Security scanning

What is DAST?

Dynamic Application Security Testing: probing a running application from the outside, the way an attacker would.

By Cláudia FernandesUpdated 2026-10-02

DAST sends real requests to a deployed application or API and observes the responses, finding issues that only exist at runtime: authentication flaws, misconfigured headers, injection points reachable through the actual request path.

Because it tests the running system, a DAST finding is usually genuine, since you have a request that demonstrates it. The trade-off is that it needs a deployed environment, runs slower than static analysis, and only covers the surface it can reach.

What to look for

API scanning support via OpenAPI or GraphQL schemas, not just web crawling
How authenticated scanning is configured and maintained
Whether it can run against ephemeral preview environments in CI
Scan duration, which usually rules out running it on every commit

Best 7 DAST tools

Every tool in the directory whose documentation covers this. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform