Dynamic application security testing, or DAST, attacks a running web app the way an outsider would, and four names show up on almost every shortlist: Burp Suite, OWASP ZAP, Invicti and StackHawk. The market just handed one of them a scorecard. Invicti announced a spot in the Leaders category of the 2026 IDC MarketScape for worldwide DAST, while PortSwigger shipped a DAST 2026.10 release in October and StackHawk joined Anthropic’s Claude Code plugin marketplace on October 14.
That is a lot of movement in three weeks, and the four products no longer compete on the same axis. One is a free open-source proxy. One is a pentester’s workbench with a DAST platform attached. One is an enterprise platform now selling AI-driven pentests by the assessment. One is a developer-first scanner that wants to live inside your coding agent. Choosing among these DAST tools by feature checklist alone gets you the wrong answer.
This comparison uses only facts verified on vendor pages and release notes as of October 23, 2026. Where a vendor publishes no number, we say so instead of guessing. If you want to try the free option first, our OWASP ZAP setup guide walks through a first scan in 12 steps. The sections below cover specs, benchmarks, pricing, real deployments, use-case picks, a migration path and a verdict.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
DAST Tools in October 2026: What Changed in Three Weeks
Start with the calendar, because it explains why this comparison looks different from one written in spring. Between October 1 and October 22, 2026, all four vendors shipped something that changes how you would evaluate them.
- October 1: the ZAP team said the AJAX Spider and the DOM XSS rule add-ons left the nightly and weekly Docker releases. Both stay available through the Marketplace, so this is a distribution change and not a retirement of the tool.
- October 8: Burp Suite DAST 2026.10 shipped with persistent triage rules, GraphQL-triggered issue retests, faster scans and lower disk usage. The same day, ZAP’s Authentication Helper add-on gained early OAuth2 support, and Invicti published a benchmark for its Agentic Pentest product.
- October 12: Burp Suite Professional and Community 2026.10 reached Early Adopter status. It restores HTTP Digest authentication and upgrades the embedded browser to Chromium 154.
- October 14: StackHawk announced two plugins,
stackhawk-hawkscanandstackhawk-api, in Anthropic’s official Claude Code plugin marketplace. - October 21: the ZAP Browser Extension and standalone Recorder reached version 0.3.0 with a Script Viewer for Zest scripts.
Two themes run through that list. First, every vendor is racing to attach AI to scanning, though they mean different things by it. Second, the center of gravity is moving from “scan on a schedule” to “test inside the pipeline or the agent loop.” If you need a refresher on where DAST sits next to static analysis and dependency scanning, our breakdown of SAST vs DAST vs SCA covers the three testing families and what each one misses.
One caution before the details. DAST only sees what the scanner can reach. A scan that cannot log in, cannot crawl a single-page app or cannot follow an API schema will report a clean result on a vulnerable system. Authentication handling and modern-app crawling are therefore the first things to test in any trial, and they run through the rest of this article.
Quick Verdict: Which DAST Tool Fits Which Team
If you only read one section, read this one. The table maps each tool to the team that gets the most out of it. The reasoning behind each row follows in the sections after it.
| Team profile | Pick | Why |
|---|---|---|
| Solo pentester or bug bounty hunter | Burp Suite Professional | Manual proxy workflow, extension ecosystem, Burp AT usage included for Professional users |
| Developer team with no AppSec budget | OWASP ZAP | Free and open source, active development, strong CI automation story |
| Enterprise AppSec program with compliance pressure | Invicti | Platform scope across DAST, APIs and components, 2026 IDC MarketScape Leader placement |
| Startup shipping with AI coding agents | StackHawk | Positioned around testing running apps inside the agent workflow, with Claude Code plugins |
| Team that wants scheduled DAST from a pentest vendor | Burp Suite DAST | Scheduled scanning with persistent triage rules from PortSwigger |
| Team that needs a one-off pentest report fast | Invicti Agentic Pentest | Report-ready results in 46 and 50 minutes in Invicti’s own benchmark |
Notice that no row says “best overall.” That is deliberate. A free scanner that your developers actually run on every pull request will catch more real bugs than an expensive platform that runs quarterly. The decision turns on who operates the tool, and the verdict section near the end ranks the four by that logic.
