Burp Suite DAST vs Caido

Burp Suite DAST is an automated dynamic scanner for web vulnerabilities, built on the scanning engine used in Burp Suite Professional. Its Chromium-based crawler can handle JavaScript single-page applications, dynamic forms, GraphQL endpoints, and asynchronous loads, while crawling and auditing can run in parallel. Session-aware scans maintain authenticated state using username-password pairs or recorded login sequences. The scanner covers APIs described by Postman Collections, OpenAPI, SOAP, and GraphQL, with native support for several authentication methods. Teams can schedule portfolio scans from a dashboard or run them in CI pipelines, including on pull requests and merges. Deployment options include managed cloud and self-hosted software for Windows and Linux, plus Helm deployment for Kubernetes; self-hosted deployments can operate in air-gapped environments. Access controls include role-based permissions, site groups, audit trails, SAML single sign-on, and group-locked scan policies. Findings include captured requests and confirming responses. Pricing depends on the portfolio and requires contacting PortSwigger; a guided proof-of-concept trial follows a tailored demo and discovery call.

Caido is a web security auditing toolkit for scaling manual testing through AI and teamwork. Its proxy intercepts and monitors HTTP and WebSocket traffic, with history for intercepted traffic and WebSocket messages. HTTPQL filtering lets users search requests and responses. Node-based workflows support ad-hoc automation, and automated attacks can use custom payloads and placeholders. Users can connect existing LLM providers, including Anthropic, Google, OpenAI, and providers available through OpenRouter. AI agents can access Caido programmatically through its Client SDK. Community plugins and custom extensions are supported; the Basic plan allows three plugins. Basic is free forever and includes two projects, seven workflows, five filter presets, and one pipeline session at a time. The pricing note lists paid access from $20/user/mo, while the opened pricing page did not display prices for Individual, Team, or Enterprise. Caido lists Linux, macOS, Windows, web, API, and self-hosted platforms, and presents the product for pentesters, security engineers, and bug bounty hunters.