How we make this list: we compare pricing pages, product documentation and public user reviews. Ratings come from G2, Capterra or Trustpilot, with the date we checked them.
Key takeaways
- StackHawk is the best DAST tool for cloud-native teams, with CI/CD integration and API scanning built for modern pipelines.
- Invicti and Acunetix suit enterprises that need broad web application coverage with proof-based verification.
- Burp Suite remains the standard for manual security testing, while OWASP ZAP is the best free DAST tool.
- Qualys WAS and Rapid7 InsightAppSec fit teams already using those vendors' wider security platforms.
- Cloud DAST success depends on pipeline integration and authentication handling, not just scan depth.
Quick comparison
| Tool | Best for | Starting price | Free plan |
|---|
 StackHawk | Cloud-native DAST | See website | Free trial |
 Invicti | Enterprise web scanning | See website | Free trial |
 Acunetix | Automated web scanning | See website | Free trial |
 Burp Suite | Manual security testing | $449/year | Yes |
 OWASP ZAP | Free DAST | Free | Yes |
 Qualys WAS | Qualys platform users | See website | Free trial |
 Rapid7 InsightAppSec | Rapid7 platform users | See website | Free trial |
 Probely | Developer-friendly scanning | See website | Free trial |
 Checkmarx DAST | Checkmarx AppSec platform | See website | Free trial |
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
Starting priceSee website
Free planFree trial
StackHawk is designed for cloud-native development, running dynamic scans inside CI/CD pipelines and giving developers findings with fix guidance in the tools they already use. Its API and GraphQL scanning covers the interfaces that modern cloud applications expose, and its pipeline-first design suits teams that ship frequently.
Pricing is confirmed on the vendor site, and its enterprise feature set is smaller than Invicti's or Acunetix's. StackHawk suits cloud-native teams that want DAST as a pipeline gate, not a periodic audit, and that value developer experience over enterprise breadth.
What we like- Built for CI/CD pipelines
- API and GraphQL scanning
- Developer-friendly findings with fix guidance
Watch out for- Pricing sits on the vendor site
- Smaller enterprise feature set than Invicti
- Best for modern stacks
#2Invicti
Best for: Enterprise web scanning4.5/5 on
G2 (72 reviews, checked Oct 2026)
Visit invicti.com
Starting priceSee website
Free planFree trial
Invicti, formerly Netsparker, uses proof-based scanning to verify vulnerabilities with safe exploits, which cuts false positives and gives security teams evidence they can act on. Its coverage spans web applications and APIs, with enterprise reporting for compliance and management.
Pricing is confirmed on the vendor site, setup takes effort for complex authenticated applications, and it is overkill for small teams. Invicti suits enterprises that need accurate, broad web scanning with defensible results.
What we like- Proof-based scanning reduces false positives
- Broad web and API coverage
- Enterprise reporting
Watch out for- Pricing sits on the vendor site
- Setup takes effort
- Overkill for small teams
#3Acunetix
Best for: Automated web scanning4.1/5 on
G2 (105 reviews, checked Oct 2026)
Visit acunetix.com
Starting priceSee website
Free planFree trial
Acunetix automates web vulnerability scanning across a broad range of technologies, with scheduled scans, CI integration, and reporting that suits compliance workflows. Its accuracy and technology coverage make it a reliable enterprise scanner for large web estates.
Pricing is confirmed on the vendor site, the interface feels enterprise-heavy, and manual testing features are thinner than Burp Suite's. Acunetix suits enterprises that want automated, scheduled scanning across many applications.
What we like- Automated scanning with low false positives
- Broad technology coverage
- Scheduled and CI scans
Watch out for- Pricing sits on the vendor site
- Interface is enterprise-heavy
- Manual testing features are thinner than Burp
Starting price$449/year
Free planYes
Burp Suite is the standard toolkit for manual web security testing, with a proxy, scanner, intruder, and repeater that professionals use to find and verify vulnerabilities by hand. Its Community Edition is free, and Professional, at $449 a year, adds the automated scanner and advanced tools.