Specs Table: Burp Suite vs OWASP ZAP vs Invicti vs StackHawk
The table below uses only details confirmed on vendor pages and release notes. Where a cell says “not confirmed,” the vendor did not publish the detail in the pages we reviewed, and we left it blank rather than fill it from memory.
| Attribute | Burp Suite | OWASP ZAP | Invicti | StackHawk |
|---|---|---|---|---|
| Core role | Manual web pentesting plus a separate DAST platform | Open-source web app security testing proxy and scanner | Application security platform with proof-based DAST | Developer and CI/CD-oriented DAST |
| Editions | Community, Professional, Burp Suite DAST | One open-source tool with add-ons | Invicti Platform, with on-demand and on-premises editions | StackHawk platform, Vibe, Wingman |
| Newest confirmed release | Pro/Community 2026.10 (Early Adopter, October 12), DAST 2026.10 (October 8) | 2.17.0 announced December 15, 2025, with a newer full release described as coming | Version number not published in reviewed pages | Hosted platform, version not published |
| Open source | No | Yes | No | No |
| Free option | Community Edition | Entire tool | No standing free tier confirmed | Not confirmed in verified sources |
| AI features | Burp AT, with free monthly usage for Professional users | Generate Fix Prompt option and AI integrations planned for 2026 | Agentic Pentest, launched in July 2026 | Claude Code plugins and AI coding agent focus |
| Modern app crawling | Embedded Chromium 154 browser | Client Spider recommended over AJAX Spider | Proof-based scanning plus AI-assisted business-logic testing | Runtime testing of running apps in the agent workflow |
| Authentication handling | HTTP Digest authentication restored in 2026.10 | Early OAuth2 support (client_credentials and password grants) | Not confirmed in reviewed pages | Not confirmed in reviewed pages |
| Triage and noise control | Persistent triage rules in DAST 2026.10 | 2.17.0 cut duplicate alerts | Proof-based validation | Not confirmed in reviewed pages |
| Analyst recognition | None confirmed in reviewed pages | None confirmed in reviewed pages | Leader, 2026 IDC MarketScape for DAST | None confirmed in reviewed pages |
| Vendor | PortSwigger | The ZAP Dev Team | Invicti Security Corp | StackHawk Inc |
| Channel program | Not confirmed | Not applicable | Not confirmed | SHARP partner program, announced February 4, 2026 |
| Best fit | Pentesters and security researchers | Developers and budget-limited teams | Large enterprises | Fast-moving product teams |
Two cells deserve a note. The ZAP row on versions reflects a real ambiguity. The project’s blog announced 2.17.0 on December 15, 2025, and the October 1, 2026 update said a new full release was hopefully coming soon, which means we cannot name a newer stable number. A Microsoft Marketplace listing shows 2.16.1, but that looks like an older package and should not be read as the current project release.
The Burp row also needs context. Burp ships its desktop and DAST products on separate release streams, and the desktop line carries a stable channel plus an Early Adopter channel. PortSwigger’s release pages list 2026.10 as Early Adopter from October 12. A secondary source also lists 2026.9.2 as the stable release from October 9, so production users should check which channel their team has approved before upgrading.
Burp Suite: Pentester Workbench With a DAST Platform Attached
PortSwigger’s product family now spans three things that people often lump together. The desktop tools, Professional and Community, are interactive proxies for manual testing. Burp Suite DAST is the automated, scheduled platform that many teams still call Enterprise Edition, though the October 2026 release stream uses DAST in its titles and component lists. Burp AT is the newer AI-assisted layer. Knowing which of the three you are buying matters, because they solve different problems.
