- Home
- Web Application Security Scanners
- Burp Suite DAST
Burp Suite DAST
Knutsford, Cheshire, UK
What it is
Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional. Its Chromium-based crawler handles JavaScript single-page apps, dynamic forms, GraphQL endpoints and asynchronous loads, with crawling and auditing in parallel. Session-aware scans retain authenticated state using username and password pairs or recorded login sequences. The scanner covers APIs described by Postman Collections, OpenAPI, SOAP and GraphQL, with several supported authentication methods. Teams can schedule portfolio scans from a dashboard or run scans in CI pipelines, including on pull requests and merges. Deployments include a managed cloud service or self-hosted software for Windows and Linux, plus a Kubernetes Helm option; self-hosted use can support air-gapped environments. Access controls include roles, site groups, audit trails, SAML single sign-on and group-locked scan policies. Findings include a captured request and confirming response. Integrations include CI/CD platforms and issue-management tools, while a GraphQL API can trigger scans, retrieve findings and manage sites. Pricing is tailored to the portfolio and requires contacting PortSwigger. A guided proof-of-concept trial is offered after a demo and discovery call.
For and against
For
- Crawler supports JavaScript apps, dynamic forms and GraphQL.
- Scans APIs described by several common formats.
- Can run scans in CI pipelines and on pull requests.
- Self-hosted deployment supports air-gapped environments.
- Findings include captured requests and confirming responses.
Against
- Pricing requires contacting PortSwigger.
- Guided proof-of-concept requires a demo and discovery call.
The verdict
Burp Suite DAST combines authenticated web and API scanning with dashboard and pipeline workflows. Buyers should confirm tailored pricing and trial requirements with PortSwigger.
Who it suits
Burp Suite DAST suits teams scanning web applications and APIs through dashboards or CI pipelines. Its managed and self-hosted deployment options also address teams with air-gapped environments.
Plans and prices
Burp Suite DAST
Tailored solution; pricing depends on portfolio; contact PortSwigger
Read 4 Oct 2026 · portswigger.net
On the record
- Access controls
- The product supports role-based access control, site groups, audit trails, SAML single sign-on, and scan policy templates that can be locked per group.portswigger.net · read 4 Oct 2026
- AI data handling
- The maker says AI request data is not stored by its AI providers and that Burp AI communications use TLS 1.2 or later; the AI documentation says the service is covered by PortSwigger’s ISO 27001 certification.portswigger.net · read 4 Oct 2026
- AI features
- Optional Burp AI features include AI-enhanced issue investigation and AI-generated recorded logins; DAST administrators must enable the features for an instance.portswigger.net · read 4 Oct 2026
- Air-gapped use
- The self-hosted deployment supports air-gapped environments and can use PostgreSQL or Oracle for production.portswigger.net · read 4 Oct 2026
- API
- A GraphQL API can trigger scans, fetch findings, manage sites, and send results to internal tools.portswigger.net · read 4 Oct 2026
- API automation
- A GraphQL API can trigger scans, fetch findings, manage sites, and send results to internal tools.portswigger.net · read 4 Oct 2026
- API coverage
- It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication.portswigger.net · read 4 Oct 2026
- API scanning
- It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication.portswigger.net · read 4 Oct 2026
- Authenticated scanning
- Session-aware scanning maintains authenticated state, and supported login methods include username and password pairs or recorded login sequences.portswigger.net · read 4 Oct 2026
- Company
- PortSwigger describes itself as a web security company whose mission is to enable the world to secure the web.portswigger.net · read 4 Oct 2026
- Custom checks
- BChecks authored for Burp Suite Professional run unchanged in Burp Suite DAST.portswigger.net · read 4 Oct 2026
- Deployment
- Burp Suite DAST is available as managed cloud service or self-hosted software, including Windows and Linux installers and a Helm deployment for Kubernetes.portswigger.net · read 4 Oct 2026
- Evidence and reporting
- Findings include the captured request and confirming response, and compliance reports cover OWASP Top 10 2025 and PCI DSS v4.0.1; PortSwigger says these reports do not guarantee compliance.portswigger.net · read 4 Oct 2026
- Integrations
- Named CI/CD integrations include Jenkins, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, CircleCI, and TeamCity; findings can be delivered to Jira, ServiceNow, Azure Boards, and GitHub Issues.portswigger.net · read 4 Oct 2026
- Modern web scanning
- Its Chromium-based crawler handles JavaScript single-page apps, dynamic forms, GraphQL endpoints, and asynchronous loads, with parallel crawl and audit.portswigger.net · read 4 Oct 2026
- Pricing availability
- The official pricing page displays a plans heading but no plan prices or limits in its readable page content; the product page directs buyers to request a demo or talk to sales.portswigger.net · read 4 Oct 2026
- Purpose
- Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.portswigger.net · read 4 Oct 2026
- Scan management
- Teams can schedule portfolio scans from a dashboard or run scans in CI pipelines, including on pull requests and merges.portswigger.net · read 4 Oct 2026
