Best Dynamic Application Security Testing (DAST) Software

How Many Dynamic Application Security Testing (DAST) Software Products Does G2 Track?

Total Products under this Category: 103

Category Stats (Nov 2026)

  • Average Rating: 4.58/5 The average rating of products in this category, based on all submitted ratings
  • Top Trending Product: Checkmarx (+0.4%) - Among all products in this category, Checkmarx recorded the largest rating increase compared to last month

Last updated: November 01, 2026

How Does G2 Rank Dynamic Application Security Testing (DAST) Software Products?

Why You Can Trust G2's Software Rankings:

  • 30 Analysts and Data Experts
  • 4,400+ Authentic Reviews
  • 103+ Products
  • Unbiased Rankings

G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.

G2 Grid® for Dynamic Application Security Testing (DAST) Software

G2 Grid® for Dynamic Application Security Testing (DAST) Software plotting products by satisfaction and market presence

Highlighted products: HCL AppScan, Aikido Security, Astra Pentest, Intruder, Burp Suite, Qodex.ai, GitLab, and Invicti.

Underlying data: [Grid® JSON](https://www.g2.com/categories/dynamic-application-security-testing-dast/grids.json?focus%5B%5D=hcl-appscan&focus%5B%5D=aikido-security&focus%5B%5D=astra-pentest&focus%5B%5D=intruder&focus%5B%5D=burp-suite&focus%5B%5D=qodex-ai&focus%5B%5D=gitlab&focus%5B%5D=invicti)

HCL AppScan

HCL AppScan is a comprehensive suite of market-leading application security testing solutions (SAST, DAST, IAST, SCA, API), available on-premises and on-cloud. These powerful DevSecOps tools pinpoint application vulnerabilities, allowing for quick remediation in every phase of the software development lifecycle. Fast and Accurate Scanning for Secure DevOps Developers and DevOps teams can quickly and accurately scan code, applications, and APIs for security vulnerabilities while applications are being developed. This allows companies to fix issues at the earliest stages of the software development lifecycle, when it is least costly to the business. Focus on the Fix Continuous monitoring with IAST, along with auto issue correlation with DAST and SAST scan results allows DevOps teams to group and prioritize findings for faster, more streamlined remediation. Enterprise Management for Security Teams Centralized, easy-to-use dashboards provide visibility and oversight of all security scanning and remediation, and allow users to set scan parameters and compliance policies.

Average Rating: 4.2/5.0

Total Reviews: 125

How Do G2 Users Rate HCL AppScan?

  • Has the product been a good partner in doing business?: 8.6/10 (Category avg: 9.2/10)
  • API / Integrations: 8.6/10 (Category avg: 8.7/10)
  • Detection Rate: 8.3/10 (Category avg: 8.8/10)
  • Test Automation: 8.5/10 (Category avg: 8.8/10)

Who Is the Company Behind HCL AppScan?

  • Seller: HCL Technologies
  • Company Website:
  • Year Founded: 1999
  • HQ Location: Noida, Uttar Pradesh
  • LinkedIn® Page: www.linkedin.com
    258,955 employees on LinkedIn®
  • Ownership: NSE - National Stock Exchange of India

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer & Network Security
  • Company Size: 51% Large, 25% Medium

What Are Recent G2 Reviews of HCL AppScan?

What Are G2 Users Discussing About HCL AppScan?

Aikido Security

Aikido Security is the developer-first security platform that unifies code, cloud, protection, and attack testing in one suite of best-in-class products. Built by developers for developers, Aikido helps teams of any size ship secure software faster, automate protection, and simulate real-world attacks with AI-driven precision. The platform’s proprietary AI cuts noise by 95%, delivers one-click fixes, and saves developers 10+ hours per week. Aikido Intel proactively uncovers vulnerabilities in open source packages before disclosure, helping secure more than 50,000 organizations worldwide, including Revolut, Niantic, Visma, Montblanc, and GoCardless.

Average Rating: 4.5/5.0

Total Reviews: 272

How Do G2 Users Rate Aikido Security?

  • Has the product been a good partner in doing business?: 9.3/10 (Category avg: 9.2/10)
  • API / Integrations: 8.3/10 (Category avg: 8.7/10)
  • Detection Rate: 10.0/10 (Category avg: 8.8/10)
  • Test Automation: 10.0/10 (Category avg: 8.8/10)

Who Is the Company Behind Aikido Security?

  • Seller: Aikido Security
  • Company Website:
  • Year Founded: 2022
  • HQ Location: Ghent, Belgium
  • LinkedIn® Page: www.linkedin.com
    320 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Founder, CTO
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 78% Small, 15% Medium

What Do G2 Reviewers Say About Aikido Security?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the ease of use of Aikido Security, thanks to its clear insights and seamless integration.
  • Users appreciate Aikido Security's robust security capabilities, providing a comprehensive and seamless integration in their workflow.
  • Users value the intuitive dashboard of Aikido Security, which simplifies security issue identification and management.
  • Users value the easy integrations of Aikido Security, enhancing workflows with seamless connections to existing GitLab repositories.
  • Users find Aikido's easy setup highly efficient, enabling quick implementation and immediate usability for security assessments.
Cons
  • Users note the lack of advanced features in Aikido Security, such as dark mode and in-depth analysis options.
  • Users find the pricing structure expensive for micro businesses, making upgrades difficult to justify.
  • Users note the limited features of Aikido Security, wishing for more customization and advanced options.
  • Users find the pricing issues challenging, especially for micro businesses, due to the steep upgrade costs.
  • Users feel Aikido Security is lacking features like advanced reporting and deeper compliance analysis compared to competitors.

What Are Recent G2 Reviews of Aikido Security?

Astra Pentest

Astra Security is a leading continuous penetration testing platform that combines AI-powered autonomous pentesting with certified expert-led assessments. Powered by Attack AI, trained on 6.8M+ security findings and insights from 5,000+ real-world pentests. Astra deploys intelligent agents that continuously discover, validate, prioritize, and help remediate vulnerabilities at scale. While AI handles speed and scale, Astra’s certified security experts focus on what automation alone cannot: complex business logic flaws, multi-step attack chains, advanced exploit paths, and emerging AI/LLM-specific threats. Built for modern engineering teams, Astra integrates directly into CI/CD workflows, enabling continuous security validation between releases instead of relying on outdated annual pentests. The platform delivers comprehensive Autonomous Pentest powered by AI agents, DAST vulnerability scanner and human-driven pentests across web apps, AI/LLMs, mobile apps, APIs, cloud infrastructure. Astra is CREST-accredited, CERT-IN empaneled, and a PCI ASV-certified vendor. Our team also led the development of the OWASP APTS framework, helping shape the industry standard for continuous security testing. Today, 1,500+ organizations across 70+ countries trust Astra Security, including Ford, Loom, CompTIA, Hitachi, HackerRank, and OLX.