Burp Suite Professional and Community
The desktop editions remain the default tool for hands-on web testing. Release 2026.10 restores HTTP Digest authentication, tightens notification behavior and BApp restrictions, and moves the embedded browser to Chromium 154. Those sound like small items, but the browser upgrade matters for anyone testing modern front ends, since an outdated embedded browser trips over new JavaScript features and breaks crawls. Our Burp Suite setup walkthrough covers the proxy, certificate and scope configuration in 13 steps.
On cost, a secondary comparison page lists Professional at $499 per named user per year as of October 2026. We could not confirm that figure on a PortSwigger page, so treat it as reported. Community stays free but lacks the automated scanner, which is the reason most teams outgrow it. PortSwigger states that Professional users also receive free monthly Burp AT usage, though the pages we reviewed do not say how large the allowance is or what overage costs.
Burp Suite DAST and persistent triage
Burp Suite DAST 2026.10 is the release that answers the most common complaint about scheduled scanners, which is that the same false positives come back every week. The update adds reusable issue-management rules, so a triage decision made once sticks across later scans. PortSwigger documents the feature in its issue management rules reference. The release also adds GraphQL API support for issue retests, faster scans and lower disk usage, plus fixes touching Jira integration, OpenAPI, SOAP/WSDL and HTTP/2 coverage.
PortSwigger did not publish a percentage for the speed or disk gains, so we will not invent one. The practical read: if your analysts already trust PortSwigger’s tooling from manual work, the DAST platform gives them scheduled scanning, and the triage rules cut the weekly noise. The tradeoff is price opacity. We found no public list price for the DAST product in the pages reviewed.
Burp AT: the AI layer
PortSwigger describes Burp AT as launched at Black Hat USA and still shipping features. One report says an October 15 update added user-defined testing skills and a /goal command for stating a task objective, but that comes from a single source, so read it as reported until the release notes confirm it. What matters for buyers: Burp AT is bundled into Professional through free monthly usage. That makes it a low-risk trial for existing Burp shops and a weak reason to switch for everyone else.
OWASP ZAP: The Free Scanner That Keeps Shipping
ZAP is free and open source, and it is still moving fast. The project posted updates on October 1, 8, 13, 21 and 22, 2026, which is a busier cadence than many paid tools manage. The team says ZAP was started nearly 9.5 million times in March 2026 and that it published integrations with three other open-source projects that month. Those are usage claims from the project itself, not independent audits, but they point to a community large enough that most problems have a documented fix.
Recent changes tell you where the project is heading. Client Spider is now the officially recommended crawler for modern applications, and the AJAX Spider remains installable from the Marketplace even though the project suggests switching. For DOM-based XSS, the project recommends OWASP PTK as the more effective alternative to the older rule add-on. The Authentication Helper add-on gained early OAuth2 support for the client_credentials and password grant types, aimed at automated runs where nobody can click through a consent screen. Our Nuclei scanner setup pairs well with ZAP when you want template-based checks next to a crawler-driven scan.
In October the team released version 0.3.0 of the browser extension and standalone Recorder. The new Script Viewer shows the Zest script as you record it, then lets you edit it, replay it step by step and save it. Recorded login flows are exactly what unauthenticated-scan failures need, and a replayable script beats a fragile form-based login config.
ZAP also has a Generate Fix Prompt option that copies everything an LLM needs to fix a vulnerability to the clipboard. It is a small feature, but it shows the project’s direction: ZAP wants to be the scanner a developer runs next to an AI assistant. The 2.17.0 release from December 2025 added core performance work and cut the number of duplicate alerts, which targets the noise problem Burp attacked with triage rules. On naming, the ZAP site still presents the tool as ZAP, and some third-party pages use the ZAP by Checkmarx name, so expect both labels in search results.
The weaknesses are the usual open-source ones. There is no vendor SLA, no single throat to choke when a scan breaks, and no analyst report to hand your procurement team. Reporting and role-based dashboards need extra tooling, such as a findings aggregator. If you already run vulnerability data through DefectDojo, ZAP’s output slots in cleanly, which narrows the gap with platforms like Invicti.
