There is no single best DAST tool. ZAP and Nuclei are free and open source, so they suit teams that want to script their own scans. Burp Suite DAST, StackHawk and Invicti are commercial products with managed dashboards. Pick by how your app is built, how you log in to it, and where scans must run.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation, as of 19 October 2026.
Key takeaways
- DAST tests a running application from the outside, so it finds problems that source code scanning cannot see, such as missing headers or broken access on a live endpoint.
- Free options (ZAP, Nuclei) cost engineering time instead of licence fees.
- Authentication and single page apps are where tools differ most, so test those first.
- Start with a short baseline scan on every pull request and run longer active scans on a schedule.
What is DAST and how is it different from SAST?
DAST (dynamic application security testing) sends requests to a running application and watches the responses, the way an attacker would. SAST reads source code without running it.
The two find different things. DAST sees the deployed configuration, the real headers, the real authentication flow. SAST sees the code path that caused it. Most teams need both. If you want to see a DAST scan end to end, try the demo below.
Click through it at your own pace, or open it full screen.
Which DAST tools are worth comparing?
Five tools come up most often in buyer searches and community threads: ZAP, Nuclei, Burp Suite DAST, StackHawk and Invicti. The table is filled only from each vendor or project page we read.
| Tool | Type | Scan approach | CI integration (per docs) | API scanning (per docs) |
|---|---|---|---|---|
| ZAP | Free and open source | Baseline, full and API packaged scans | GitHub Actions for each packaged scan; Docker images | OpenAPI and GraphQL (GraphQL needs 2.9.0 or later) |
| Nuclei | Open source, MIT license | YAML templates, each describing one check | Not covered on the page we read | API support marked alpha |
| Burp Suite DAST | Commercial | Same scanning engine as Burp Suite Professional; Chromium based crawler | Jenkins, GitHub Actions, GitLab CI, Azure DevOps | Postman Collections, OpenAPI, SOAP WSDL, GraphQL |
| StackHawk | Commercial | HawkScan scanner configured by a stackhawk.yml file | GitHub Actions, GitLab, Jenkins, CircleCI, Azure Pipelines | OpenAPI, GraphQL, gRPC, JSON-RPC, SOAP configuration pages |
| Invicti | Commercial | Proof based scanning, per its site | More than 110 integrations listed, including GitHub Actions, Jenkins, GitLab CI/CD, Azure Pipelines | Claims shadow API discovery and BOLA and BFLA detection |
Pricing is not published on the pages we read for Burp Suite DAST or StackHawk, so ask each vendor for a quote.
What are the strengths and limits of each tool?
ZAP calls itself free and open source. Its Docker image ships three packaged scans. The baseline scan runs the spider for one minute by default and then reports passive findings. The full scan adds an active scan. The API scan works from an OpenAPI or GraphQL definition. The ZAP site is branded "ZAP by Checkmarx" and also states that ZAP is an independent open source project. The trade off is that you own the setup, tuning and triage.
Nuclei is template driven. Its docs describe it as probing applications, infrastructure, cloud platforms and networks, and say the community contributes over 6,500 templates. It fits teams that want fast, repeatable checks for known issues. Its template model is different from a crawler that explores an app, so treat it as a complement rather than a drop in replacement.
Burp Suite DAST says it uses the same engine as Burp Suite Professional. It lists native authentication for Basic, Bearer Token, API Key and OAuth 2.0 Client Credentials, can gate merges by severity, and offers cloud, self hosted and Kubernetes deployment, including air gapped environments. It suits teams that already trust Burp for manual testing.
StackHawk runs HawkScan locally or in CI and keeps findings in its platform. The documentation we read did not state what engine HawkScan uses. It fits developer led teams who want scan config stored beside the code.
Invicti describes proof based scanning and API discovery. The vendor cites a Miercom validation of accuracy on its site. We could not verify that claim independently, so check the report yourself.
How do I choose a DAST tool?
Use this checklist and score each tool on a real staging app, not a demo target.
- Can it log in the way your app does (form, token, OAuth, SSO)?
- Does it handle your front end, such as a single page app, GraphQL or WebSockets?
- Can it run inside your CI runner, or does it need a separate scanning machine?
- Does it import your OpenAPI or Postman definition for API coverage?
- Can you set a pass or fail gate by severity without blocking on noise?
- Can scans run against internal targets, and who hosts the scanner?
- Who triages the output, and where do findings go (Jira, GitHub issues)?
- What does it cost at your application count, including concurrency limits?
How should I run DAST in CI without slowing every build?
Run the short scan on pull requests and the long scan on a schedule. ZAP's baseline scan is a good model: a time limited spider plus passive checks. Reserve full active scans for a staging environment you are allowed to attack, overnight or weekly.
Never point an active scan at production data you cannot lose. Active scans submit forms and can create records.
Where does Safeguard fit?
Safeguard has an interactive DAST demo you can walk through without an account, and a CLI and local runner that keeps source on your machine. For dependency risk, the free in-browser scan at gold.safeguard.sh/scan checks up to 100 dependencies with no login, and the file stays on your machine. The wider catalog is at gold.safeguard.sh.
Frequently asked questions
Is there a free DAST tool?
Yes. ZAP describes itself as free and open source, and Nuclei is MIT licensed. You pay in setup and triage time rather than licence fees.
Can DAST replace a penetration test?
No. DAST automates repeatable checks. A penetration tester chains issues and tests business logic that scanners do not understand.
How long does a DAST scan take?
It depends on the app. ZAP's baseline scan spiders for one minute by default, while a full active scan has no default time limit.
Does DAST need source code access?
No. It tests the running app over HTTP. That is also why it cannot tell you which line of code caused a finding.
Should I scan production?
Run passive checks at most. Active scans send attack traffic and write data, so use staging.
Sources
- ZAP Docker packaged scans: https://www.zaproxy.org/docs/docker/about/
- ZAP home page: https://www.zaproxy.org/
- Nuclei overview: https://docs.projectdiscovery.io/opensource/nuclei/overview
- Nuclei repository (license): https://github.com/projectdiscovery/nuclei
- Burp Suite DAST: https://portswigger.net/burp/dast
- StackHawk docs: https://docs.stackhawk.com/
- Invicti: https://www.invicti.com/
- Free dependency scan: https://gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
