Duck Seeker is another paid choice for Linux, macOS, web and Windows environments.

For broader category browsing, see Dynamic Application Security Testing Software, Interactive Application Security Testing Software, DevSecOps Platforms, SAST Tools, Dependency Management Software and Static Application Security Testing Software.

Verdict

Veracode DAST is a strong choice for organizations that need scalable, configurable scans of live web applications and APIs, including authenticated and firewall-protected assets, tied directly to CI/CD workflows. Look elsewhere if you need published pricing, a lasting free plan, Federal Region support or API scans that do not depend on OpenAPI 2.0 or 3.0 specifications.