Burp AT Agentic AI that extends human-led pentesting. 
Burp Suite DAST The enterprise-enabled dynamic web vulnerability scanner. 
Burp Suite Professional The world's #1 web penetration testing toolkit. 
Burp Suite Community Edition The best manual tools to start web security testing. View all product editions The same scanning engine your pentesters trust in Burp Suite Professional. Now running across your whole portfolio.
Trusted by the world’s most security-conscious organisations
Burp Suite DAST is the only DAST built on the workflow your pentesters trust in Burp Suite Professional. It fits both how your AppSec team runs the security programme and how your developers release code. Whether a scan runs on a schedule or in your pipeline, it's the same engine, and findings land in the same place.
Schedule scans across the whole portfolio, on the cadence your risk model demands. Triage, prioritise, and report from a single place. The evidence model is the same one your pentesters already use in Burp Suite Professional.
Plug Burp Suite DAST into your CI as a step. Run on every pull request, gate merges by severity, route findings back to the engineer who opened the PR. No translation between platforms. The same finding lands in your AppSec team's view too.
Built around how your team already tests. Every capability shaped by the workflow your pentesters trust in Burp Suite Professional, then running continuously across every application in your portfolio.
Browser-powered Chromium crawler that handles modern JavaScript SPAs. Single-page apps, dynamic forms, GraphQL endpoints, async loads. Burp Suite DAST sees the app the way your customers do, with parallel crawl and audit.
Session-aware scanning carries authenticated state across the scan. Capture the session once, then the scanner explores everything behind the login without restarting the auth flow on every request.
Crawler docs →Scan APIs defined by Postman Collections, OpenAPI, SOAP, and GraphQL. Native authentication for Basic, Bearer Token, API Key, and OAuth 2.0 Client Credentials. Platform integrations for Amazon API Gateway, Azure API Management, and Google Apigee.
"At Accenture, API scans went from two to three days to about thirty minutes."API scanning docs →
DAST and Pro run on the same scanning engine: same taxonomy, same evidence, same severity model. The check IDs match. The severity classifications match. The reasoning model is shared. Every finding DAST surfaces speaks the language your pentesters already use in Burp Suite Professional.
Custom logic carries across, too. Your team's BChecks (PortSwigger's declarative scan-check language) run unchanged in Burp Suite DAST. Internal scan policy you've already invested in is portable.
Explore the Burp Suite ecosystem →Role-based access control. Site groups for organising large portfolios. Audit trails on every scan and every issue change. SAML SSO into your identity provider. Bulk operations across thousands of sites.
Programme-level controls built in. Scan policy templates you can lock down per group. Reporting that rolls up across the whole portfolio.
Admin & access control docs →See pentester-grade coverage across your own portfolio.
Burp Suite DAST runs as managed Cloud, or self-hosted on your own infrastructure: a standard installer for Windows or Linux, or an auto-scaling Helm deployment on Kubernetes. Same software, same scanning engine, wherever you run it.
Fastest time to first scan. Always on the latest scanning engine. Add self-hosted scanning machines to reach network-internal targets when you need them.
Windows or Linux installers for the dashboard and scanning machines. Full control of the deployment, with your own database (PostgreSQL or Oracle) for production. Air-gapped supported.
Helm chart deployment with auto-scaling scanning resources. Dashboard and scanner pods managed the way you already manage everything else on the cluster.
The integrations your AppSec programme depends on, with native support out of the box. For the rest, a GraphQL API your platform team can hit from anywhere.
Whatever your platform team needs to automate, they can build with the Burp Suite DAST API. Trigger scans, fetch findings, manage sites, push results into your internal tools.
# schedule a scan from a custom internal tool POST https://burp-dast.example.com/graphql/v1 Authorization: $DAST_API_KEY mutation { create_schedule_item(input: { site_ids: ["184"] }) { schedule_item { id scheduled_run_time } } }
Every Burp Suite DAST finding includes the evidence Burp Scanner captured: the request it sent and the response that confirms the issue, the same proof a pentester would gather by hand. A pentester can verify it. A security lead can defend it at review. A developer can reproduce it locally in Burp Pro.
// Burp DAST · evidence · job 8421 · target: auth-svc.example.com[DAST] Scheduled scan starting · scope: auth-svc.example.com[DAST] Auth: OAuth 2.0 Client Credentials · session captured[DAST] Crawler: Chromium headless · parallel audit enabled[DAST] Discovered 412 endpoints · 84 JSON · 7 GraphQL · 14 WS · 23 forms[Scanner] Audit phase: running JWT issuer-confusion family[Scanner] > GET /api/auth/refresh[Scanner] > Authorization: Bearer eyJhbGciOiJIUzI1NiI…[Scanner] < 200 OK { "sessionId": "abc123" } // baseline established[Scanner] Testing: re-request without Authorization header[Scanner] > GET /api/auth/refresh // no Authorization header[Scanner] < 200 OK { "sessionId": "new-9f8e7d6c..." }[Scanner] CONFIRMED · JWT verification bypass via header omission[Scanner] CVSS 8.6 (High) · CWE-287 · check: jwt-bypass-001[DAST] Issue raised · job 8421 · auth-svc · /api/auth/refresh→ Reproduces 1:1 in Burp Suite Professional. Send to your pentester for follow-up.
of any DAST platform SAP Sovereign Cloud Services evaluated.
"By partnering with PortSwigger and adopting Burp Suite's DAST solution, we are able to satisfy regional security requirements across multiple countries at scale, through automation, and with the lowest false positives."
See what Burp Suite DAST finds in your applications.
When you need help, you’ll get an engineer, not a queue. Three things we do differently:
Open a ticket and you reach a technical support specialist who works in Burp Suite DAST every day. When something needs an engineering answer, they sit close to the team that builds the scanner and can get one back fast.
A structured onboarding programme takes your team from contract signature to first confirmed finding, without you doing the integration discovery on your own. Scheduled scans across your first portfolio inside the first weeks, not months.
A named solutions architect to lean on as the programme matures. Expert guidance on coverage decisions, false-positive triage, scan-policy tuning, and integration health, on whatever cadence your team needs. They sit between you and product to escalate what matters.
The best way to evaluate a scanner is to point it at your own apps. Book a demo, talk to our team, or check pricing for your portfolio.
