17.6
OWASP ZAP, now identified as ZAP or ZAP by Checkmarx, is a free, open-source web application scanner and proxy for security testing.
Free planOpen sourceAPIExtensionLinux
Alternatives to Nuclei
Nuclei is a free, open-source vulnerability scanner for applications, infrastructure, cloud platforms, and networks. Its YAML approach supports community checks and custom security tests, while bulk and parallel scans, multiple target formats, filters, authentication, and broad protocol coverage suit security engineers, red teams, DevOps teams, bug bounty hunters, and penetration testers. It can run in CI/CD, export SARIF to GitHub Code Scanning, connect with…
26.9
Beagle Security is an agentic AI penetration testing platform for web applications, APIs, and GraphQL.
Free planWebAPI
36.8
ImmuniWeb is a cybersecurity platform for testing and protecting web and mobile applications, APIs, microservices, and cloud and network infrastructure.
AndroidiOSWeb
- 4
ZeroThreat
ZeroThreat is an AI-powered penetration-testing platform for web applications and APIs, available through web and API access.
Free planWebAPI6.7From $100 a month - 5
VAddy
VAddy is a cloud service for automated black-box security testing of web applications.
WebAPILinuxmacOS6.6From ¥19,800 a month - 6
Astra Security
Astra Security describes its product as a continuous penetration testing platform for web applications, APIs, and cloud infrastructure.
WebAPI6.5From $699 a year - 7
Burp Suite DAST
Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.
WebAPILinuxSelf-hosted6.4 - 8
Invicti
Invicti is an application security platform for finding, prioritizing, and fixing application risk.
WebAPISelf-hosted6.3$500 one-time - 9
Wapiti
Wapiti is a free Python tool for scanning deployed websites and web applications for vulnerabilities.
Free planAPILinuxmacOSSelf-hosted6.2Free plan - 10
Blacklock
Blacklock is a cloud Penetration Testing as a Service platform available through a web interface, API, and browser extension.
WebAPIExtension6.1From $85 a month - 116.1From $10 a month
- 12
BlueClosure BC Detect
BlueClosure BC Detect is a paid JavaScript security platform presented for IT security professionals.
5.9From £60 a month - 13
BreachLock DAST
BreachLock DAST checks running applications from the outside by sending inputs and analyzing their responses.
WebAPIExtension5.9From $5,000 a year - 14
Haxore Web Security Scanner
WebExtension5.9From $49 a month - 15
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.7 - 16
AppCheck
AppCheck automates security-flaw discovery across websites, applications, networks, and cloud infrastructure.
WebAPISelf-hosted5.6 - 17
Vega
Vega is a free, Java-based graphical platform for testing web application security.
LinuxmacOSWindows5.6 - 18
Escape
Escape is an offensive security platform that brings together attack surface management, business-logic-aware dynamic application security testing…
WebAPI5.5 - 19
Rapid7 InsightAppSec
WebWindows5.5From $175 a month - 20
Tenable One Web App Scanning
Tenable One Web App Scanning is a web application scanning product from Tenable, a company founded in 2002 and headquartered in Columbia, Maryland, United States.
Web5.5From $3,578 a year - 21
5.4 - 22
OpenText Fortify DAST
OpenText Fortify DAST is a paid application security testing product for Linux and web platforms.
WebLinux4.9 - 23
Pentest-Tools Website Scanner
WebLinuxmacOS4.9 - 244.8
- 254.8
- 26
FortiDAST
Web4.7 - 274.7
- 284.3