Burp Suite DAST vs Escape
Burp Suite DAST
portswigger.net
Escape
escape.techSide by side
| Figure | Burp Suite DAST | Escape |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Web Application Security Scanners | 8.6 (#1) | 7.3 (#17) |
| AI data handling | The maker says AI request data is not stored by its AI providers and that Burp AI communications use TLS 1.2 or later; the AI documentation says the service is covered by PortSwigger’s ISO 27001 certification. | Escape’s AI Pentesting FAQ says customer context is scoped to the organization and asset and is never used to train models. |
| Founded | 2008 | 2020 |
| Headquarters | Knutsford, Cheshire, UK | Escape says its team is based across Europe and the US; the page does not name a specific headquarters city. |
| Integrations | Named CI/CD integrations include Jenkins, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, CircleCI, and TeamCity; findings can be delivered to Jira, ServiceNow, Azure Boards, and GitHub Issues. | The homepage names Wiz for asset and risk context, and Cursor, Claude Code, and Gemini for AI-assisted remediation. |
Plans
In their own words
Burp Suite DAST
Burp Suite DAST is an automated dynamic scanner for web vulnerabilities, built on the scanning engine used in Burp Suite Professional. Its Chromium-based crawler can handle JavaScript single-page applications, dynamic forms, GraphQL endpoints, and asynchronous loads, while crawling and auditing can run in parallel. Session-aware scans maintain authenticated state using username-password pairs or recorded login sequences. The scanner covers APIs described by Postman Collections, OpenAPI, SOAP, and GraphQL, with native support for several authentication methods. Teams can schedule portfolio scans from a dashboard or run them in CI pipelines, including on pull requests and merges. Deployment options include managed cloud and self-hosted software for Windows and Linux, plus Helm deployment for Kubernetes; self-hosted deployments can operate in air-gapped environments. Access controls include role-based permissions, site groups, audit trails, SAML single sign-on, and group-locked scan policies. Findings include captured requests and confirming responses. Pricing depends on the portfolio and requires contacting PortSwigger; a guided proof-of-concept trial follows a tailored demo and discovery call.