- Home
- Dynamic Application Security Testing Software
- Safeguard DAST
Safeguard DAST
Dublin, California, United States
What it is
Safeguard DAST scans running applications and reports findings alongside how much of the discovered attack surface its crawl reached. It uses Safeguard SAST call graphs, route tables, and authentication middleware to guide crawling, and generates targeted payloads for SQL, OS command, SSRF, XSS, and deserialization sinks. Endpoint discovery can use OpenAPI, GraphQL introspection, gRPC reflection, and live traffic samples. Supported authenticated flows include form auth, OAuth 2.0 with refresh, JWT bearer, session cookies, SAML, and mutual TLS. The listed scan modes are Fast, Deep, Progressive, and Reconnaissance, which sends no probes. A Coverage Score explains what portion of discovered attack surface was reached and why scanning stopped; the product states coverage for the OWASP Top 10 and API Top 10. It also analyzes served JavaScript, JSON, and source maps for exposed credentials, endpoints, routes, cloud-storage references, personal data, configuration, and developer comments. Secret samples are redacted at detection, and raw credentials are not stored or returned. Requests require ownership verification and are gated by scope, rate, and budget limits. CI integrations include GitHub Actions, GitLab CI, Buildkite, CircleCI, and Jenkins. Internal-network and on-prem scans are supported through a self-hosted scanner pod with mTLS to the control plane. The listing notes a free plan and paid service from $9/mo, but the DAST page does not state a DAST-specific price.
For and against
For
- Supports multiple authenticated scanning flows
- Discovers endpoints from API descriptions and live traffic
- Coverage Score explains reached surface and scan stops
- Lists five CI integrations
Against
- The DAST page does not state a DAST-specific price
- Requests require ownership verification
- Internal-network and on-prem scanning uses a self-hosted scanner pod
The verdict
Safeguard DAST combines guided crawling, targeted payloads, and attack-surface coverage reporting. Confirm the DAST-specific pricing and deployment requirements for your environment before selecting it.
Who it suits
Safeguard DAST suits teams that need dynamic testing of running applications, including authenticated and API scanning. Its CI integrations and self-hosted scanner option may suit teams incorporating scans into build workflows or internal-network environments.
On the record
- API discovery
- Endpoint discovery draws on OpenAPI, GraphQL introspection, gRPC reflection, and live traffic samples.safeguard.sh · read 7 Oct 2026
- Authentication
- Supported authenticated flows include form auth, OAuth 2.0 with refresh, JWT bearer, session cookies, SAML, and mutual TLS.safeguard.sh · read 7 Oct 2026
- CI integrations
- The DAST page lists GitHub Actions, GitLab CI, Buildkite, CircleCI, and Jenkins integrations.safeguard.sh · read 7 Oct 2026
- Coverage
- The product page states full OWASP Top 10 and API Top 10 coverage.safeguard.sh · read 7 Oct 2026
- Coverage reporting
- A Coverage Score reports how much discovered attack surface the scan reached and why it stopped.safeguard.sh · read 7 Oct 2026
- Delta scans
- Subsequent scans focus on changes from the last clean run, and the page describes nightly delta scans as taking minutes.safeguard.sh · read 7 Oct 2026
- Deployment
- Internal-network and on-prem scanning is supported through a self-hosted scanner pod with mTLS to the control plane.safeguard.sh · read 7 Oct 2026
- Endpoint discovery
- It builds endpoint inventories from OpenAPI, GraphQL introspection, gRPC reflection and live traffic samples.safeguard.sh · read 7 Oct 2026
- Findings
- Findings can include the function and file reached by a request, the patch that introduced a regression, and a static call-graph annotation.safeguard.sh · read 7 Oct 2026
- Findings workflow
- DAST findings join the same ranked triage queue as Safeguard SAST and SCA results, with code-level context attached.safeguard.sh · read 7 Oct 2026
- Graph-aware crawling
- The scanner uses Safeguard SAST call graphs, route tables, and authentication middleware to guide its crawl.safeguard.sh · read 7 Oct 2026
- Integrations
- The listed CI integrations are GitHub Actions, GitLab CI, Buildkite, CircleCI and Jenkins.safeguard.sh · read 7 Oct 2026
- JavaScript analysis
- DAST analyzes served JavaScript, JSON, and source maps for exposed credentials, API endpoints, routes, cloud-storage references, personal data, configuration, and developer comments.safeguard.sh · read 7 Oct 2026
- Maker
- The DAST page footer identifies the company as Safeguard.sh Inc and lists its headquarters at 7779 Topaz Circle, Dublin, California 94568, United States.safeguard.sh · read 7 Oct 2026
- Pricing
- The DAST page offers a demo and a “Try It” button but does not state a DAST-specific price.safeguard.sh · read 7 Oct 2026
- Purpose
- Safeguard DAST dynamically tests running applications and reports attack surface coverage alongside findings.safeguard.sh · read 7 Oct 2026
- Scan modes
- The launch page lists Fast, Deep, Progressive, and Reconnaissance scan modes, with Reconnaissance sending no probes.safeguard.sh · read 7 Oct 2026
- Scanning
- It generates targeted SQL, OS command, SSRF, XSS and deserialization payloads based on expected parameter shapes.safeguard.sh · read 7 Oct 2026