Average Rating: 4.7/5.0

Total Reviews: 264

G2 Deal: For G2 users: 10% off across all pentest plans

Avail Astra Pentest at 10% off, our comprehensive pentest suite scans for 8000+ security tests including OWASP Top 10, SANS 25, known CVEs & security best practices. This offer is exclusive to G2 users!

Price: ~~$5999~~ → $5400

View this exclusive G2 deal

How Do G2 Users Rate Astra Pentest?

  • Has the product been a good partner in doing business?: 9.3/10 (Category avg: 9.2/10)
  • API / Integrations: 8.3/10 (Category avg: 8.7/10)
  • Detection Rate: 8.9/10 (Category avg: 8.8/10)
  • Test Automation: 8.8/10 (Category avg: 8.8/10)

Who Is the Company Behind Astra Pentest?

  • Seller: ASTRA IT, Inc.
  • Company Website:
  • Year Founded: 2018
  • HQ Location: Bengaluru, IN
  • LinkedIn® Page: www.linkedin.com
    154 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: CTO, CEO
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 68% Small, 27% Medium

What Do G2 Reviewers Say About Astra Pentest?

AI-generated summary from verified user reviews

Pros
  • Users value the responsive customer support of Astra Pentest, facilitating a smooth and efficient penetration testing process.
  • Users appreciate Astra Pentest's thorough vulnerability detection, praising its clarity, responsiveness, and ease of management.
  • Users appreciate the ease of use of Astra Pentest, enjoying a smooth onboarding process and intuitive interface.
  • Users commend Astra Pentest for its thorough and responsive pentesting efficiency, simplifying vulnerability management with clear guidance.
  • Users value Astra Pentest's thorough vulnerability identification, enjoying clear findings and effective collaboration for easy remediation.
Cons
  • Users express frustration with poor customer support, highlighting delays and lack of transparency in tracking issues.
  • Users note a poor interface design in Astra Pentest, making usability and navigation more challenging than necessary.
  • Users often face slow performance issues, particularly with report speed and initial setup complications during pentesting.
  • Users note that the UX could be improved, particularly regarding the interface's intuitiveness and false positives during scans.
  • Users experience false positives with Astra Pentest, leading to additional clarification and verification time.

What Are Recent G2 Reviews of Astra Pentest?

What Are G2 Users Discussing About Astra Pentest?

AI can help you find the answers. G2 helps you trust them.

Connect G2 to Claude or ChatGPT for answers grounded in G2's trusted reviews, comparisons, and pricing from real user insights.

How it works
Connect G2 to ChatGPTConnect G2 to Claude

Burp Suite

Burp Suite is a complete ecosystem for web application and API security testing, combining two products: Burp Suite DAST - a best-of-breed, precision DAST solution that automates runtime testing, and Burp Suite Professional - the industry-standard toolkit for manual penetration testing. Developed by PortSwigger, more than 85,000 security professionals rely on Burp Suite to find, verify, and understand vulnerabilities across complex modern web applications. Burp Suite DAST is PortSwigger’s enterprise dynamic application security testing (DAST) solution, purpose-built for continuous, automated scanning of web applications and APIs. Unlike many DAST solutions, which are part of a wider AST offering, Burp Suite DAST is not a bolt-on tool - instead it’s precision-built from over 20 years of dynamic testing experience. Burp Suite DAST reveals the runtime issues that static analysis tools miss, such as authentication flaws, configuration drift, and chained vulnerabilities. Built on the same proprietary scanning engine that powers Burp Suite Professional, it delivers precise, low-noise results that security teams trust. Key capabilities of Burp Suite DAST include: Continuous, automated scanning of web applications and APIs, integration with CI/CD pipelines and vulnerability management tools, flexible deployment across cloud, and on-premise environments, shared scanning logic and configurations between automated and manual testing, accurate, low-noise detection informed by PortSwigger Research. Burp Suite Professional complements DAST with deep manual testing capability. It’s the industry-standard toolkit for penetration testers, consultants, and AppSec engineers who need complete insight and flexibility when validating or exploring vulnerabilities. Findings discovered by DAST can be investigated and verified in Burp Suite Professional, ensuring every result is accurate, contextual, and actionable. Together, Burp Suite DAST and Burp Suite Professional create a unified ecosystem that delivers automation at breadth and manual depth where it counts. Burp Suite is built for AppSec teams who need scalable, trustworthy coverage across web and API environments, enabling a seamless handoff between automated and manual testing.

Average Rating: 4.8/5.0

Total Reviews: 134

How Do G2 Users Rate Burp Suite?

  • Has the product been a good partner in doing business?: 9.7/10 (Category avg: 9.2/10)
  • API / Integrations: 8.3/10 (Category avg: 8.7/10)
  • Detection Rate: 7.2/10 (Category avg: 8.8/10)
  • Test Automation: 7.5/10 (Category avg: 8.8/10)

Who Is the Company Behind Burp Suite?

Who Uses This Product?

  • Who Uses This: Cyber Security Analyst
  • Top Industries: Computer & Network Security, Information Technology and Services
  • Company Size: 41% Medium, 33% Small

What Do G2 Reviewers Say About Burp Suite?

AI-generated summary from verified user reviews

Pros
  • Users enjoy the user-friendly interface of Burp Suite, making navigation and analysis straightforward for all skill levels.
  • Users highlight the user-friendly interface of Burp Suite, making it easy to navigate and utilize effectively.
  • Users value the deep automation and manual testing capabilities of Burp Suite for effective security assessments.
  • Users appreciate the control and visibility Burp Suite offers, with powerful tools for effective web application testing.
  • Users praise Burp Suite for its clear, user-friendly interface that simplifies web application penetration testing for both beginners and experts.
Cons
  • Users find Burp Suite to be expensive, particularly for the professional version, which may limit accessibility for some users.
  • Users report slow performance with Burp Suite, particularly on lower-end systems during extensive scanning tasks.
  • Users find the steep learning curve of Burp Suite challenging, especially beginners navigating its complex features and tools.
  • Users find the steep learning curve in Burp Suite challenging, particularly for beginners adjusting to its complex setup.
  • Users find the limited customization in Burp Suite restricts exploration, especially for beginners and independent learners.

