Ranked list · DAST

Top 10 DAST Tools

10 tools, ranked Last reviewed 29 September 2026

A practitioner's guide to dynamic application security testing tools, picked for distinct scenarios rather than ranked, with an honest caveat on each.

The order follows the roundup The 10 Best DAST Tools, which explains each pick and where it falls short.

Number 1: ZAP

by ZAP project, Software Security Project

Best for: teams that need a fully scriptable scanner they can own end to end

Open source Established Verified

Read the full profile Visit zaproxy.org

Number 2: Burp Suite

by PortSwigger

Best for: hands-on manual testing where a human drives every request

Freemium Established Verified

Read the full profile Visit portswigger.net

Number 3: Invicti

by Invicti Security

Best for: large application estates where triage capacity, not detection, is the bottleneck

Commercial Established

Read the full profile Visit invicti.com

Number 4: StackHawk

by StackHawk

Best for: developer-owned scanning of pre-production environments in CI

Commercial Growing

Read the full profile Visit stackhawk.com

Number 5: Fortify WebInspect

by OpenText

Best for: complex authenticated legacy applications under centralized policy

Commercial Established

Read the full profile Visit opentext.com

Number 6: Escape

by Escape Technologies

Best for: API testing that covers authorization logic, not just injection

Commercial Growing

Read the full profile Visit escape.tech

Number 7: Detectify

by Detectify

Best for: finding and testing the internet-facing assets you did not know you had

Commercial Established

Read the full profile Visit detectify.com

Number 8: Nuclei

by ProjectDiscovery

Best for: fast, high-confidence checks for known issues across many hosts

Open source Established Verified

Read the full profile Visit docs.projectdiscovery.io

Number 9: Fluid Attacks

by Fluid Attacks

Best for: continuous assurance where scanner output alone will not satisfy the requirement

Commercial Growing

Read the full profile Visit fluidattacks.com

Number 10: Mayhem

by ForAllSecure

Best for: driving code paths into failure states with reproducible crash cases

Commercial Growing

Read the full profile Visit mayhem.security

methodology

How this list was made

How entries are chosen. Every entry is a tool with a published profile in the catalog, in Dynamic Application Security Testing. Each note above says why it made this list, for the job in the title, separately from the tool's full profile.

Ranking is editorial. The order is a judgement by the editors about fit for this use case, not a score, a benchmark or a popularity count. A different job can produce a different order.

Advertising has no influence. Slots marked Sponsored are sold separately from the editorial. No vendor can pay to be included, to move up, or to be removed.

Read the editorial policy