Automation needs configuration compared with pipeline-native tools, and the learning curve is steep for beginners. Burp Suite suits security testers and penetration testers who need manual control, and teams that verify automated findings by hand.
What we like- Industry-standard manual testing toolkit
- Extensible with community extensions
- Community Edition is free
Watch out for- Professional costs $449 a year
- Automation needs configuration
- Learning curve for beginners
Starting priceFree
Free planYes
OWASP ZAP is the best free DAST tool, offering automated scanning, manual testing through a proxy, and API scanning, all open source with strong community documentation. Its automation framework and Docker images suit CI pipelines on a zero budget.
The interface is less polished than commercial rivals, enterprise reporting is thinner, and complex authenticated applications need tuning. ZAP suits small teams, students, and security learners, and any team that wants a free DAST baseline before buying a commercial tool.
What we like- Completely free and open source
- Automated and manual scanning
- Strong community and documentation
Watch out for- Interface is less polished than commercial tools
- Enterprise reporting is thinner
- Needs tuning for complex apps
#6Qualys WAS
Best for: Qualys platform users4.5/5 on
G2 (21 reviews, checked Oct 2026)
Visit qualys.com
Starting priceSee website
Free planFree trial
Qualys Web Application Scanning integrates with the wider Qualys cloud platform, combining web scanning with asset discovery, vulnerability management, and compliance reporting in one console. That integration suits organizations already running Qualys for infrastructure scanning.
Pricing is confirmed on the vendor site, and standalone value is lower than specialist DAST tools for teams that do not use Qualys elsewhere. Qualys WAS suits Qualys customers who want web scanning inside their existing platform.
What we like- Integrated with the Qualys cloud platform
- Asset discovery and vulnerability management
- Compliance reporting
Watch out for- Pricing sits on the vendor site
- Best inside Qualys
- Standalone value is lower than specialists
#7Rapid7 InsightAppSec
Best for: Rapid7 platform users3.9/5 on
G2 (10 reviews, checked Oct 2026)
Visit rapid7.com
Starting priceSee website
Free planFree trial
Rapid7 InsightAppSec offers cloud-based dynamic scanning with CI integration and attack replay, which replays exploits to verify findings. Its integration with InsightVM unifies application and infrastructure risk in one view, which suits teams managing both.
Pricing is confirmed on the vendor site, and standalone value is lower for teams outside Rapid7. InsightAppSec suits Rapid7 customers who want application scanning alongside infrastructure vulnerability management.
What we like- Cloud-based scanning with CI integration
- Works with InsightVM for unified risk
- Attack replay for verification
Watch out for- Pricing sits on the vendor site
- Best inside Rapid7
- Smaller standalone community than Burp or ZAP
Starting priceSee website
Free planFree trial
Probely targets developers with a clean interface, clear findings, and straightforward CI integration, plus API scanning for modern applications. Its simplicity suits small and mid-size teams that want DAST without enterprise complexity.
Pricing is confirmed on the vendor site, enterprise features are thinner than Invicti's, and brand recognition is lower. Probely suits developer-led teams that want a friendly, pipeline-ready scanner.
What we like- Developer-friendly interface and findings
- API scanning
- Straightforward CI integration
Watch out for- Pricing sits on the vendor site
- Smaller enterprise feature set
- Less known than Invicti or Acunetix
Starting priceSee website
Free planFree trial
Checkmarx DAST sits inside a unified application security platform alongside static analysis and software composition analysis, correlating findings across testing types. That correlation helps teams prioritize vulnerabilities that appear in multiple scans and manage AppSec in one place.
Pricing is confirmed on the vendor site, and standalone DAST depth varies by use case compared with specialists. Checkmarx DAST suits organizations already using Checkmarx for SAST or SCA who want DAST in the same platform.