What Are Recent G2 Reviews of Burp Suite?

What Are G2 Users Discussing About Burp Suite?

Intruder

Intruder's continuous exposure management platform helps security, IT, and engineering teams stop breaches before they start. By unifying AI penetration testing, attack surface monitoring, cloud security, and vulnerability management in one intuitive platform, Intruder gives stretched teams an always-on security source of truth. Our approach focuses on continuous automated scanning using expertise and agentic solutions to ensure that the findings we deliver are accurate, prioritized by real-world risk, and ready to act on. Founded in 2015 by Chris Wallis, a former ethical hacker turned corporate blue teamer, Intruder is now protecting over 3,000 companies worldwide. Intruder has been awarded multiple accolades, was selected for GCHQ’s Cyber Accelerator, included on Deloitte’s Tech Fast 50 2023 list as the fastest-growing cybersecurity company in the UK and was named in G2’s 2026 Best Software Awards.

Average Rating: 4.8/5.0

Total Reviews: 223

How Do G2 Users Rate Intruder?

  • Has the product been a good partner in doing business?: 9.7/10 (Category avg: 9.2/10)
  • API / Integrations: 8.9/10 (Category avg: 8.7/10)
  • Detection Rate: 9.5/10 (Category avg: 8.8/10)
  • Test Automation: 8.8/10 (Category avg: 8.8/10)

Who Is the Company Behind Intruder?

  • Seller: Intruder
  • Company Website:
  • Year Founded: 2015
  • HQ Location: London
  • LinkedIn® Page: www.linkedin.com
    81 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: CTO, Director
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 56% Small, 37% Medium

What Do G2 Reviewers Say About Intruder?

AI-generated summary from verified user reviews

Pros
  • Users find Intruder's ease of use essential, appreciating its intuitive setup and minimal maintenance requirements.
  • Users value the easy setup and effective vulnerability detection of Intruder, enhancing their network security swiftly.
  • Users commend Intruder's responsive and friendly customer support, appreciating their fast and effective communication for assistance.
  • Users praise Intruder's intuitive user interface, which simplifies navigation and integrates seamlessly with existing tools.
  • Users appreciate the clarity and prioritisation of Intruder's vulnerability findings, enabling effective and meaningful action against risks.
Cons
  • Users find the expensive pricing a barrier for smaller implementations and prefer a more competitive option.
  • Users are frustrated with the slow scanning speed of Intruder, leading to missed vulnerabilities and increased manual work.
  • Users find licensing issues complicated, with unclear costs and separate application and infrastructure licenses adding to confusion.
  • Users report experiencing false positives with Intruder, leading to extra manual work and missed vulnerabilities.
  • Users find limited features in Intruder, particularly regarding licensing clarity and advanced reporting options.

What Are Recent G2 Reviews of Intruder?

What Are G2 Users Discussing About Intruder?

Qodex.ai

Qodex is a swarm of AI agents that attacks and tests your app 24/7, so your team ships AI-written code without a security or QA team. The problem: your team ships with coding agents, so the code doubles and the people who test and secure it do not. 45% of AI-written code fails OWASP Top 10 security tests (Veracode, 2025). Your pentest is once a year. What Qodex does: a swarm of agents runs against your live app. The largest group tries to break in the way a hacker would: injection, broken auth, one customer seeing another customer's data, the OWASP Top 10 and the OWASP API Top 10, with the exploit reproduced as evidence. The others click through every screen in a real browser and call every API, from an OpenAPI, Swagger or Postman import. How you drive it: describe what to attack or test in plain English and watch it work live. It remembers your app across sessions: auth, quirks, past bugs, your code if you link the repo. What you keep: every test is saved as plain Playwright or HTTP code you own. Saved tests re-run with no AI calls, every night, from CI on every deploy, or from Claude Code and Cursor. When a screen changes, a saved step finds its control again from the intent. What you get back: every failure labelled real bug, stale test or environment problem, with severity, steps and evidence. A security test passes only when the attack was blocked. Start: free plan, no card. Paid from $1,299 per project per month. Managed cloud, AWS Marketplace or self-host.

Average Rating: 4.9/5.0

Total Reviews: 60

How Do G2 Users Rate Qodex.ai?

  • Has the product been a good partner in doing business?: 9.4/10 (Category avg: 9.2/10)
  • API / Integrations: 8.3/10 (Category avg: 8.7/10)
  • Detection Rate: 8.3/10 (Category avg: 8.8/10)
  • Test Automation: 10.0/10 (Category avg: 8.8/10)

Who Is the Company Behind Qodex.ai?

  • Seller: QodexAI
  • Year Founded: 2024
  • HQ Location: San Francisco, California
  • LinkedIn® Page: linkedin.com
    13 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 75% Small, 20% Medium

What Do G2 Reviewers Say About Qodex.ai?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the ease of use of Qodex.ai, allowing quick adoption and streamlined testing workflows effortlessly.
  • Users value the automation capabilities of Qodex.ai, which streamline AI testing while maintaining high quality and speed.
  • Users praise Qodex.ai for its ability to automate AI-driven testing workflows, significantly reducing manual efforts while ensuring quality.
  • Users appreciate the testing efficiency of Qodex.ai, enabling faster workflows while ensuring high-quality coverage in AI testing.
  • Users appreciate the ease of use and automation in Qodex.ai, simplifying testing processes and enhancing productivity.
Cons
  • Users note that the slow loading times for UI and reports can hinder their overall experience.
  • Users find the poor documentation of Qodex.ai limits their ability to fully utilize advanced features effectively.
  • Users notice slow performance in Qodex.ai, with delays in UI loading and chatbot response times affecting usability.
  • Users report bug issues with repeated test cases, suggesting improvements in tagging and reporting processes.
  • Users experience repeated test case issues and suggest improvements in bug reporting and prioritization.

What Are Recent G2 Reviews of Qodex.ai?

GitLab

GitLab is the most comprehensive AI-Powered DevSecOps platform that enables software innovation by empowering development, security, and operations teams to build better software, faster. With GitLab, teams can create, deliver, and manage code quickly and continuously instead of managing disparate tools and scripts. GitLab helps your teams across the complete DevSecOps lifecycle, from developing, securing, and deploying software. What makes us truly different? - Flexibility: Consume as a service or manage your own deployment - Cloud-Agnostic: Deploy anywhere with no vendor lock-in - No rip and replace: Scale to a platform approach at your own pace

Average Rating: 4.5/5.0

Total Reviews: 888

How Do G2 Users Rate GitLab?

