Veracode DAST

Overview

Veracode DAST scans live web applications and REST APIs, including authenticated targets and assets behind firewalls. It suits teams that need configurable scanning tied to development workflows. The main trade-offs are custom pricing and an OpenAPI specification requirement for API scans.

Key features

Scans can run automatically or on a schedule, with controls for depth, speed and accuracy. A Quick scan takes about three to five minutes and uses non-invasive scanners to check basic misconfigurations; it is a narrow, fast option rather than a substitute for deeper scans.

The cloud-native engine is designed to scan hundreds of assets across environments, including applications behind firewalls. Veracode reports a false positive rate below 5%. DAST probes API endpoints and complete workflows, including business logic, which makes it relevant when security checks need to cover more than isolated routes.

CI/CD integration uses webhooks or the Veracode CLI, and reports can be downloaded in PDF, JUnit or CSV. Ticketing workflows are documented for Jira, DefectDojo and Asana. Veracode directs customers to Technical Support for help with DAST integrations.

API testing requires an OpenAPI 2.0 or 3.0 specification in JSON or YAML; HAR files are not supported. That prerequisite can rule out teams whose API documentation is not maintained in one of those formats.

Pricing

Veracode DAST is paid, with custom pricing and no free plan. The plan is offered for web applications and APIs, and Veracode invites prospective customers to request a live demo or contact the company for pricing.

A free 14-day DAST trial is available through the Veracode Platform. It gives teams a defined period to assess the product before committing, but does not change the paid-only plan model.

Platforms

DAST is delivered as SaaS with a hybrid deployment model and cloud deployment options. The product is listed for web, API, Linux, macOS and Windows environments. Browser-based and authenticated scanning are supported, alongside an agent-based approach.

The DAST engine is language-agnostic, but specific language coverage is not published. Veracode reports SOC 2 Type II attestation and a FedRAMP Moderate Authority to Operate for its cloud-based application security platform. The United States Federal Region is not supported for DAST, so federal-region requirements may make it unsuitable despite that platform-level authorization.

Who it's for

Veracode DAST is a strong fit for organizations scanning live web applications and APIs at scale, especially where authentication, firewall boundaries, scheduled runs or CI/CD integration matter. API teams should have OpenAPI documentation ready, and buyers should confirm that the product's region support fits their deployment needs.

It is less suitable for teams seeking a free ongoing scanner, an API scanner that accepts HAR files, or a public price they can compare without contacting sales.

Pros and cons

Pros: Authenticated scanning and support for assets behind firewalls extend testing to applications that are not publicly exposed.

Pros: Scheduled scans, configurable scan behavior and CI/CD integrations support repeatable checks in development workflows.

Pros: API workflow probing and a reported false positive rate below 5% strengthen its case for teams balancing coverage with manageable findings.

Cons: API scans require OpenAPI 2.0 or 3.0 JSON/YAML; HAR files are not accepted.

Cons: There is no free plan, and custom pricing makes direct budget comparison harder.

Cons: DAST is unavailable in the United States Federal Region.

Alternatives

For a broader comparison of products in this category, browse Dynamic Application Security Testing Software. If you want to compare adjacent approaches, see Interactive Application Security Testing Software, SAST Tools, Static Application Security Testing Software, DevSecOps Platforms or Dependency Management Software.

Qualys External Attack Surface Management may suit buyers who want to evaluate a 30-day no-cost CSAM with EASM offer. Choose Beagle Security if a free tier matters: it includes one lite test per month, monthly surface scan reports, and SSL and domain expiry monitoring; its Essential plan is $99 a month, billed $1188 annual.

Detectify Surface Monitoring has a free Starter plan for up to five users and one team, but Surface Monitoring costs extra per domain; its Standard plan is €2,500 a year, billed annual. For a free, open-source web application scanner, consider w3af; Wapiti is another free, open-source vulnerability scanner, without a free trial.

Bright Security DAST and Burp Suite DAST are paid alternatives with pricing available by request; Burp Suite says pricing depends on portfolio. DASTA-AI offers a free one-scan Demo and a Personal plan at $100 a month for 30 scans, making it worth considering when a stated scan quota is useful.

Verdict

Choose Veracode DAST if your team needs scalable live-application and API testing that can reach authenticated or firewalled targets and fit CI/CD routines. Its configurable scans and workflow coverage are compelling, but teams should look elsewhere if they need HAR-based API scanning, United States Federal Region support, or a free plan.