Skip to content
SPECIFICTION
Get listed

Burp Suite DAST

portswigger.net

Free trial WebWindowsLinuxAPISelf-hosted
Visit portswigger.net
Spec score 8.6 #1 of 29 in Web Application Security Scanners

What it is

Burp Suite DAST is an automated dynamic scanner for web vulnerabilities, built on the scanning engine used in Burp Suite Professional. Its Chromium-based crawler can handle JavaScript single-page applications, dynamic forms, GraphQL endpoints, and asynchronous loads, while crawling and auditing can run in parallel. Session-aware scans maintain authenticated state using username-password pairs or recorded login sequences. The scanner covers APIs described by Postman Collections, OpenAPI, SOAP, and GraphQL, with native support for several authentication methods. Teams can schedule portfolio scans from a dashboard or run them in CI pipelines, including on pull requests and merges. Deployment options include managed cloud and self-hosted software for Windows and Linux, plus Helm deployment for Kubernetes; self-hosted deployments can operate in air-gapped environments. Access controls include role-based permissions, site groups, audit trails, SAML single sign-on, and group-locked scan policies. Findings include captured requests and confirming responses. Pricing depends on the portfolio and requires contacting PortSwigger; a guided proof-of-concept trial follows a tailored demo and discovery call.

Spec sheet

Purpose
Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.Read 4 Oct 2026 · portswigger.net
Deployment
Burp Suite DAST is available as managed cloud service or self-hosted software, including Windows and Linux installers and a Helm deployment for Kubernetes.Read 4 Oct 2026 · portswigger.net
Trial
PortSwigger offers a guided proof-of-concept trial license after a tailored demo and a 30-minute discovery call; its documentation also describes a self-hosted trial setup.Read 4 Oct 2026 · portswigger.net
API
A GraphQL API can trigger scans, fetch findings, manage sites, and send results to internal tools.Read 4 Oct 2026 · portswigger.net
Integrations
Named CI/CD integrations include Jenkins, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, CircleCI, and TeamCity; findings can be delivered to Jira, ServiceNow, Azure Boards, and GitHub Issues.Read 4 Oct 2026 · portswigger.net
Support
The product page describes technical support from specialists, SLA-backed support for enterprise, onboarding, and a named solutions architect for the enterprise tier.Read 4 Oct 2026 · portswigger.net
Headquarters
Knutsford, Cheshire, UKRead 23 Sep 2026 · portswigger.net
Founded
2008Read 23 Sep 2026 · portswigger.net
Company
PortSwigger describes itself as a web security company whose mission is to enable the world to secure the web.Read 4 Oct 2026 · portswigger.net
Access controls
The product supports role-based access control, site groups, audit trails, SAML single sign-on, and scan policy templates that can be locked per group.Read 4 Oct 2026 · portswigger.net
AI data handling
The maker says AI request data is not stored by its AI providers and that Burp AI communications use TLS 1.2 or later; the AI documentation says the service is covered by PortSwigger’s ISO 27001 certification.Read 4 Oct 2026 · portswigger.net
AI features
Optional Burp AI features include AI-enhanced issue investigation and AI-generated recorded logins; DAST administrators must enable the features for an instance.Read 4 Oct 2026 · portswigger.net
Air-gapped use
The self-hosted deployment supports air-gapped environments and can use PostgreSQL or Oracle for production.Read 4 Oct 2026 · portswigger.net
API automation
A GraphQL API can trigger scans, fetch findings, manage sites, and send results to internal tools.Read 4 Oct 2026 · portswigger.net
API coverage
It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication.Read 4 Oct 2026 · portswigger.net
API scanning
It scans APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL, with native Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials authentication.Read 4 Oct 2026 · portswigger.net
Authenticated scanning
Session-aware scanning maintains authenticated state, and supported login methods include username and password pairs or recorded login sequences.Read 4 Oct 2026 · portswigger.net
Custom checks
BChecks authored for Burp Suite Professional run unchanged in Burp Suite DAST.Read 4 Oct 2026 · portswigger.net
Evidence and reporting
Findings include the captured request and confirming response, and compliance reports cover OWASP Top 10 2025 and PCI DSS v4.0.1; PortSwigger says these reports do not guarantee compliance.Read 4 Oct 2026 · portswigger.net
Modern web scanning
Its Chromium-based crawler handles JavaScript single-page apps, dynamic forms, GraphQL endpoints, and asynchronous loads, with parallel crawl and audit.Read 4 Oct 2026 · portswigger.net
Pricing availability
The official pricing page displays a plans heading but no plan prices or limits in its readable page content; the product page directs buyers to request a demo or talk to sales.Read 4 Oct 2026 · portswigger.net
Scan management
Teams can schedule portfolio scans from a dashboard or run scans in CI pipelines, including on pull requests and merges.Read 4 Oct 2026 · portswigger.net

Plans and prices

Burp Suite DAST Priced on request Tailored solution; pricing depends on portfolio; contact PortSwigger Read 4 Oct 2026 · portswigger.net

Every Burp Suite DAST plan and price →

Strong points and limits

Strong points

  • Crawls JavaScript apps, dynamic forms, GraphQL, and asynchronous loads.
  • Scans APIs described by Postman Collections, OpenAPI, SOAP, and GraphQL.
  • Supports scheduled scans and CI pipeline runs.
  • Offers managed cloud and self-hosted deployment.
  • Findings include captured requests and confirming responses.

Limits

  • Pricing depends on the portfolio and requires contacting PortSwigger.
  • The guided proof-of-concept trial follows a demo and discovery call.
  • Optional AI features must be enabled by DAST administrators.

Who it suits

Burp Suite DAST suits teams scanning modern web applications and APIs, especially those integrating scans into CI pipelines. Its self-hosted option also supports air-gapped environments.

Verdict

Burp Suite DAST provides web and API scanning with deployment and access-control options for team workflows. Buyers need to contact PortSwigger for portfolio-based pricing, and the trial process includes a demo and discovery call.

Where Specifiction places it

Alternatives to Burp Suite DASTAll alternatives →