  • Has the product been a good partner in doing business?: 8.9/10 (Category avg: 9.2/10)
  • API / Integrations: 9.2/10 (Category avg: 8.7/10)
  • Detection Rate: 9.0/10 (Category avg: 8.8/10)
  • Test Automation: 9.1/10 (Category avg: 8.8/10)

Who Is the Company Behind GitLab?

  • Seller: GitLab Inc.
  • Year Founded: 2014
  • HQ Location: San Francisco, California
  • LinkedIn® Page: www.linkedin.com
    3,431 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Software Engineer, Senior Software Engineer
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 37% Medium, 37% Small

What Do G2 Reviewers Say About GitLab?

AI-generated summary from verified user reviews

Pros
  • Users value the ease of use in GitLab, appreciating its intuitive interface and straightforward setup for seamless collaboration.
  • Users appreciate the powerful all-in-one functionalities of GitLab that enhance collaboration and streamline development workflows.
  • Users value GitLab's integrated CI/CD feature, enhancing collaboration and streamlining code management seamlessly.
  • Users value the integrated CI/CD in GitLab, enhancing workflow efficiency and collaboration seamlessly.
  • Users value the seamless integration of GitLab with security tools, enhancing workflow efficiency and convenience.
Cons
  • Users find the complexity of the interface challenging, especially with large projects and advanced features being tiered.
  • Users find the difficult learning curve challenging, particularly when adapting to GitLab's complex features and structure.
  • Users often find the confusing interface of GitLab challenging, especially when navigating its extensive features and settings.
  • Users find the complex user interface challenging, especially with large projects, affecting performance and usability.
  • Users find the learning curve steep when adapting to GitLab's many features and unique group structures.

What Are Recent G2 Reviews of GitLab?

What Are G2 Users Discussing About GitLab?

Invicti

Invicti (formerly known as Netsparker) is an enterprise application and API security testing platform that helps organizations secure thousands of web applications and APIs at scale while dramatically reducing the risk of attack. Combining advanced DAST and IAST capabilities in a single platform, Invicti enables security teams to continuously identify, prioritize, and remediate vulnerabilities across complex modern environments with confidence and automation. With Invicti, security teams can: - Automate application security testing workflows and save hundreds of hours every month - Discover and secure all web applications and APIs, including forgotten, unmanaged, and shadow assets - Deliver actionable, developer-friendly feedback that helps teams remediate vulnerabilities faster and build more secure code over time - Reduce false positives with proof-based scanning technology that validates exploitable vulnerabilities - Scale application security programs across large enterprises without slowing development teams - Integrate security seamlessly into existing DevSecOps and CI/CD workflows Built for organizations with the most demanding security requirements, Invicti empowers teams to confidently secure their entire attack surface with accuracy, scalability, and automation.

Average Rating: 4.5/5.0

Total Reviews: 69

How Do G2 Users Rate Invicti?

  • Has the product been a good partner in doing business?: 9.6/10 (Category avg: 9.2/10)
  • API / Integrations: 8.2/10 (Category avg: 8.7/10)
  • Detection Rate: 8.6/10 (Category avg: 8.8/10)
  • Test Automation: 8.5/10 (Category avg: 8.8/10)

Who Is the Company Behind Invicti?

  • Seller: Invicti Security
  • Company Website:
  • Year Founded: 2018
  • HQ Location: Austin, Texas
  • LinkedIn® Page: www.linkedin.com
    326 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 46% Large, 29% Medium

What Do G2 Reviewers Say About Invicti?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the ease of use of Invicti, highlighting its quick setup and straightforward report generation.
  • Users value the effective scanning technology of Invicti, enabling accurate identification of vulnerabilities and streamlined workflows.
  • Users value the accuracy and integration capabilities of Invicti, enhancing efficiency and simplifying reporting processes.
  • Users appreciate the well-formatted and easy-to-read reports from Invicti, simplifying certification processes significantly.
  • Users value the super accurate vulnerability detection of Invicti, enhancing their security workflows efficiently.
Cons
  • Users find the customer support inadequate, struggling with timely responses and effective solutions to issues.
  • Users experience slow performance during scans and setup, which affects their overall satisfaction with Invicti.
  • Users experience slow scanning issues with Invicti, affecting efficiency despite good support and solid performance once set up.
  • Users face API scanning issues with Invicti, limiting its effectiveness for their specific needs despite good support.
  • Users find the complex setup to be overwhelming initially, impacting the ease of using Invicti effectively.

What Are Recent G2 Reviews of Invicti?

What Are G2 Users Discussing About Invicti?

Harness Platform

Simplify your developer experience with the world's first AI-augmented software delivery platform. Upgrade your software delivery with Harness' innovative CI/CD, Feature Flags, Infrastructure as Code Management, and Chaos Engineering tools. We are a software delivery platform that helps developers and infrastructure engineers build and ship code for cloud and on-premise projects. We automate the continuous integration and continuous delivery (CI/CD) process to help teams build faster, ship more frequently, and improve quality, efficiency, and governance. We help companies in four key areas: Number one, we accelerate innovation through DevOps modernization. We provide an approach for software delivery that automates processes, reduces manual interventions, consolidates tools, and accelerates time-to-market for new products, features, and fixes. Number two, we improve developer experience. We give you the ability to attract, retain, and onboard high-caliber engineering talent while fostering a culture of continuous innovation and improvement. Number three, we secure software delivery. We give you the ability to integrate security into every phase of the SDLC. And last but not least is, we optimize cloud costs. We give you the ability to eliminate waste and to ensure that appropriate cloud resources are allocated at the right place at the right time.

Average Rating: 4.6/5.0

Total Reviews: 330

How Do G2 Users Rate Harness Platform?

  • Has the product been a good partner in doing business?: 9.2/10 (Category avg: 9.2/10)
  • API / Integrations: 10.0/10 (Category avg: 8.7/10)
  • Detection Rate: 10.0/10 (Category avg: 8.8/10)
  • Test Automation: 10.0/10 (Category avg: 8.8/10)

Who Is the Company Behind Harness Platform?