What we like- Part of a unified AppSec platform with SAST and SCA
- Correlation across testing types
- Enterprise reporting
Watch out for- Pricing sits on the vendor site
- Best inside Checkmarx
- Standalone DAST depth varies by use case
How we chose
We compared dynamic application security testing tools that scan running web applications and APIs, excluding pure static analysis and network scanners without web focus. Pricing figures come from each vendor's own pricing page, checked in October 2026, and where pricing is quote-based we say so. We weighed cloud and CI/CD fit, authentication handling, API coverage, false positive rates, reporting, and price.
Cloud DAST lives or dies on pipeline fit
A scanner that cannot run in your pipeline, authenticate to your application, and report findings developers act on will not improve security, however deep its checks. Test each shortlisted tool against a staging environment with your real authentication flow, and confirm that findings appear in your issue tracker with enough context to fix.
Authenticated scanning is the real test
Most cloud applications sit behind login, single sign-on, or API keys, and unauthenticated scans miss the most important surfaces. Prioritize tools that handle your authentication method cleanly, including multi-factor flows and token-based APIs, and test them before buying.
DAST in CI/CD: gates versus reports
Running DAST in a CI/CD pipeline forces a choice: should a failed scan block the release, or only report findings for later fixing? Blocking gates catch vulnerabilities before production, but they also block releases on false positives, slow teams down, and tempt developers to bypass the gate when deadlines press. Reporting-only scans keep pipelines fast, but findings pile up unread, and the same vulnerabilities ship release after release. Most mature teams use both, with different rules for different severities.
A workable pattern is to block on new critical and high findings while reporting medium and low findings to a backlog with a service level for fixing. That pattern needs a baseline: scan the application once, record existing findings, and only block on newly introduced issues, so legacy problems do not freeze every release. Tune the scanner for your application first, since a gate built on noisy results will be disabled within weeks.
Scan scope also matters in pipelines. Full scans on every commit are slow, so many teams run a fast, targeted scan on each commit and a full scan nightly or weekly. Targeted scans cover changed endpoints and authentication flows, while full scans catch issues in untouched areas. Whatever pattern you choose, track two metrics: how often gates block releases, and how quickly blocked findings get fixed. If either number drifts, the gate configuration needs adjusting, not abandoning.
A final consideration is authentication coverage. DAST tools can only test what they can reach, and applications behind login pages, multi-factor authentication, or single sign-on often get scanned only as anonymous visitors, which leaves authenticated functionality untested. Check how each tool handles login recording, session management, and token refresh, and confirm it can scan the authenticated areas of your application. A scanner that only tests public pages gives a false sense of security for any application with user accounts.
Frequently asked questions
Which DAST tool is best for cloud platforms overall?
StackHawk, for cloud-native teams that want pipeline-integrated scanning with API coverage. Enterprises needing broad coverage should evaluate Invicti or Acunetix, while small teams should start free with OWASP ZAP.
Is there a free DAST tool?
Yes. OWASP ZAP is completely free and open source, and Burp Suite Community Edition is free for manual testing. Commercial tools here offer trials, but full automation and reporting need paid plans.
What is the difference between DAST and SAST?
DAST tests a running application from the outside, finding vulnerabilities in its live behavior. SAST analyzes source code without running it. Mature programs use both, since each finds issues the other misses.
Can DAST tools scan APIs?
Yes, modern DAST tools including StackHawk, Invicti, and Probely scan REST and GraphQL APIs, provided they can authenticate and import API definitions. Confirm API coverage for your specific API style before buying.
How often should cloud applications be DAST scanned?
Continuously, in practice. Run scans on every significant deployment through CI/CD, with deeper scheduled scans weekly or monthly. Point-in-time annual scans miss vulnerabilities introduced between scans.
Sources we checked (9)
- https://www.stackhawk.com
- https://www.invicti.com
- https://www.acunetix.com
- https://portswigger.net/burp
- https://www.zaproxy.org
- https://www.qualys.com/apps/web-app-scanning
- https://www.rapid7.com/products/insightappsec
- https://probely.com
- https://checkmarx.com
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
Shihab Mia · Founder, Rankite
Shihab has 5+ years in B2B and SaaS SEO. He writes Rankite's software buying guides from pricing pages, documentation and public user reviews. More about Shihab.