Invicti: Platform Scope, Proof-Based DAST and Agentic Pentests
Invicti now describes itself as an application security platform covering applications, APIs, code, software components and vulnerability management, not only standalone DAST. The product pages list the Invicti Platform alongside on-demand and on-premises editions. That positioning matters in an enterprise evaluation, because the buying question shifts from “which scanner” to “which platform consolidates the most tools.”
The newest product is Invicti Agentic Pentest, announced July 29-30, 2026. It combines autonomous AI reasoning with the company’s proof-based DAST engine to find, validate and report exploitable vulnerabilities. Invicti’s site also promotes a hybrid agentic pentester called Octo that promises audit-ready reports in under 24 hours for $500 or less. Anyone shopping against traditional consulting pentests should price that claim against their last engagement, though the vendor’s own marketing is the only source here.
Invicti also leans on a defense-in-depth story for regulated sectors. On August 7, 2026, after FBI and EPA warnings, it offered qualifying U.S. water utilities three months of complimentary access to the platform with guided onboarding and engineering support. That is a time-limited program for a specific sector, so do not read it as a free tier. The IDC placement, announced late September, rounds out the enterprise pitch. Invicti also publishes a customer testimonial claiming the pentest budget dropped by roughly 60% almost immediately after adoption, which is marketing copy and not a study. For teams weighing AI-driven offensive testing more broadly, our list of AI penetration testing companies puts Invicti’s approach in context.
Where Invicti falls short for this comparison is transparency. The current official pages do not expose a full price schedule, and the latest version number is not stated in the material we could verify. That is normal for enterprise software, but it means you will run a sales process before you learn what a year costs.
StackHawk: DAST Rebuilt Around Developers and Coding Agents
StackHawk has stopped pitching itself as just a scanner. Its site now frames the product as AI coding agent security: test the running application inside the agent workflow, find exploitable issues, and fix them before a pull request opens. On October 14 it announced that it had joined Anthropic’s official Claude Code plugin marketplace with two plugins, stackhawk-hawkscan and stackhawk-api. The announcement page was updated on October 23.
Pricing signals point to a developer-first model. StackHawk’s pricing page lists Wingman, the tool you run beside a coding agent, at $10 per person per month with unlimited apps and no per-app or per-scan math. Other pricing details come from a single source each. A pricing result from October 4 reportedly lists a $5-per-month single-user Vibe plan and Secure and Scale plans based on the number of code contributors, with unlimited testing across environments. We could not find a reliable number for Secure or Scale, so you will need a quote for team sizing.
An August article on StackHawk’s site reportedly lists support for REST, GraphQL, gRPC, SOAP, JSON-RPC and MCP servers. The MCP mention is the interesting one, since agent-facing endpoints are a new attack surface, and our guide to testing API security against the OWASP Top 10 shows how those checks translate into a pipeline job. StackHawk also launched a partner program, SHARP, on February 4, 2026, promising resellers at least 30% guaranteed margins, which signals the company wants to sell through channels as it grows.
The caveat is maturity at the enterprise end. Unlike Invicti, we found no analyst placement for StackHawk, and the product’s center of gravity sits with small and mid-size engineering teams. For that audience, the agent-workflow angle is a real differentiator. For a bank’s central AppSec group, it is a nice-to-have.
DAST Tool Benchmarks: What the Evidence Actually Shows
Here is the uncomfortable truth about DAST benchmarks: there is no recent independent head-to-head that tests all four tools on the same targets with published scores. What exists is a mix of vendor-run tests, analyst assessments, open benchmark projects and usage figures. The table collects every data point we could verify and flags who ran it.
