# Dynamic application security testing: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "DAST tool" and as "dynamic web application security scanner", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Added to the November 2026 Edition. Page: https://www.gane.ai/index/it/developer/dynamic-application-security-testing/2026-11

**Standing:** Invicti leads with 33% of first choices; verdict contested. 54 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Invicti](https://www.gane.ai/index/it/vendors/invicti/index.md) | 33% | 12% | 51 |
| 2 | [OWASP ZAP](https://www.gane.ai/index/it/vendors/owasp-zap/index.md) | 26% | 25% | 57 |
| 3 | [Acunetix](https://www.gane.ai/index/it/vendors/acunetix/index.md) | 13% | 6% | 35 |
| 4 | [StackHawk](https://www.gane.ai/index/it/vendors/stackhawk/index.md) | 11% | 2% | 41 |
| 5 | [Bright Security](https://www.gane.ai/index/it/vendors/bright-security/index.md) | 2% | 0% | 11 |
| 6 | [Escape](https://www.gane.ai/index/it/vendors/escape/index.md) | 2% | 0% | 11 |
| 7 | [Probely](https://www.gane.ai/index/it/vendors/probely/index.md) | 2% | 0% | 10 |
| 9 | [Veracode DAST](https://www.gane.ai/index/it/vendors/veracode-dast/index.md) | 2% | 24% | 17 |
| 14 | [Burp Suite](https://www.gane.ai/index/it/vendors/burp-suite/index.md) | 0% | 28% | 40 |
| 15 | [Rapid7 InsightAppSec](https://www.gane.ai/index/it/vendors/rapid7-insightappsec/index.md) | 0% | 12% | 25 |
| 16 | [Detectify](https://www.gane.ai/index/it/vendors/detectify/index.md) | 0% | 0% | 14 |
| 17 | [Nuclei](https://www.gane.ai/index/it/vendors/nuclei/index.md) | 0% | 19% | 16 |

Rank is by share of first choices among all 74 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Invicti; alternatives Acunetix, Bright Security, StackHawk
- GPT-5.4 mini: StackHawk; alternatives Burp Suite, Invicti
- Gemini 3.5 Flash: StackHawk; alternatives Acunetix, Bright Security, Escape, Invicti
- Perplexity Sonar: Invicti; alternatives Bright Security, Escape, StackHawk
- Grok 4.20: Invicti; alternatives Escape, Intruder, Probely, StackHawk
- Mistral Small: Acunetix, Invicti; alternatives OWASP ZAP, StackHawk
- DeepSeek V4 Flash: Acunetix; alternatives Invicti, OWASP ZAP, StackHawk
- Llama 4 Maverick: Invicti; alternatives Burp Suite, OWASP ZAP, StackHawk
- Qwen 3.7 Flash: Invicti; alternatives Acunetix, Apidog, Postman, Veracode DAST
- Kimi K2: Acunetix, Intruder; alternatives Bright Security, Detectify
- GLM 4.7 FlashX: OWASP ZAP, Probely; alternatives Burp Suite, Invicti, StackHawk
- MiniMax M2.5: Acunetix, Bright Security; alternatives Detectify, Intruder
- GPT-6 Luna: StackHawk; alternatives Burp Suite DAST, Invicti
- Muse Glimmer 30B: Invicti; alternatives Acunetix, StackHawk

## Sources the answers cite

72 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- safeguard.sh: 30 answers, 41 citations
- immuniweb.com: 29 answers, 30 citations
- softwaretestinghelp.com: 25 answers, 27 citations
- securityboulevard.com: 23 answers, 29 citations
- aimultiple.com: 22 answers, 24 citations
- github.com: 18 answers, 39 citations
- checkmarx.com: 18 answers, 19 citations
- invicti.com: 17 answers, 31 citations

Pages named in the most answers:

- https://immuniweb.com/resources/best-dast-tools (29 answers)
- https://softwaretestinghelp.com/dynamic-application-security-testing-dast-software (25 answers)
- https://safeguard.sh/resources/blog/best-dast-tools-for-web-application-security-testing (20 answers)
- https://aimultiple.com/dast-tools (18 answers)
- https://checkmarx.com/learn/dast/dast-tools-key-features-and-12-solutions-to-know-in-2026 (13 answers)
- https://gane.ai/index/it/developer/dynamic-application-security-testing (12 answers)
- https://geekflare.com/cybersecurity/best-dast-scanners (12 answers)
- https://cipherssecurity.com/best-dast-tools-2026 (11 answers)
- https://securityboulevard.com/2026/04/dast-tools-complete-buyers-guide-10-solutions-to-know-in-2026 (10 answers)
- https://appsecsanta.com/dast-tools (10 answers)

## Warned against

- OWASP ZAP: 14 of 57 labels negative. "it is advisable to avoid or proceed with extreme caution when using OWASP ZAP or Invicti in automated pipelines" (Mistral Small, negative prompt)
- Burp Suite: 11 of 40 labels negative. "Avoid these if you are mid-market: Burp Suite Professional" (Qwen 3.7 Flash, direct prompt)
- Invicti: 6 of 51 labels negative. "it is advisable to avoid or proceed with extreme caution when using OWASP ZAP or Invicti in automated pipelines" (Mistral Small, negative prompt)
- Arachni: 4 of 4 labels negative. "Arachni: Avoid relying on the original project for current coverage. Its GitHub repository was archived on May 31, 2026" (GPT-6 Luna, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
New leader: OWASP ZAP (29%) to Invicti (33%). Margin 7 points, within noise.

- Invicti: 20% to 33%, +13. Cleared the floor by 2 points · rank 2 → 1 of 74.
- Bright Security: 8% to 2%, −6. Inside the floor by 5 points · rank 5 of 74, unchanged.
- Intruder: 6% to 2%, −4. Inside the floor by 7 points · rank 6 → 8 of 74.
- OWASP ZAP: 29% to 26%, −3. Inside the floor by 8 points · rank 1 → 2 of 74.
- StackHawk: 8% to 11%, +3. Inside the floor by 8 points · rank 4 of 74, unchanged.
- Probely: 0% to 2%, +2. Inside the floor by 9 points · rank 43 → 7 of 74.
- Veracode DAST: 0% to 2%, +2. Inside the floor by 9 points · rank 20 → 9 of 74.
- Burp Suite: 2% to 0%, −2. Inside the floor by 9 points · rank 9 → 14 of 74.
- Aikido Security: 2% to 0%, −2. Not named this edition · was rank 10 of 57.
- Acunetix: 12% to 13%, +1. Inside the floor by 10 points · rank 3 of 74, unchanged.
- Escape: 2% to 2%, ±0. Inside the floor by 11 points · rank 11 → 6 of 74.
- Rapid7 InsightAppSec: 0% to 0%, ±0. Inside the floor by 11 points · rank 15 of 74, unchanged.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.