Burp Suite DAST vs Checkmarx One

Burp Suite DAST is an automated dynamic scanner for web vulnerabilities, built on the scanning engine used in Burp Suite Professional. Its Chromium-based crawler can handle JavaScript single-page applications, dynamic forms, GraphQL endpoints, and asynchronous loads, while crawling and auditing can run in parallel. Session-aware scans maintain authenticated state using username-password pairs or recorded login sequences. The scanner covers APIs described by Postman Collections, OpenAPI, SOAP, and GraphQL, with native support for several authentication methods. Teams can schedule portfolio scans from a dashboard or run them in CI pipelines, including on pull requests and merges. Deployment options include managed cloud and self-hosted software for Windows and Linux, plus Helm deployment for Kubernetes; self-hosted deployments can operate in air-gapped environments. Access controls include role-based permissions, site groups, audit trails, SAML single sign-on, and group-locked scan policies. Findings include captured requests and confirming responses. Pricing depends on the portfolio and requires contacting PortSwigger; a guided proof-of-concept trial follows a tailored demo and discovery call.

Checkmarx One is a paid web application-security platform focused on source-code analysis. It integrates with CI/CD workflows, scans pull requests, and supports IDE use so security checks can occur during development. Teams can define custom security rules and custom rules for their requirements, while automated fixes assist with remediation. The listed analysis target is source code. Pull-request scanning provides a way to examine proposed changes, and CI/CD integration connects checks with delivery processes. IDE support places analysis in developer tooling. Checkmarx One has no free plan, and pricing is available on request. The company was founded in 2006. Its web delivery model combines configurable security policies with automated assistance for addressing findings, without listing additional analysis targets or a free tier.