| Source | What it measured | Result | Caveat |
|---|---|---|---|
| Invicti Agentic Pentest benchmark (October 8, 2026) | Findings on Fider 0.33.0 and Photoview 2.4.0 | 52 findings after normalization, 27 (52%) from DAST and 25 (48%) from agentic testing | Vendor-run on open-source targets |
| Same benchmark, white-box runs | True positives and time to report | 24 true positives on Fider in 46 minutes, 18 on Photoview in 50 minutes | Single run per target, tested by Invicti’s research team |
| Same benchmark, competitor comparison | Delivery time | Roughly eight hours per target for Aikido and multi-day timelines for XBOW, per Invicti | Invicti’s claim about rivals, not independently confirmed |
| IDC MarketScape: Worldwide DAST 2026 | Vendor assessment | Invicti placed in the Leaders category | Only Invicti’s excerpt was reviewed, other placements not confirmed |
| ZAP project blog (April 2026) | Usage | Started nearly 9.5 million times in March 2026 | Project-reported telemetry |
| PortSwigger DAST 2026.10 notes | Scan speed and disk use | Faster scans and lower disk usage | No percentages published |
| OWASP WAVSEP project page (updated May 2026) | Open test cases for scanner evaluation | Framework exists, but no 2026 four-way scores found | Bring your own runs |
Read the Invicti numbers with care. Splitting findings 52% DAST and 48% agentic is useful, because it shows the AI layer found issues the classic scanner missed on those two apps. It also means about half the value depends on a product you have to buy separately. And a test on two open-source apps says little about a sprawling internal SaaS product with custom authentication.
The honest benchmark is your own, and a two-week bake-off is enough to run it. Here is a simple plan:
- Pick three targets. Choose one app with a messy login flow, one single-page app and one API. A scanner that handles all three will handle most of your estate.
- Use a staging copy. Seed it with a few known flaws, so you can measure misses as well as hits.
- Score four numbers. Record true positives, false positives, missed seeded flaws and the minutes your team spends triaging.
- Repeat after a code change. Ship a small update and check how long the tool takes to rescan and whether triage decisions carry over.
The OWASP WAVSEP project gives you a repeatable set of test cases if you want something neutral to start with, and it costs nothing to run. A free tool that scores within a few points of a paid one on your own apps changes the budget conversation fast.
Pricing Table: From $0 to Quote-Only
DAST pricing falls into three camps: free, per-seat or per-contributor, and quote-based. The table lists only prices confirmed on vendor pages. Reported but unconfirmed figures, such as Burp Professional at $499 per named user per year, appear in the prose above and stay out of the table.
| Product | Entry cost | Pricing model | Confirmed detail |
|---|---|---|---|
| OWASP ZAP | $0 | Free, open source | No paid tier from the project |
| Burp Suite Community | $0 | Free desktop edition | No automated scanner |
| Burp Suite Professional | Paid, see vendor | Commercial license | Free monthly Burp AT usage included |
| Burp Suite DAST | No public list price found | Sold by PortSwigger | Release 2026.10 on October 8 |
| Invicti Platform | No full public schedule found | Quote-based | On-demand and on-premises editions |
| Invicti Agentic Pentest | $31.46 per assessment (lowest) | Per assessment, introductory pricing through December 31, 2026 | Four benchmark assessments totaled $345.54 |
| StackHawk Wingman | $10 per person per month | Per person, unlimited apps | No per-app or per-scan charges |
Invicti’s introductory pricing for Agentic Pentest is the only per-assessment data in the group, so here is the full breakdown from its benchmark.
| Assessment | Introductory price |
|---|---|
| Fider black-box | $31.46 |
| Fider source-assisted | $110.55 |
| Photoview black-box | $134.49 |
| Photoview source-assisted | $69.05 |
| Four-assessment total reported by Invicti | $345.54 |
The spread between $31.46 and $134.49 for similar work shows that price depends on the target and the testing mode, not on a flat rate. Plan a budget range, not a single number. Also remember the introductory offer ends December 31, 2026, so any cost model built on it needs a post-promotion line.
The total cost of ownership picture is wider than license fees. A free ZAP deployment still costs engineer hours for setup, authentication scripting and triage. A paid platform shifts some of that to the vendor but adds procurement time, seat management and sometimes professional services. Teams that pick on sticker price alone usually end up paying the difference in staff time.
