Analysis & detection

What is DAST?

Dynamic Application Security Testing: probing a running application from the outside, the way an attacker would.

DAST sends real requests to a deployed application or API and observes the responses, finding issues that only exist at runtime: authentication flaws, misconfigured headers, injection points reachable through the actual request path.

Because it tests the running system, a DAST finding is usually genuine, since you have a request that demonstrates it. The trade-off is that it needs a deployed environment, runs slower than static analysis, and only covers the surface it can reach.

Top 7 DAST tools

Every tool in the directory documented as supporting DAST, with what its own documentation says.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

  1. 1
    CodacyQuality PlatformBusiness

    OWASP ZAP integration scans web apps, OpenAPI, GraphQL, REST APIs; Business plan only.

  2. 2
    AikidoCode Security PlatformPro

    Front-end domain DAST plus REST, GraphQL, gRPC, WebSocket API scanning

  3. 3
    Checkmarx OneCode Security Platformadd-on

    DAST is a platform engine and links to API Security, but requires separate DAST and API Security licenses.

  4. 4
    CodeAnt AIPR Review

    Black box testing of APIs and running systems plus penetration testing listed; delivery mechanism undocumented

  5. 5
    CorgeaCode Security Platform

    AI Pentesting actively tests live web-app targets; API-type breakdown not enumerated

  6. 6
    SnykCode Security Platform

    Snyk API & Web scans live apps and APIs; BOLA testing; SAST/DAST correlation to source lines.

  7. 7
    VeracodeCode Security Platformadd-on

    DAST covers web apps and REST/SOAP/OpenAPI/Postman APIs; Enterprise mode adds API spec management

What to look for

  • API scanning support via OpenAPI or GraphQL schemas, not just web crawling
  • How authenticated scanning is configured and maintained
  • Whether it can run against ephemeral preview environments in CI
  • Scan duration, which usually rules out running it on every commit

Related terms

SASTTaint / Data-Flow AnalysisSecrets DetectionSecrets ValidationSCA (Software Composition Analysis)Reachability Analysis

FAQ

What is DAST?

Dynamic Application Security Testing: probing a running application from the outside, the way an attacker would.

How many tools support DAST?

7 of the 20 tools tracked in this directory support DAST, including Codacy, Aikido, Checkmarx One, CodeAnt AI, Corgea. Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

What should you look for in DAST?

API scanning support via OpenAPI or GraphQL schemas, not just web crawling. How authenticated scanning is configured and maintained. Whether it can run against ephemeral preview environments in CI. Scan duration, which usually rules out running it on every commit.