  • Seller: Harness
  • Company Website:
  • Year Founded: 2018
  • HQ Location: San Francisco
  • LinkedIn® Page: www.linkedin.com
    1,832 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Software Engineer, Senior Software Engineer
  • Top Industries: Computer Software, Financial Services
  • Company Size: 41% Large, 40% Medium

What Do G2 Reviewers Say About Harness Platform?

AI-generated summary from verified user reviews

Pros
  • Users find Harness Platform to be easy to use, significantly streamlining deployment management and integrations.
  • Users value the comprehensive features of Harness Platform, facilitating efficient workflows across various DevOps processes.
  • Users value the ease of deploying and testing features with Harness Platform, enhancing workflow and control over experiments.
  • Users appreciate the easy setup of Harness Platform, enabling quick integrations and streamlined workflows for efficient deployment.
  • Users value the easy integrations of the Harness Platform, enhancing their efficiency and adaptability in CI/CD workflows.
Cons
  • Users notice that some essential features are missing from Harness Platform, affecting overall functionality and support.
  • Users find the features immature and desire greater control over data granularity in the Harness Platform.
  • Users find that some features are underdeveloped and essential options are missing, affecting overall satisfaction with Harness Platform.
  • Users find the steep learning curve challenging, especially when adjusting to the platform's numerous features and settings.
  • Users express frustration with the poor UI of Harness Platform, citing clutter and slow navigation as major issues.

What Are Recent G2 Reviews of Harness Platform?

What Are G2 Users Discussing About Harness Platform?

Tenable Nessus

Built for security practitioners, by security professionals, Nessus products by Tenable are the de-facto industry standard for vulnerability assessment. Nessus performs point-in-time assessments to help security professionals quickly and easily identify and fix vulnerabilities, including software flaws, missing patches, malware, and misconfigurations - across a variety of operating systems, devices, and applications. With features such as pre-built policies and templates, customizable reporting, group “snooze” functionality, and real-time updates, Nessus is designed to make vulnerability assessment simple, easy, and intuitive. The result: less time and effort to assess, prioritize, and remediate issues.

Average Rating: 4.5/5.0

Total Reviews: 306

How Do G2 Users Rate Tenable Nessus?

  • Has the product been a good partner in doing business?: 8.7/10 (Category avg: 9.2/10)

Who Is the Company Behind Tenable Nessus?

  • Seller: Tenable
  • Company Website:
  • HQ Location: Columbia, MD
  • LinkedIn® Page: www.linkedin.com
    2,361 employees on LinkedIn®
  • Ownership: NASDAQ: TENB

Who Uses This Product?

  • Who Uses This: Security Engineer, Network Engineer
  • Top Industries: Information Technology and Services, Computer & Network Security
  • Company Size: 41% Medium, 33% Large

What Do G2 Reviewers Say About Tenable Nessus?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the comprehensive and accurate vulnerability detection of Tenable Nessus, enabling efficient management of network security.
  • Users value the high accuracy in vulnerability detection provided by Tenable Nessus, enabling effective risk management.
  • Users praise the high accuracy of automated scanning in Tenable Nessus, enhancing vulnerability management efficiently.
  • Users find the intuitive interface of Tenable Nessus easy to navigate, enhancing their overall user experience.
  • Users appreciate the high accuracy and extensive plugin support of Tenable Nessus for effective vulnerability scanning.
Cons
  • Users find the slow scanning times can disrupt production, often lasting days depending on the environment.
  • Users find the cost of Tenable Nessus to be excessively high, impacting both maintenance and accessibility.
  • Users note limited features in Tenable Nessus, impacting user experience and requiring additional tools for full functionality.
  • Users express concerns about the complexity of Tenable Nessus, noting a steep learning curve and high operational costs.
  • Users experience false positives, occasionally identifying incorrect vulnerabilities, including issues with some Windows patch updates.

What Are Recent G2 Reviews of Tenable Nessus?

What Are G2 Users Discussing About Tenable Nessus?

Cobalt

Cobalt is the pioneer in pentesting as a service (PTaaS) and a leader in continuous offensive security testing grounded in human expertise. The Cobalt Offensive Security Platform spans the full spectrum of offensive security, from targeted, human-led pentesting to high-frequency, AI-driven autonomous security testing. Only Cobalt brings together the four critical elements of modern offensive security: elite human expertise, a context-aware platform, AI-powered orchestration, and the industry's largest dataset of real-world pentest results. Thousands of customers and hundreds of partners rely on Cobalt and its global network of 500+ vetted security experts to continuously identify, prioritize, and remediate exploitable risk with the speed, flexibility, and precision today's organizations require.

Average Rating: 4.5/5.0

Total Reviews: 184

How Do G2 Users Rate Cobalt?

  • Has the product been a good partner in doing business?: 9.3/10 (Category avg: 9.2/10)
  • API / Integrations: 8.3/10 (Category avg: 8.7/10)
  • Detection Rate: 8.6/10 (Category avg: 8.8/10)
  • Test Automation: 8.9/10 (Category avg: 8.8/10)

Who Is the Company Behind Cobalt?

  • Seller: Cobalt
  • Company Website:
  • Year Founded: 2013
  • HQ Location: San Francisco, California
  • LinkedIn® Page: www.linkedin.com
    597 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Security Engineer, CTO
  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 52% Medium, 22% Small

What Do G2 Reviewers Say About Cobalt?

AI-generated summary from verified user reviews

Pros
  • Users value Cobalt's efficient pentesting process with organized dashboards and real-time collaboration, enhancing overall productivity.
  • Users value the quick and responsive customer support of Cobalt, enhancing their testing experience with excellent communication.
  • Users praise the ease of use of Cobalt, highlighting its friendly interface for non-technical resources.
  • Users value the excellent communication from Cobalt's support team, appreciating their responsiveness and timely updates.
  • Users value Cobalt’s real-time, detailed reporting, which provides immediate insights and a streamlined pentesting process.
Cons
  • Users find Cobalt to be expensive compared to competitors, raising concerns over its pricing structure and auto-renewal policy.
  • Users feel that Cobalt has a limited scope of audits, impacting efficiency and overall cybersecurity effectiveness.
  • Users find the lack of detail in test cases leads to confusion and a less satisfactory experience.
  • Users find Cobalt's pricing model confusing and prefer a more straightforward payment structure for services.
  • Users experience inaccuracy in audits, causing missed findings and inefficiencies in the pentesting process of Cobalt.

What Are Recent G2 Reviews of Cobalt?

What Are G2 Users Discussing About Cobalt?