Real-World Examples: Who Uses What, and What Happened
Case studies in DAST are mostly marketing, so we limited this section to events that appear on vendor or project pages with dates. Each example shows a different slice of how these tools get used.
- Invicti’s Fider and Photoview benchmark (runs on September 27-28, published October 8, 2026). Invicti’s research team ran its Agentic Pentest against two open-source apps and reported 52 findings after de-duplication. Report-ready output arrived after 46 minutes on Fider and 50 minutes on Photoview, and the first Critical or High finding on Photoview landed 27 minutes into the run.
- Water utilities program (August 7, 2026). After FBI and EPA warnings about utility systems, Invicti offered qualifying U.S. water utilities three months of complimentary platform access. It shows how DAST vendors now package outreach around government advisories.
- ZAP’s March 2026 usage. The project reported nearly 9.5 million starts in a single month, a sign that ZAP sits inside a huge number of CI jobs and developer laptops.
- PHP2Shell response (October 2026). A ZAP passive scan rule named Server Side Technology Version with Known Vulnerabilities, reportedly released in October, adds detection for PHP2Shell and more than 60 other known PHP vulnerabilities. Fast rule delivery when a new threat appears is a good proxy for how seriously a scanner project treats it.
- StackHawk’s Claude Code launch (October 14, 2026). By publishing in the official plugin marketplace, StackHawk put DAST one command away for developers who already work in an AI coding agent. That is a distribution bet, not a detection improvement.
The PHP2Shell episode is worth a second look. When a widely deployed web flaw lands, the useful question for a DAST buyer is not “who has the most checks” but “who ships a check in days and lets me run it against my own estate.” Quarterly scans fail that test. Continuous scanning in a pipeline, which all four tools support to different degrees, passes it.
What the Tool Builders Say About DAST
Two of these projects have founders who explained their thinking on the record. The quotes below are verbatim, and the older ones carry their dates, since roles and products change.
In a 2013 FOSDEM interview, Simon Bennetts, then the OWASP ZAP project lead, described the tool’s target audience. He said “My talk is all about how developers can use ZAP to find vulnerabilities in their web applications.” In the same interview he added: “And it’s one of the few security tools that is aimed at developers – lots of security people use ZAP as well, but developers are always going to be a priority for me.” More than a decade on, the developer-first stance still shows in ZAP’s CI-friendly design and in its AI-assistant features.
StackHawk co-founder and chief security officer Scott Gerlach made the case for runtime testing in a 2025 Software Engineering Daily interview. He said “Testing that running version of the application is really beneficial because of a couple of different things, mostly discoverability and exploitability.” That is the core DAST argument in one sentence. A static finding tells you code looks risky, while a running test tells you an attacker can find and use the weakness.
Beyond the founders, the analyst view adds a third angle. Invicti’s placement in the Leaders category of the 2026 IDC MarketScape for worldwide DAST gives buyers a data point for shortlists, but only an excerpt for Invicti was available to us. Ask any vendor you shortlist for the full report and check where the others landed before you lean on the headline.
Use-Case Recommendations: Matching DAST Tools to Teams
These six recommendations come from the verified feature set above plus our own judgment on fit. They are analysis, not vendor claims.
1. Startup with no security staff. Run OWASP ZAP in CI against staging on every merge, and add StackHawk if developers use AI coding agents heavily. ZAP costs nothing, and the Authentication Helper plus the new Script Viewer cover many login flows. The weak spot is triage: someone has to own the alert list, or the findings rot.
2. Bug bounty hunter or consultant. Buy Burp Suite Professional. The interactive workflow, extension store and Burp AT usage included for Professional users are built for this job. Pair it with Nmap for network reconnaissance when scoping a target.
