- Home
- Dynamic Application Security Testing Software
- Veracode DAST
Veracode DAST
Burlington, Massachusetts, United States
What it is
Veracode DAST scans live web applications and REST APIs for security vulnerabilities. It can test authenticated or unauthenticated assets, including applications behind firewalls, and inspect API endpoints and workflows to check business logic. Scans can be automated or scheduled, with adjustable depth, speed, and accuracy. Its cloud-native engine is designed to scan hundreds of assets across environments, and Veracode reports a false positive rate below 5%. DAST connects to CI/CD pipelines through webhooks or the Veracode CLI, with reports available in PDF, JUnit, or CSV formats. A Quick scan takes approximately three to five minutes and uses non-invasive scanners to check basic misconfigurations. API scans require an OpenAPI 2.0 or 3.0 specification in JSON or YAML; HAR files are not supported. The product is SaaS with hybrid deployment, and a free 14-day trial is available through the Veracode Platform. Pricing is on request.
For and against
For
- Tests authenticated and unauthenticated assets.
- Scans can be automated or scheduled.
- Connects to CI/CD through webhooks or CLI.
- Reports are available in PDF, JUnit, or CSV.
Against
- API scans require an OpenAPI specification.
- HAR files are not supported.
- The United States Federal Region is unsupported.
- Pricing is available on request.
The verdict
Veracode DAST focuses on runtime testing of live applications and APIs, with pipeline integration and configurable scans. A free 14-day trial is available; pricing is on request.
Who it suits
DAST may suit teams that need automated or scheduled security scans for live web applications and REST APIs, including assets behind firewalls. Its API scanning requires an OpenAPI 2.0 or 3.0 specification.
Plans and prices
Veracode DAST
Web applications and APIs · Request a live demo · Contact Us
Read 1 Oct 2026 · veracode.com
On the record
- API security
- DAST probes API endpoints and entire workflows to detect vulnerabilities and validate business logic.veracode.com · read 1 Oct 2026
- API specification limit
- API scans require an OpenAPI 2.0 or 3.0 specification in JSON or YAML; HAR files are not supported.docs.veracode.com · read 1 Oct 2026
- CI/CD integration
- DAST integrates with CI/CD pipelines through webhooks or the Veracode CLI, and reports can be downloaded in PDF, JUnit or CSV formats.docs.veracode.com · read 1 Oct 2026
- False positives
- Veracode states that DAST has a false positive rate below 5%.veracode.com · read 1 Oct 2026
- Purpose
- Veracode DAST is a Dynamic Application Security Testing solution for automated, scalable scanning of web applications and REST APIs.docs.veracode.com · read 1 Oct 2026
- Region limit
- The United States Federal Region is not supported for DAST.docs.veracode.com · read 1 Oct 2026
- Runtime testing
- It runs security tests against live web applications and APIs, including authenticated or unauthenticated analyses and assets behind firewalls.docs.veracode.com · read 1 Oct 2026
- Scale
- The cloud-native engine is designed to scan hundreds of assets across environments, including applications behind firewalls.veracode.com · read 1 Oct 2026
- Scan configuration
- Scans can be automated or scheduled with configurable scan depth, speed and accuracy.veracode.com · read 1 Oct 2026
- Scan modes
- A Quick scan takes approximately three to five minutes and runs non-invasive scanners for basic misconfigurations.docs.veracode.com · read 1 Oct 2026
- Security compliance
- Veracode reports SOC 2 Type II attestation and a FedRAMP Moderate Authority to Operate for its cloud-based application security platform.veracode.com · read 1 Oct 2026
- Support
- Veracode directs users to Technical Support for help with DAST integrations.docs.veracode.com · read 1 Oct 2026
- Ticketing integrations
- The integration documentation describes ticketing workflows for Jira, DefectDojo and Asana.docs.veracode.com · read 1 Oct 2026
- Trial
- Veracode offers a free 14-day DAST trial through the Veracode Platform.docs.veracode.com · read 1 Oct 2026
