Burp Suite DAST
Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.
What Burp Suite DAST is
Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional. Its Chromium-based crawler handles JavaScript single-page apps, dynamic forms, GraphQL endpoints, and asynchronous page loads, while crawling and auditing can run in parallel. Session-aware scanning maintains authenticated state using username and password pairs or recorded login sequences. It scans APIs described by Postman Collections, OpenAPI, SOAP, and GraphQL, with native support for several authentication methods. Teams can schedule portfolio scans from a dashboard or run scans through CI pipelines, including on pull requests and merges. Deployment options include a managed cloud service and self-hosted software for Windows and Linux, plus Helm deployment for Kubernetes; self-hosted use supports air-gapped environments. Access controls include roles, site groups, audit trails, SAML single sign-on, and group-locked scan policies. Findings include captured requests and confirming responses. Pricing is tailored to the portfolio and requires contacting PortSwigger; a guided proof-of-concept trial follows a tailored demo and discovery call.
Good
- Scans modern JavaScript applications and dynamic forms
- Supports API definitions and multiple authentication methods
- Managed cloud or self-hosted deployment options
- Integrates with named CI/CD and issue-tracking tools
- Findings include requests and confirming responses
Watch out
- Pricing depends on the portfolio and requires a sales inquiry
- Guided proof-of-concept requires a demo and discovery call
Who it suits
Burp Suite DAST suits teams that need to scan web applications and APIs, including authenticated and modern JavaScript applications. Its deployment options and CI integrations may fit organizations with self-hosted, air-gapped, or pipeline-based scanning needs.
Verdict
Burp Suite DAST combines web and API scanning with deployment, access-control, and pipeline options for team use. Buyers should discuss portfolio-specific pricing and trial requirements with PortSwigger.
Plans and prices
From Burp Suite DAST's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Burp Suite DAST | Priced on request | Tailored solution; pricing depends on portfolio; contact PortSwigger |
The facts
Each one read from Burp Suite DAST's own pages, with the date it was checked.
What it does
- Access controls
- The product supports role-based access control, site groups, audit trails, SAML single sign-on, and scan policy templates that can be locked per group.checked 4 Oct 2026
- AI data handling
- The maker says AI request data is not stored by its AI providers and that Burp AI communications use TLS 1.2 or later; the AI documentation says the service is covered by PortSwigger’s ISO 27001 certification.checked 4 Oct 2026
- AI features
- Optional Burp AI features include AI-enhanced issue investigation and AI-generated recorded logins; DAST administrators must enable the features for an instance.checked 4 Oct 2026
- API
- A GraphQL API can trigger scans, fetch findings, manage sites, and send results to internal tools.checked 4 Oct 2026
- API automation
- A GraphQL API can trigger scans, fetch findings, manage sites, and send results to internal tools.checked 4 Oct 2026
- API coverage
- It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication.checked 4 Oct 2026
- API scanning
- It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication.checked 4 Oct 2026
- Authenticated scanning
- Session-aware scanning maintains authenticated state, and supported login methods include username and password pairs or recorded login sequences.checked 4 Oct 2026
- Custom checks
- BChecks authored for Burp Suite Professional run unchanged in Burp Suite DAST.checked 4 Oct 2026
- Deployment
- Burp Suite DAST is available as managed cloud service or self-hosted software, including Windows and Linux installers and a Helm deployment for Kubernetes.checked 4 Oct 2026
- Evidence and reporting
- Findings include the captured request and confirming response, and compliance reports cover OWASP Top 10 2025 and PCI DSS v4.0.1; PortSwigger says these reports do not guarantee compliance.checked 4 Oct 2026
- Integrations
- Named CI/CD integrations include Jenkins, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, CircleCI, and TeamCity; findings can be delivered to Jira, ServiceNow, Azure Boards, and GitHub Issues.checked 4 Oct 2026
- Modern web scanning
- Its Chromium-based crawler handles JavaScript single-page apps, dynamic forms, GraphQL endpoints, and asynchronous loads, with parallel crawl and audit.checked 4 Oct 2026
- Pricing availability
- The official pricing page displays a plans heading but no plan prices or limits in its readable page content; the product page directs buyers to request a demo or talk to sales.checked 4 Oct 2026
- Purpose
- Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.checked 4 Oct 2026
- Scan management
- Teams can schedule portfolio scans from a dashboard or run scans in CI pipelines, including on pull requests and merges.checked 4 Oct 2026
- Support
- The product page describes technical support from specialists, SLA-backed support for enterprise, onboarding, and a named solutions architect for the enterprise tier.checked 4 Oct 2026
Where it runs
- Air-gapped use
- The self-hosted deployment supports air-gapped environments and can use PostgreSQL or Oracle for production.checked 4 Oct 2026
The company
- Company
- PortSwigger describes itself as a web security company whose mission is to enable the world to secure the web.checked 4 Oct 2026
- Founded
- 2008checked 23 Sep 2026
- Headquarters
- Knutsford, Cheshire, UKchecked 23 Sep 2026
Money
- Trial
- PortSwigger offers a guided proof-of-concept trial license after a tailored demo and a 30-minute discovery call; its documentation also describes a self-hosted trial setup.checked 4 Oct 2026
Alternatives to Burp Suite DAST
- 1
OWASP ZAP
Free planOpen sourceAPIExtensionLinuxmacOS7.6Free plan - 2
Beagle Security
Free planWebAPI6.9From $99 a month - 3
ImmuniWeb
AndroidiOSWebAPI6.8From €595 a year - 4
Nuclei
Free planLinuxmacOSSelf-hostedWindows6.8Free plan - 5
ZeroThreat
Free planWebAPI6.7From $100 a month - 6
VAddy
WebAPILinuxmacOS6.6From ¥19,800 a month