Offensive360 DAST
Offensive360 DAST dynamically tests live web applications and APIs with a headless browser, more than 40 active exploit checks, and 19 passive analyzers.
What Offensive360 DAST is
Offensive360 DAST dynamically tests live web applications and APIs with a headless browser, more than 40 active exploit checks, and 19 passive analyzers. Coverage includes injection, cross-site scripting, authentication, access control, SSRF, API flaws, and known CVEs in listed technologies and frameworks. Authenticated scans support forms, tokens, cookies, multi-step logins, and role-based testing. Findings contain request and response evidence, severity, CWE and OWASP mappings, remediation guidance, and post-scan validation. Safe mode uses non-destructive payloads by default, while denial-of-service techniques are disabled in every mode. AI application checks address the OWASP Top 10 for LLM Applications (2025), including prompt injection, jailbreaks, and system-prompt leakage. Reports provide four templates and five export formats; syslog forwarding and a REST API support automation. Deployment options include cloud SaaS, OVA or Azure VHD appliances, and offline air-gapped operation. Pricing is on request, with free evaluation scans and a personalized demo.
Good
- 40+ active exploit checks
- Authenticated and role-based scanning
- Evidence, severity, and remediation details
- AI application testing against OWASP LLM risks
- Cloud, appliance, and air-gapped deployment
Watch out
- No free DAST plan
- Pricing is available only on request
- Evaluation scans have no stated duration
- Denial-of-service techniques are disabled
Who it suits
Offensive360 DAST suits security teams assessing live web applications, APIs, and AI applications. It supports hybrid deployment, CI/CD automation, authenticated testing, and air-gapped environments.
Verdict
Offensive360 DAST combines broad dynamic testing, authenticated workflows, evidence-rich findings, and flexible deployment. Teams must request pricing and should distinguish its commercial DAST product from the free SAST program.
Plans and prices
From Offensive360 DAST's own pricing page, checked 8 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Application Security | — | SAST and DAST product options · supported languages and frameworks · scan scope agreed in proposal · support options · Custom annual license |
| On-Premise | — | Selected security products · OVA virtual appliance · optional air-gapped deployment · infrastructure deployment · support terms and service levels in proposal · Custom annual license |
The facts
Each one read from Offensive360 DAST's own pages, with the date it was checked.
Where it runs
- AI application testing
- The product tests AI applications against the OWASP Top 10 for LLM Applications (2025), including prompt injection, jailbreaks, and system prompt leakage.checked 8 Oct 2026
What it does
- Authenticated scans
- Supports form-based authentication, token and cookie sessions, multi-step logins, and role-based testing.checked 8 Oct 2026
- Data controls
- The security page states TLS 1.2 or higher in transit, encryption at rest for stored artefacts, role-based access, scoped API tokens, and logged customer access.checked 8 Oct 2026
- Deployment
- DAST is available as part of a virtual appliance delivered as OVA or Azure VHD, can run fully offline in air-gapped networks, and is also offered as cloud SaaS.checked 8 Oct 2026
- Evaluation
- The pricing page offers free scans for evaluation and a personalized demo; it does not specify a trial duration.checked 8 Oct 2026
- Evidence and validation
- Findings include request and response evidence, severity, CWE and OWASP mapping, remediation steps, and post-scan validation.checked 8 Oct 2026
- Integration example
- The DAST page says syslog forwarding was validated end to end with FortiSIEM.checked 8 Oct 2026
- Purpose
- DAST tests live web applications and APIs using a headless browser, more than 40 active exploit checks, and 19 passive analyzers.checked 8 Oct 2026
- Reports and automation
- DAST offers four report templates, five export formats, syslog forwarding, and a REST API for pipelines and automation.checked 8 Oct 2026
- Safe scanning
- Safe mode is on by default with non-destructive validation payloads, and denial-of-service techniques are force-disabled across every mode.checked 8 Oct 2026
- Security certification
- O360 B.V. says it operates an information security management system certified against ISO/IEC 27001.checked 8 Oct 2026
- Vulnerability coverage
- Checks include injection, cross-site scripting, authentication, access control, SSRF, API flaws, and known CVEs in listed technologies and frameworks.checked 8 Oct 2026
The company
- Company background
- Offensive360 says it was founded by offensive security professionals and builds its scanning engines in-house.checked 8 Oct 2026
- Headquarters
- Amsterdam, The Netherlandschecked 28 Sep 2026
Money
- Free tier limit
- The open-source program provides free SAST only; DAST is listed as a commercial product, so the page does not describe a free DAST plan.checked 8 Oct 2026
Alternatives to Offensive360 DAST
- 1
OWASP ZAP
Free planOpen sourceAPIExtensionLinuxmacOS7.6Free plan - 2
DASTA-AI
Free planWebAPI7.3From $100 a month - 3
Beagle Security
Free planWebAPI6.9From $99 a month - 4
StackHawk HawkScan
WebAPILinuxmacOS6.8From $10 a month - 5
w3af
Free planWebAPILinuxmacOS6.8Free plan - 6
6.6From $599 a year