3. Enterprise AppSec team with 100+ applications. Shortlist Invicti and Burp Suite DAST, and run a proof of concept on three apps. Invicti’s platform scope and IDC placement suit consolidation. Burp DAST suits teams whose analysts already live in Burp and want triage rules to stick.
4. Regulated critical infrastructure. Invicti’s on-premises edition and its sector outreach make it the natural first call. Confirm data-residency terms in writing, because the sources we reviewed do not detail them. The broader cybersecurity coverage on Tech Insider tracks the advisories that drive these programs.
5. A team that needs a pentest report next week. Invicti Agentic Pentest is the only product here sold per assessment, with introductory prices from $31.46. Use it for a first pass, then validate the findings with a human tester before sending anything to auditors.
6. API-first product with agent-facing endpoints. Start with StackHawk for the reported MCP and GraphQL coverage and run Burp’s GraphQL retests for deep dives. Neither replaces a manual review of authorization logic, which automated scanners still handle poorly.
Migration Guide: From Manual Burp or Ad Hoc ZAP to Pipeline DAST
Most teams do not pick a DAST tool on a blank slate. They already run Burp by hand or have a ZAP script on someone’s laptop. This eight-step path moves that setup into a pipeline without losing the tuning you have built.
- Inventory your targets. List every web app and API with its environment, owner and authentication type. Mark which ones have a staging copy that is safe to attack.
- Record your login flows. For ZAP, use the browser extension and Recorder to capture a Zest script. For Burp, export your session handling rules. Store both in version control.
- Run a baseline scan. Start with a passive baseline against staging to see how noisy a tool is before you let it attack anything.
- Tune the noise. Mark false positives. In Burp DAST use persistent triage rules, and in ZAP use alert filters. Keep a written reason for every suppression.
- Add the scan to CI. Trigger on merges to the staging branch, not on every commit, so scans do not slow developers down.
- Fail builds on severity, not count. Block on confirmed critical and high issues only. Everything else becomes a ticket.
- Centralize findings. Send results to one tracker so duplicates across tools merge. A vulnerability management hub works, and the setup is the same whether the source is ZAP, Burp or a commercial platform.
- Compare after 30 days. Count true positives, false positives and triage hours. Use those numbers, not a vendor demo, to decide whether to upgrade to a paid platform.
A minimal ZAP baseline job runs from the official Docker image. This command scans a staging URL and writes an HTML report:
docker run --rm -v "$(pwd)":/zap/wrk/:rw -t ghcr.io/zaproxy/zaproxy:stable \
zap-baseline.py -t https://staging.example.com -r zap-report.htmlRemember the October 1 change when you plan crawler coverage. The AJAX Spider and DOM XSS add-ons no longer ship in the nightly and weekly Docker images, so install them from the Marketplace if you depend on them, or move to the Client Spider the project now recommends. For StackHawk, the scanner reads a small YAML file at the root of the repository. Check HawkDocs for the current schema before copying this skeleton:
app:
applicationId: YOUR-APP-ID
env: staging
host: https://staging.example.comBudget the first month for tuning, not for coverage. A common failure in DAST rollouts is a scan that logs in, gets logged out after two requests and reports nothing. Verify authenticated coverage by checking that the scan actually reached pages behind the login, not just that it finished green.
Pros, Cons and the Verdict: Which DAST Tool to Buy in 2026
| Tool | Pros | Cons |
|---|---|---|
| Burp Suite | Best manual workflow, persistent triage rules in DAST, Burp AT usage for Professional users, Chromium 154 browser | DAST price not public, Community lacks the scanner, desktop and DAST are separate products |
| OWASP ZAP | Free, active release cadence, Script Viewer for recorded logins, early OAuth2 support, large user base | No vendor SLA, version ambiguity between releases, reporting needs extra tooling |
| Invicti | Platform breadth, proof-based scanning, IDC Leader placement, Agentic Pentest with per-assessment pricing | No public full price list, benchmark data is vendor-run, version not published |
| StackHawk | Developer-first, Claude Code plugins, simple per-person Wingman pricing, partner program | No analyst placement found, team-plan prices unclear, narrower enterprise track record |
One pattern in the table is worth stating plainly. The open-source option and the developer-first option both win on cost and speed to first scan. The two heavier tools win on governance and support. If your auditors ask for evidence of vendor support and analyst validation, the cost of going free rises quickly.
