Burp Suite DAST vs Pentographer

Burp Suite DAST is an automated dynamic scanner for web vulnerabilities, built on the scanning engine used in Burp Suite Professional. Its Chromium-based crawler can handle JavaScript single-page applications, dynamic forms, GraphQL endpoints, and asynchronous loads, while crawling and auditing can run in parallel. Session-aware scans maintain authenticated state using username-password pairs or recorded login sequences. The scanner covers APIs described by Postman Collections, OpenAPI, SOAP, and GraphQL, with native support for several authentication methods. Teams can schedule portfolio scans from a dashboard or run them in CI pipelines, including on pull requests and merges. Deployment options include managed cloud and self-hosted software for Windows and Linux, plus Helm deployment for Kubernetes; self-hosted deployments can operate in air-gapped environments. Access controls include role-based permissions, site groups, audit trails, SAML single sign-on, and group-locked scan policies. Findings include captured requests and confirming responses. Pricing depends on the portfolio and requires contacting PortSwigger; a guided proof-of-concept trial follows a tailored demo and discovery call.

Pentographer is an open-source platform for managing security assessments, from findings and evidence through client reports. Findings can carry CVSS scores, risk and status tracking, evidence attachments, version history, and playbook links. Users can build reusable checklists mapped to OWASP, PTES, or their own framework; OWASP Top 10 (2021) is built in. Claude can draft finding descriptions and remediation from tester notes, evidence images, and playbook context, with review required before saving and an Anthropic API key required. Pentographer creates branded reports with customizable templates and executive summaries, exporting to Word and PDF. Team workspaces provide owner, admin, member, and viewer roles, including read-only viewers. A GraphQL API handles projects, findings, and playbooks, while an MCP server supports Claude Desktop, Cursor, and compatible clients. Free cloud and MIT-licensed self-hosted plans are listed; self-hosting requires Node.js 20+ and PostgreSQL.