Checkmarx

Checkmarx exists so the world can innovate faster than it ever has and still trust what it builds. That purpose starts with closing the Risk Gap — the widening distance between how fast software gets created and how fast risk can be understood and removed. As AI compresses the software development lifecycle from months to minutes, the old model of shipping code with known vulnerabilities and racing to patch it before attackers strike no longer works. Checkmarx's foundation: decades of deterministic threat intelligence and trillions of lines of code scanned each year. The Checkmarx One platform gives enterprises comprehensive application security, built to capture risk, eliminate vulnerabilities, and unify governance. Checkmarx Fusion now pairs that foundation with Claude-powered AI reasoning, unifying both engines to lead the category in detection accuracy. From there, the Checkmarx Assist family — Developer Assist, Triage Assist, and Remediation Assist — prevents vulnerabilities at the point of creation, prioritizes findings by real-world attackability, and generates review-ready fixes, so nothing sits in backlog waiting on a human to catch up. Checkmarx keeps detection and remediation independent. Instead of having the same system that writes the code grade its own work, security teams get oversight they can trust. This is the promise at the center of the mission: developers and agents never have to become security experts, and security leaders never have to take security on faith so enterprises can innovate at machine speed without ever trading speed for certainty.

Average Rating: 4.2/5.0

Total Reviews: 46

How Do G2 Users Rate Checkmarx?

  • Has the product been a good partner in doing business?: 8.6/10 (Category avg: 9.2/10)
  • API / Integrations: 9.2/10 (Category avg: 8.7/10)
  • Detection Rate: 7.5/10 (Category avg: 8.8/10)
  • Test Automation: 8.3/10 (Category avg: 8.8/10)

Who Is the Company Behind Checkmarx?

  • Seller: Checkmarx
  • Company Website:
  • Year Founded: 2006
  • HQ Location: Paramus, NJ
  • LinkedIn® Page: www.linkedin.com
    997 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer Software
  • Company Size: 56% Large, 22% Medium

What Do G2 Reviewers Say About Checkmarx?

AI-generated summary from verified user reviews

Pros
  • Users find Checkmarx easy to implement into existing repositories, appreciating its user-friendly interface and comprehensive features.
  • Users appreciate the intuitive user interface of Checkmarx, making security reviews straightforward and user-friendly.
  • Users value the accuracy of results from Checkmarx, noting its effective code review and user-friendly interface.
  • Users appreciate the automation of security reviews in Checkmarx, praising its ease of implementation and user-friendly interface.
  • Users commend Checkmarx for its excellent customer support, consistently available to assist with any issues that arise.
Cons
  • Users experience a high number of false positives with Checkmarx, especially when analyzing Kotlin based projects.
  • Users are frustrated with Checkmarx's poor feature support for Kotlin, leading to numerous false positives in scans.
  • Users note a significant issue with false positives in Kotlin support, affecting their experience when using Checkmarx.
  • Users feel that the poor navigation in Checkmarx hinders their ability to efficiently use the dashboards.

What Are Recent G2 Reviews of Checkmarx?

What Are G2 Users Discussing About Checkmarx?

Pynt - API Security Testing

Pynt is an innovative API Security Testing platform exposing verified API threats through simulated attacks. Hundreds of companies rely on Pynt to continuously monitor, classify and attack poorly secured APIs, before hackers do.

Average Rating: 4.8/5.0

Total Reviews: 44

How Do G2 Users Rate Pynt - API Security Testing?

  • Has the product been a good partner in doing business?: 9.2/10 (Category avg: 9.2/10)
  • API / Integrations: 9.5/10 (Category avg: 8.7/10)
  • Detection Rate: 9.3/10 (Category avg: 8.8/10)
  • Test Automation: 9.2/10 (Category avg: 8.8/10)

Who Is the Company Behind Pynt - API Security Testing?

  • Seller: Pynt
  • Year Founded: 2022
  • HQ Location: Tel Aviv, IL
  • LinkedIn® Page: www.linkedin.com
    13 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Computer Software, Computer & Network Security
  • Company Size: 57% Small, 23% Large

What Do G2 Reviewers Say About Pynt - API Security Testing?

AI-generated summary from verified user reviews

Pros
  • Users value Pynt for its efficient vulnerability detection, quickly uncovering critical security issues in APIs.
  • Users appreciate Pynt for its effective security engine, quickly identifying critical issues and boosting confidence in API security.
  • Users appreciate the seamless integration of Pynt with their SDLC, enhancing API discovery and security automation.
  • Users appreciate the simple integration of Pynt with their SDLC, enhancing their API security workflow effortlessly.
  • Users value the automation capabilities of Pynt, as it simplifies API security testing and enhances confidence in their systems.
Cons
  • Users find the complex setup challenging initially, requiring time and effort to fully integrate Pynt effectively.
  • Users find the setup complexity of Pynt challenging, often requiring support to navigate the initial process.
  • Users note the limited features of Pynt, particularly in reporting and onboarding, which can hinder functionality.
  • Users find the user interface challenging, making it difficult to navigate and set up the software effectively.
  • Users find the user interface challenging, suggesting significant improvements for a better overall experience.

What Are Recent G2 Reviews of Pynt - API Security Testing?