Our ranking weighs verified capability, cost transparency and how many teams each tool fits.
- OWASP ZAP wins for most teams. It is free, it ships updates almost weekly and it runs in CI today. Its October changes (Client Spider, OAuth2 support, the Script Viewer) target the exact weak points of automated DAST, which are modern crawling and authentication.
- Burp Suite wins for security professionals. Nothing here matches the interactive workflow, and the DAST 2026.10 triage rules fix the biggest operational complaint about scheduled scans.
- Invicti wins for large enterprises. Platform scope, IDC Leader placement and the first per-assessment agentic pentest pricing make it the safest paper trail. Demand the full price list and run your own proof of concept before signing.
- StackHawk wins for AI-agent-heavy startups. Wingman at $10 per person per month with unlimited apps is the simplest pricing in the group, and the Claude Code plugins put scanning where those developers already work.
The data behind this call is thin in one place, and we would rather say so. No independent benchmark compares all four tools, and the only published performance numbers come from Invicti’s own test of its own product. If a decision costs six figures, spend two weeks running the same three apps through two finalists and let your own false-positive rate decide. For everyone else, start free with ZAP, add Burp Professional for the person who does manual testing, and revisit a paid platform only when triage hours, compliance asks or app count outgrow the free setup.
FAQ: DAST Tools, Burp Suite, ZAP, Invicti and StackHawk
What are DAST tools and what do they test?
DAST tools test a running web application or API from the outside, sending crafted requests and watching responses for signs of flaws such as injection or broken authentication. They need no source code access, which makes them useful for third-party apps. They miss issues in code paths the scanner never reaches, so pair them with static analysis.
Is OWASP ZAP better than Burp Suite?
Neither wins across the board. ZAP is free and strong in automation, while Burp Professional offers the more polished manual testing workflow and Burp Suite DAST adds scheduled scanning with persistent triage rules. Developers and budget-limited teams tend to pick ZAP, and professional pentesters tend to pick Burp.
How much does Burp Suite Professional cost?
A secondary comparison page lists $499 per named user per year as of October 2026, but we could not confirm that on a PortSwigger page, so check the vendor’s purchase page before budgeting. PortSwigger states that Professional users get free monthly Burp AT usage.
Is there a free DAST tool?
Yes. OWASP ZAP is free and open source with no paid tier from the project. Burp Suite Community is also free, but it lacks the automated scanner. Free tools cost engineer time for setup and triage, so count that when you compare against paid platforms.
What is Invicti Agentic Pentest and what does it cost?
It is Invicti’s AI-driven pentest product, launched in July 2026, that pairs autonomous reasoning with proof-based DAST. In Invicti’s October 8 benchmark, four assessments cost $345.54 at introductory pricing, with individual assessments between $31.46 and $134.49. The introductory offer runs through December 31, 2026.
Which DAST tool works best in CI/CD pipelines?
ZAP and StackHawk both target pipeline use. ZAP offers Docker images and baseline scripts at no cost, and StackHawk is built around developer workflows with per-person pricing. Burp Suite DAST and Invicti also schedule and automate scans but suit teams with a central AppSec owner.
Can DAST replace a manual penetration test?
No. Automated scanners, even AI-assisted ones, still struggle with authorization logic and multi-step business flows. Use DAST for continuous coverage and known vulnerability classes, then schedule human testers for high-risk releases and compliance-mandated reviews.
Which DAST tool is the best choice for AI coding agents?
StackHawk is the one built around that scenario, with Claude Code plugins announced October 14, 2026 and a Wingman plan at $10 per person per month. ZAP’s Generate Fix Prompt feature offers a lighter version of the same idea for teams that prefer to stay open source.
