Veracode DAST
Veracode DAST is a dynamic application security testing tool that scans live web applications and REST APIs.
What Veracode DAST is
Veracode DAST is a dynamic application security testing tool that scans live web applications and REST APIs. It can analyze authenticated or unauthenticated assets, including systems behind firewalls, and inspect API workflows to check business logic. Scans can run automatically or on a schedule, with configurable depth, speed, and accuracy. Its cloud-native engine is designed to cover hundreds of assets, and Veracode reports a false positive rate below 5%. Teams can connect scans to CI/CD pipelines through webhooks or the Veracode CLI, then download reports in PDF, JUnit, or CSV formats. A Quick scan takes approximately three to five minutes and uses non-invasive checks for basic misconfigurations. API scans require an OpenAPI 2.0 or 3.0 specification in JSON or YAML; HAR files are not supported. The service is SaaS with hybrid deployment options. A free 14-day trial is available through the Veracode Platform. Pricing is on request.
Good
- Scans authenticated and unauthenticated live assets.
- Supports API endpoint and workflow testing.
- Automates or schedules configurable scans.
- Integrates with CI/CD through webhooks or CLI.
- Offers a free 14-day trial.
Watch out
- API scans require an OpenAPI 2.0 or 3.0 specification.
- HAR files are not supported.
- United States Federal Region is unsupported.
- Pricing is available on request.
Who it suits
It suits teams that need automated security scans for live web applications and REST APIs, including assets behind firewalls. Its CI/CD connections and configurable scans may fit teams integrating testing into development workflows.
Verdict
Veracode DAST combines live application and API scanning with configurable automation and CI/CD connections. Check its API specification and regional limits before choosing it.
Plans and prices
From Veracode DAST's own pricing page, checked 1 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Veracode DAST | Priced on request | Web applications and APIs · Request a live demo · Contact Us |
The facts
Each one read from Veracode DAST's own pages, with the date it was checked.
What it does
- API security
- DAST probes API endpoints and entire workflows to detect vulnerabilities and validate business logic.checked 1 Oct 2026
- API specification limit
- API scans require an OpenAPI 2.0 or 3.0 specification in JSON or YAML; HAR files are not supported.checked 1 Oct 2026
- CI/CD integration
- DAST integrates with CI/CD pipelines through webhooks or the Veracode CLI, and reports can be downloaded in PDF, JUnit or CSV formats.checked 1 Oct 2026
- False positives
- Veracode states that DAST has a false positive rate below 5%.checked 1 Oct 2026
- Purpose
- Veracode DAST is a Dynamic Application Security Testing solution for automated, scalable scanning of web applications and REST APIs.checked 1 Oct 2026
- Region limit
- The United States Federal Region is not supported for DAST.checked 1 Oct 2026
- Runtime testing
- It runs security tests against live web applications and APIs, including authenticated or unauthenticated analyses and assets behind firewalls.checked 1 Oct 2026
- Scale
- The cloud-native engine is designed to scan hundreds of assets across environments, including applications behind firewalls.checked 1 Oct 2026
- Scan configuration
- Scans can be automated or scheduled with configurable scan depth, speed and accuracy.checked 1 Oct 2026
- Scan modes
- A Quick scan takes approximately three to five minutes and runs non-invasive scanners for basic misconfigurations.checked 1 Oct 2026
- Security compliance
- Veracode reports SOC 2 Type II attestation and a FedRAMP Moderate Authority to Operate for its cloud-based application security platform.checked 1 Oct 2026
- Support
- Veracode directs users to Technical Support for help with DAST integrations.checked 1 Oct 2026
- Ticketing integrations
- The integration documentation describes ticketing workflows for Jira, DefectDojo and Asana.checked 1 Oct 2026
The company
- Founded
- 2006checked 28 Sep 2026
- Headquarters
- Burlington, Massachusetts, United Stateschecked 28 Sep 2026
Money
- Trial
- Veracode offers a free 14-day DAST trial through the Veracode Platform.checked 1 Oct 2026
Alternatives to Veracode DAST
- 1
OWASP ZAP
Free planOpen sourceAPIExtensionLinuxmacOS7.6Free plan - 2
DASTA-AI
Free planWebAPI7.3From $100 a month - 3
Beagle Security
Free planWebAPI6.9From $99 a month - 4
StackHawk HawkScan
WebAPILinuxmacOS6.8From $10 a month - 5
w3af
Free planWebAPILinuxmacOS6.8Free plan - 6
6.6From $599 a year