# Dynamic application security testing for enterprise buyers: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "DAST tool" and as "dynamic web application security scanner", six framings each, to fourteen models with search on, on behalf of an enterprise B2B company. Added to the November 2026 Edition. Page: https://www.gane.ai/index/it/developer/dynamic-application-security-testing/2026-11/enterprise

**Standing:** Invicti leads with 58% of first choices; verdict clear leader. 52 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Invicti](https://www.gane.ai/index/it/vendors/invicti/index.md) | 58% | 11% | 65 |
| 2 | [Burp Suite DAST](https://www.gane.ai/index/it/vendors/burp-suite-dast/index.md) | 10% | 0% | 20 |
| 3 | [Checkmarx DAST](https://www.gane.ai/index/it/vendors/checkmarx-dast/index.md) | 4% | 6% | 32 |
| 4 | [HCL AppScan](https://www.gane.ai/index/it/vendors/hcl-appscan/index.md) | 4% | 13% | 31 |
| 5 | [Burp Suite Enterprise Edition](https://www.gane.ai/index/it/vendors/burp-suite-enterprise-edition/index.md) | 4% | 10% | 10 |
| 6 | [Burp Suite](https://www.gane.ai/index/it/vendors/burp-suite/index.md) | 4% | 48% | 29 |
| 7 | [Rapid7 InsightAppSec](https://www.gane.ai/index/it/vendors/rapid7-insightappsec/index.md) | 2% | 16% | 37 |
| 8 | [Qualys Web Application Scanning](https://www.gane.ai/index/it/vendors/qualys-web-application-scanning/index.md) | 2% | 12% | 26 |
| 9 | [Veracode DAST](https://www.gane.ai/index/it/vendors/veracode-dast/index.md) | 2% | 15% | 27 |
| 10 | [Bright Security](https://www.gane.ai/index/it/vendors/bright-security/index.md) | 2% | 8% | 12 |
| 11 | [Escape](https://www.gane.ai/index/it/vendors/escape/index.md) | 2% | 10% | 10 |
| 21 | [StackHawk](https://www.gane.ai/index/it/vendors/stackhawk/index.md) | 0% | 33% | 21 |

Rank is by share of first choices among all 79 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: no first choice
- GPT-5.4 mini: Invicti; alternatives Burp Suite DAST, Rapid7 InsightAppSec
- Gemini 3.5 Flash: Invicti; alternatives Bright Security, Burp Suite, Rapid7 InsightAppSec, StackHawk
- Perplexity Sonar: Invicti; alternatives Burp Suite DAST, Checkmarx DAST, Escape, StackHawk
- Grok 4.20: Invicti; alternatives Aikido Security, Burp Suite, Checkmarx DAST, HCL AppScan
- Mistral Small: Invicti; alternatives Burp Suite, Cycode, Escape, StackHawk
- DeepSeek V4 Flash: Invicti; alternatives Checkmarx DAST, Checkmarx One, HCL AppScan, Rapid7 InsightAppSec
- Llama 4 Maverick: Invicti
- Qwen 3.7 Flash: Invicti; alternatives Checkmarx DAST, Escape, PortSwigger Burp Suite Enterprise, Qualys Web Application Scanning
- Kimi K2: Invicti, Veracode DAST; alternatives Burp Suite, HCL AppScan
- GLM 4.7 FlashX: Invicti; alternatives Bright Security, Burp Suite Enterprise Edition, Fortify WebInspect, HCL AppScan
- MiniMax M2.5: Invicti; alternatives Checkmarx DAST, HCL AppScan, Rapid7 InsightAppSec, Veracode DAST
- GPT-6 Luna: Burp Suite DAST; alternatives Invicti
- Muse Glimmer 30B: Invicti; alternatives PortSwigger Burp Suite DAST

## Sources the answers cite

75 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- invicti.com: 46 answers, 89 citations
- checkmarx.com: 31 answers, 37 citations
- aikido.dev: 26 answers, 28 citations
- brightsec.com: 25 answers, 33 citations
- augmentcode.com: 25 answers, 26 citations
- aimultiple.com: 23 answers, 24 citations
- escape.tech: 22 answers, 31 citations
- safeguard.sh: 22 answers, 30 citations

Pages named in the most answers:

- https://aikido.dev/blog/top-enterprise-dast-tools (26 answers)
- https://augmentcode.com/tools/best-dast-tools-for-enterprise-security (25 answers)
- https://checkmarx.com/learn/dast/dast-tools-key-features-and-12-solutions-to-know-in-2026 (20 answers)
- https://invicti.com/blog/web-security/best-enterprise-dast-tools-for-large-enterprises-buyers-guide (20 answers)
- https://aimultiple.com/dast-tools (19 answers)
- https://escape.tech/blog/top-dast-tools (19 answers)
- https://softwaretestinghelp.com/dynamic-application-security-testing-dast-software (19 answers)
- https://immuniweb.com/resources/best-dast-tools (18 answers)
- https://invicti.com/blog/web-security/enterprise-dast-rfp-checklist-how-to-evaluate-dast-vendors (15 answers)
- https://safeguard.sh/resources/blog/best-dast-tools-for-web-application-security-testing (15 answers)

## Warned against

- OWASP ZAP: 22 of 28 labels negative. "Why cautious/avoid: Excellent free/open-source option for small teams or learning, but it often produces high false positives on complex applications" (Grok 4.20, negative prompt)
- Burp Suite: 14 of 29 labels negative. "Models to Avoid at Your Scale ... Per-user (Burp Suite Pro: ~$449/user/year) | 1,000 users = $449K/year; linear cost growth" (Kimi K2, budget prompt)
- StackHawk: 7 of 21 labels negative. "Tools to Avoid for This Specific Use Case ... Developer-based SaaS DAST tools (e.g., StackHawk" (Gemini 3.5 Flash, budget prompt)
- Invicti: 7 of 65 labels negative. "Tools with high measured false-positive rates and/or a gap between vendor accuracy claims and independent benchmarks, e.g. Invicti/Acunetix showing 23% false positives" (Muse Glimmer 30B, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: Invicti at 58%.

- Invicti: 62% to 58%, −4. Inside the floor by 7 points · rank 1 of 79, unchanged.
- Checkmarx DAST: 0% to 4%, +4. Inside the floor by 7 points · rank 14 → 3 of 79.
- Burp Suite DAST: 12% to 10%, −2. Inside the floor by 9 points · rank 2 of 79, unchanged.
- Burp Suite Enterprise Edition: 2% to 4%, +2. Inside the floor by 9 points · rank 7 → 5 of 79.
- Qualys Web Application Scanning: 0% to 2%, +2. Inside the floor by 9 points · rank 16 → 8 of 79.
- Veracode DAST: 4% to 2%, −2. Inside the floor by 9 points · rank 3 → 9 of 79.
- Bright Security: 0% to 2%, +2. Inside the floor by 9 points · rank 17 → 10 of 79.
- Escape: 0% to 2%, +2. Inside the floor by 9 points · rank 18 → 11 of 79.
- Checkmarx One: 2% to 0%, −2. Inside the floor by 9 points · rank 8 → 16 of 79.
- StackHawk: 2% to 0%, −2. Inside the floor by 9 points · rank 10 → 21 of 79.
- Acunetix: 2% to 0%, −2. Inside the floor by 9 points · rank 11 → 36 of 79.
- HCL AppScan: 4% to 4%, ±0. Inside the floor by 11 points · rank 4 of 79, unchanged.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.