Checkmarx DAST vs Safeguard DAST
Checkmarx DAST
checkmarx.com
Safeguard DAST
safeguard.shSide by side
| Figure | Checkmarx DAST | Safeguard DAST |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 0 |
| Spec score · Dynamic Application Security Testing Software | 7.7 (#11) | 7.1 (#17) |
| Authentication | DAST supports browser-recorded login flows, two-factor authentication, and instant verification for application coverage. | Supported authenticated flows include form auth, OAuth 2.0 with refresh, JWT bearer, session cookies, SAML, and mutual TLS. |
| Deployment | Checkmarx One is offered as cloud SaaS and supports self-hosted and on-premises deployments, including for air-gapped environments. | Internal-network and on-prem scanning is supported through a self-hosted scanner pod with mTLS to the control plane. |
| Founded | 2006 | 2026 |
| Integrations | Checkmarx lists CI/CD integrations including Jenkins, TeamCity, GitHub Actions, Azure DevOps, Maven, Bitbucket Pipelines, CircleCI, GitLab CI, Bamboo, AWS CodeBuild, and SonarQube. | The listed CI integrations are GitHub Actions, GitLab CI, Buildkite, CircleCI and Jenkins. |
| Purpose | Checkmarx DAST is a language-agnostic tool that tests live web applications and APIs by simulating real-world attacks. | Safeguard DAST dynamically tests running applications and reports attack surface coverage alongside findings. |
Plans
In their own words
Checkmarx DAST
Checkmarx DAST has no write-up on Specifiction yet; its figures are above.
Safeguard DAST
Safeguard DAST dynamically tests running applications, reporting findings alongside how much discovered attack surface the scan reached. Its graph-aware crawler uses Safeguard SAST call graphs, route tables, and authentication middleware. Endpoint inventories can come from OpenAPI, GraphQL introspection, gRPC reflection, and live traffic samples. Targeted payloads cover SQL, OS command, SSRF, XSS, and deserialization sink classes, with parameter shapes informing generation. Authenticated flows include form authentication, OAuth 2.0 refresh, JWT bearer, session cookies, SAML, and mutual TLS. Listed scan modes are Fast, Deep, Progressive, and Reconnaissance; Reconnaissance sends no probes. Coverage Score explains reached surface and stopping reasons, while stated coverage includes the OWASP Top 10 and API Top 10. JavaScript, JSON, and source maps are analyzed for exposed credentials, routes, endpoints, cloud references, personal data, configuration, and comments. Secret samples are redacted, ownership verification gates requests, and scope, rate, and budget limits constrain them. It supports self-hosted and web use, hybrid deployment, CI integrations, pull-request and IDE workflows, and listed infrastructure analyses. Pricing is freemium: Free plan; paid from $9/mo.