Edgescan

What Is Edgescan? Edgescan is a cybersecurity company that helps organizations proactively identify, validate, and prioritize vulnerabilities across their applications, API’s and digital landscape. The company specializes in continuous vulnerability assessment, automated penetration testing, Attack Surface Management and Penetration Testing as a Service (PTaaS). Edgescan also delivers Autonomous Penetration Testing via "Edgescan Atomic". Atomic is an AI powered autonomous penetration testing capability available exclusively to Edgescan customers. Each Atomic Attack Credit provides an autonomous penetration test, allowing organizations to perform an additional autonomous penetration test when required Atomic complements PTaaS by providing another way to assess security as environments evolve. (Supercharge your security with AI) Edgescan combines advanced automation with certified security experts, including professionals holding credentials such as CREST and OSCP, to deliver highly accurate and actionable security testing. This hybrid approach allows organizations to move beyond traditional point-in-time penetration tests and operate a continuous proactive cybersecurity program. The Edgescan platform is designed primarily for web application and API security, enabling organizations to continuously assess their attack surface and identify vulnerabilities throughout the development lifecycle but also delivers “full stack” coverage to detect host layer CVE’s. With a client retention rate of over 90%, Edgescan has built long-term partnerships by delivering measurable improvements in security efficiency, risk visibility, and vulnerability management. Key Features and Capabilities of Edgescan Automated Penetration Testing Edgescan uses intelligent automation to continuously assess applications, APIs, hosts, and cloud environments for vulnerabilities. This enables frequent, scalable security testing across modern and distributed architectures. Human‑Validated Testing Findings are reviewed and manually validated by certified security experts to eliminate false positives and provide deeper insight into real‑world exploitability. Each result is accurate, contextual, and actionable. Penetration Testing as a Service (PTaaS) Edgescan’s PTaaS model extends beyond automated testing by allowing expert testers to focus on vulnerabilities that require human analysis, including: • Business logic flaws • Authentication and authorization weaknesses • Context-dependent exposures • Complex attack chains and privilege escalation paths Cyber Analytics and AI‑Assisted Validation AI-driven analysis enhances detection, verifies exploitability, and increases accuracy. This reduces noise and gives security teams a clearer picture of genuine threats. Integrated Threat Intelligence Edgescan correlates vulnerabilities with real-world threat intelligence, including known exploits and ransomware activity to help organizations prioritize the most dangerous exposures first. Risk‑Based Prioritization Findings are prioritized based on exploitability, severity, threat context, and business impact, ensuring teams focus on the issues that matter most. Primary Value: What Edgescan Solves for Clients Edgescan enables organizations to shift from reactive vulnerability management to a continuous, proactive security model. Traditional scanners and periodic penetration tests frequently produce large volumes of unvalidated findings. This creates noise and forces security teams to spend hours determining which issues are real and critical. Edgescan solves this by combining: Automation for continuous testing Human expertise for validation and complex analysis Cyber analytics and AI for accuracy and prioritization Key Benefits Significant efficiency gains: reducing thousands of hours spent on manual validation. Higher accuracy, thanks to expert‑validated findings and reduced false positives. Clear prioritization, using threat intelligence and ransomware insights to highlight the highest‑risk exposures. Continuous security improvement, enabling rapid detection, faster remediation, and scalable vulnerability management. By unifying automation, human expertise, AI, and threat intelligence, Edgescan empowers organizations to maintain a continuous cybersecurity program that strengthens overall security posture while dramatically reducing operational burden.

Average Rating: 4.6/5.0

Total Reviews: 58

How Do G2 Users Rate Edgescan?

  • Has the product been a good partner in doing business?: 9.1/10 (Category avg: 9.2/10)
  • API / Integrations: 8.0/10 (Category avg: 8.7/10)
  • Detection Rate: 9.2/10 (Category avg: 8.8/10)
  • Test Automation: 9.3/10 (Category avg: 8.8/10)

Who Is the Company Behind Edgescan?

  • Seller: Edgescan
  • Company Website:
  • Year Founded: 2017
  • HQ Location: Dublin, Dublin
  • LinkedIn® Page: www.linkedin.com
    88 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Information Technology and Services, Computer Software
  • Company Size: 38% Large, 28% Medium

What Do G2 Reviewers Say About Edgescan?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the ease of use of Edgescan, enjoying its user-friendly interface and convenient access to essential information.
  • Users value the near false positive free vulnerability scanning of Edgescan, making web application testing efficient and reliable.
  • Users highly value the fantastic customer support from Edgescan, enhancing their overall experience significantly.
  • Users value the validated, near false positive free vulnerability scanning of Edgescan, enhancing their testing experience significantly.
  • Users appreciate the user-friendly console of Edgescan, as it offers easy access and comprehensive functionality for managing vulnerabilities.
Cons
  • Users find the complex UI of Edgescan challenging, leading to inefficiencies and difficulties in task navigation.
  • Users find the limited customization for hosts and filtering frustrating, impacting their ability to adapt to changes.
  • Users find the poor interface design of Edgescan frustrating, hindering efficient navigation and task completion.
  • Users experience slow performance with Edgescan, as scans can take longer due to thorough validation processes.
  • Users find the user interface challenging to navigate, leading to delays and difficulty performing common tasks.

What Are Recent G2 Reviews of Edgescan?

What Are G2 Users Discussing About Edgescan?

Indusface WAS

Indusface WAS (Web Application Scanner) provides comprehensive managed dynamic application security testing (DAST) solution. It is a zero-touch, non-intrusive cloud-based solution that provides daily monitoring for web applications, checking for systems and application vulnerabilities, and malware. Indusface WAS with its automated scans & manual pentesting done by certified security experts ensures none of the OWASP Top10, business logic vulnerabilities, and malware go unnoticed. With zero false-positive guarantee and comprehensive reporting with remediation guidance, Indusface web app scanning ensures developers to quickly fix vulnerabilities seamlessly.

Average Rating: 4.6/5.0

Total Reviews: 64

How Do G2 Users Rate Indusface WAS?

  • Has the product been a good partner in doing business?: 9.4/10 (Category avg: 9.2/10)
  • API / Integrations: 9.7/10 (Category avg: 8.7/10)
  • Detection Rate: 9.4/10 (Category avg: 8.8/10)
  • Test Automation: 9.4/10 (Category avg: 8.8/10)

Who Is the Company Behind Indusface WAS?

Who Uses This Product?

  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 53% Small, 37% Medium

What Do G2 Reviewers Say About Indusface WAS?

AI-generated summary from verified user reviews

Pros
  • Users value the comprehensive vulnerability detection by Indusface WAS, benefiting from detailed insights and helpful remediation guidelines.
  • Users appreciate the comprehensive vulnerability identification offered by Indusface WAS, ensuring detailed insights and effective remediation.
  • Users commend the responsive customer support from Indusface, ensuring timely assistance during VAPT testing and queries.
  • Users value the scanning efficiency of Indusface WAS, benefiting from automated deep-dive security scans and detailed reports.
  • Users value the deep-dive security scans of Indusface WAS, which enhance security accreditation and vulnerability management.
Cons
  • Users note that Indusface WAS is expensive, particularly for development environment scans and SSL certificates.
  • Users find the interface confusing and suggest it needs to be more intuitive and up-to-date.
  • Users find the limited functionality in the free testing version restricts their ability to effectively scan development environments.
  • Users feel that limited pricing options for staging scans hinder effective testing before deployment in development environments.
  • Users find the interface design outdated and unintuitive, though improvements are reportedly in progress.

What Are Recent G2 Reviews of Indusface WAS?

What Are G2 Users Discussing About Indusface WAS?

Lauren Worth
LW
Researched and written by Lauren Worth
Updated October 3, 2024

Dynamic Application Security Testing (DAST) Topics

Expand/Collapse

Learn More About Dynamic Application Security Testing (DAST) Software

What is Dynamic Application Security Testing (DAST) Software?

Dynamic application security testing (DAST) is one of the many technology groupings of security testing solutions. DAST is a form of black-box security testing, meaning it simulates realistic threats and attacks. This differs from other forms of testing such as static application security testing (SAST), a white-box testing methodology used to examine the source code of an application.

DAST includes a number of testing components that operate while an application is running. Security professionals simulate real-world functionality through testing the application for vulnerabilities and then evaluate the effects on application performance. The methodology is often used to find issues near the end of the software development lifecycle. These issues may be tougher to fix than early flaws and bugs are, but those flaws pose a larger threat to critical components of an application.

DAST can also be thought of as a methodology. It’s a different approach than traditional security testing because once a test is completed, there are still tests to be done. It involves periodic inspections as updates are pushed live or changes are made before release. While a penetration test or code scan might serve as a one-off test for specific vulnerabilities or bugs, dynamic testing can be performed continually throughout the lifecycle of an application.

Key Benefits of Dynamic Application Security Testing (DAST) Software

  • Simulate realistic attacks and threats
  • Discover vulnerabilities not found in source code
  • Flexible and customizable testing options
  • Comprehensive assessment and scalable testing

Why Use Dynamic Application Security Testing (DAST) Software?

There are a number of testing solutions necessary for an all-encompassing approach to security testing and vulnerability discovery. Most start in the early stages of software development and help programmers discover bugs in the code and issues with the underlying framework or design. These tests require access to source code and are often used during development and quality assurance (QA) processes.

While early testing solutions approach testing from the standpoint of the developer, DAST approaches testing from the standpoint of a hacker. These tools simulate real threats to a functional, running application. Security professionals can simulate common attacks such as SQL injection and cross-site scripting or customize tests to threats specific to their product. These tools offer a highly customizable solution for testing during the later stages of development and while applications are deployed.

Flexibility — Users can schedule tests as they please or perform them continuously throughout an application’s or website’s lifecycle. Security professionals can modify environments to simulate their resources and infrastructure to ensure a realistic test and evaluation. They’re often scalable, as well, to see if increased traffic or usage would affect vulnerabilities and protection.

Industries with more specific threats may require more specific testing. Security professionals may identify a threat specific to the health care industry or financial sector and alter tests to simulate the threats most common to them. If performed correctly, these tools offer some of the most realistic and customizable solutions to the threats present in real-world situations.

Comprehensiveness — Threats are continuously evolving and expanding, making the ability to simulate multiple tests more necessary. DAST offers a versatile approach to testing, wherein security professionals can simulate and analyze each threat or attack type individually. These tests deliver comprehensive feedback and actionable insights that security and development teams use to remediate any issues, flaws, and vulnerabilities.

These tools will first perform an initial crawl, or examination, of applications and websites from a third-party perspective. They interact with applications using HTTP, allowing the tools to examine applications built with any programming language or on any framework. The tool will then test for misconfigurations, which expose a greater attack surface than internal vulnerabilities. Additional tests can be run, depending on the solution, but all the results and discoveries can be stored for actionable remediation.

Continuous assessment — Agile teams and other companies relying on frequent updates to applications should use DAST products with continuous assessment capabilities. SAST tools will provide more direct solutions for issues related to continuous integration processes, but DAST tools will provide a better view of how updates and changes will be seen from an outside perspective. Each new update may pose a new threat or unveil a new vulnerability; it is therefore crucial to continue testing even after applications have been completed and deployed.

Unlike SAST, DAST also requires less access to potentially sensitive source code within the application. DAST approaches the situation from an outside perspective as simulated threats attempt to gain access to vulnerable systems or sensitive information. This can make it easier to perform tests continuously without requiring individuals to access source code or other internal systems.

What are the Common Features of Dynamic Application Security Testing (DAST) Software?

Standard functionality is included in most dynamic application security testing (DAST) solutions:

Compliance testing — Compliance testing gives users the ability to test for various requirements from regulatory bodies. This can help ensure information is stored securely and protected from hackers.

Test automation — Test automation is the feature powering continuous testing processes. This functionality operates by running prescripted tests as frequently as required without the need for hands-on or manual testing.

Manual testing — Manual testing gives the user complete control over individual tests. These features allow users to perform hands-on live simulations and penetration tests.

Command-line tools — The command-line interface (CLI) is the language interpreter of a computer. CLI capabilities will allow security testers to simulate threats directly from the terminal host system and input command sequences.

Static code analysis — Static code analysis and static security testing is used to test from the inside out. These tools help security professionals examine application source code for security flaws without executing it.

Issue tracking — Issue tracking helps security professionals and developers document flaws or vulnerabilities as they are discovered. Proper documentation will make it easier to organize the actionable insights provided by the DAST tool.

Reporting and analytics — Reporting capabilities are important to DAST tools because they provide the information necessary to remediate any recently discovered vulnerabilities. Reporting and analytics features can also give teams a better idea of how attacks may affect application availability and performance.

Extensibility — Many applications offer the ability to expand functionality through the use of integrations, APIs, and plugins. These extensible components provide the ability to extend the platform beyond its native feature set to include additional features and functionalities.

Potential Issues with Dynamic Application Security Testing (DAST) Software

Testing coverage — While DAST technologies have come a long way, DAST tools alone are unable to discover the majority of vulnerabilities. This is why most experts suggest pairing them with SAST solutions. Combining the two can decrease the rate at which false positives occur. They can also be used to simplify the continuous testing process for agile teams. While no tool will detect every vulnerability, DAST may be less efficient than other testing tools if used alone.

Late-stage issues — DAST tools will require code to be compiled for each individual test because they rely on simulated functionality to test responses. This can be a roadblock for agile teams constantly integrating new code into an application. Reports are usually static and result from single tests. For agile teams, those reports can become outdated and lose value very quickly. This is just one more reason DAST tools should be used as a component of an all-encompassing security testing stack rather than a standalone solution.

Testing capabilities — Because DAST tools do not access an application's underlying source code, there are a number of flaws DAST tools will be unable to detect. For example, DAST tools are most effective at simulating reflection, or call-and-response, attacks where they can simulate an input and receive a response. They are not, however, highly effective in discovering smaller vulnerabilities or flaws in areas of the application that are rarely touched by users. These issues, as well as vulnerabilities in the original source code, will need to be addressed by additional security testing technologies.