Dynamic application security testing for enterprise buyers
Asked as “DAST tool”, and as “dynamic web application security scanner”, on behalf of an enterprise B2B company. 52 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each. Added to the November 2026 Edition.
Standing · first-choice share
58%
Clear leader
58Invicti10Burp Suite DAST04Burp Suite29others
58% of first choices, clear leader.
Since October 2026▼−4Since October 2026: 62% → 58%, −4 points. Inside the 11-point floor: within noise.Invicti held the lead, −4 points on 62%, inside the 11-point floor.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small business
OWASP ZAP51%Clear leader▲+8Since October 2026: 43% → 51%, +8 points. Inside the 11-point floor: within noise.Standing →Mid-market
Invicti33%Contested↗new leaderNew leader since October 2026: Invicti (33%) replaces OWASP ZAP (29% then, 26% now), 7 points clear, inside the 11-point floor.Standing →EnterpriseInvicti58%Clear leader▼−4Since October 2026: 62% → 58%, −4 points. Inside the 11-point floor: within noise.This page
OWASP ZAP51%Clear leader▲+8Since October 2026: 43% → 51%, +8 points. Inside the 11-point floor: within noise.Standing →Mid-marketInvicti33%Contested↗new leaderNew leader since October 2026: Invicti (33%) replaces OWASP ZAP (29% then, 26% now), 7 points clear, inside the 11-point floor.Standing →EnterpriseInvicti58%Clear leader▼−4Since October 2026: 62% → 58%, −4 points. Inside the 11-point floor: within noise.This pageThe standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince October 2026
01Invicti58%11%65endorsed leader▼−4Since October 2026: 62% → 58%, −4 points. Inside the 11-point floor: within noise.62% → 58%
Invicti58%11%65endorsed leader▼−4Since October 2026: 62% → 58%, −4 points. Inside the 11-point floor: within noise.62% → 58%02Burp Suite DAST10%0%20accepted challenger▼−2Since October 2026: 12% → 10%, −2 points. Inside the 11-point floor: within noise.12% → 10%
03
Checkmarx DAST4%6%32accepted challenger▲+4Since October 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise.0% → 4%
Checkmarx DAST4%6%32accepted challenger▲+4Since October 2026: 0% → 4%, +4 points. Inside the 11-point floor: within noise.0% → 4%04
HCL AppScan4%13%31accepted challenger=heldSince October 2026: 4% → 4%, ±0 points. Inside the 11-point floor: within noise.4% → 4%
HCL AppScan4%13%31accepted challenger=heldSince October 2026: 4% → 4%, ±0 points. Inside the 11-point floor: within noise.4% → 4%05Burp Suite Enterprise Edition4%10%10accepted challenger▲+2Since October 2026: 2% → 4%, +2 points. Inside the 11-point floor: within noise.2% → 4%
06Burp Suite4%48%29criticized challenger=heldSince October 2026: 4% → 4%, ±0 points. Inside the 11-point floor: within noise.4% → 4%
07
Rapid7 InsightAppSec2%16%37accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%
Rapid7 InsightAppSec2%16%37accepted challenger=heldSince October 2026: 2% → 2%, ±0 points. Inside the 11-point floor: within noise.2% → 2%08
Qualys Web Application Scanning2%12%26accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%
Qualys Web Application Scanning2%12%26accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%09
Veracode DAST2%15%27accepted challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%
Veracode DAST2%15%27accepted challenger▼−2Since October 2026: 4% → 2%, −2 points. Inside the 11-point floor: within noise.4% → 2%10Bright Security2%8%12accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%
11
Escape2%10%10accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%
Escape2%10%10accepted challenger▲+2Since October 2026: 0% → 2%, +2 points. Inside the 11-point floor: within noise.0% → 2%Show the three products at 0%, ordered by negative rate
14OWASP ZAP0%79%28criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%
OWASP ZAP0%79%28criticized challenger=heldSince October 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise.0% → 0%13
Acunetix0%40%15criticized challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%
Acunetix0%40%15criticized challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%12
StackHawk0%33%21criticized challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%
StackHawk0%33%21criticized challenger▼−2Since October 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise.2% → 0%The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one can't be told apart from repeat variation, and both are shown. Each index measures its own floor from its own repeat, over its own categories, so the floor differs from one index to the next. Both editions asked the same fourteen models. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
For buyers
Head to headHead-to-head pages are published for mid-market buyers, so these open on mid-market figures, not enterprise.
All twenty-eight head-to-head pages: the top eight products, each against each
Invicti vs Bright SecurityInvicti vs EscapeInvicti vs ProbelyInvicti vs Veracode DASTOWASP ZAP vs AcunetixOWASP ZAP vs StackHawkOWASP ZAP vs Bright SecurityOWASP ZAP vs EscapeOWASP ZAP vs ProbelyOWASP ZAP vs Veracode DASTAcunetix vs StackHawkAcunetix vs Bright SecurityAcunetix vs EscapeAcunetix vs ProbelyAcunetix vs Veracode DASTStackHawk vs Bright SecurityStackHawk vs EscapeStackHawk vs ProbelyStackHawk vs Veracode DASTBright Security vs EscapeBright Security vs ProbelyBright Security vs Veracode DASTEscape vs ProbelyEscape vs Veracode DASTProbely vs Veracode DAST
One product takes 58% of first choices here, so the chart would put thirteen markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Four products carry a negative rate above 25% in this category.
What they warned about
Seven of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, Mistral Small, DeepSeek V4 Flash, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
OWASP ZAP79%
22 of 28 labels negative · 12 of 14 models · 2 hard negative
“Why cautious/avoid: Excellent free/open-source option for small teams or learning, but it often produces high false positives on complex applications” Grok 4.20, negative prompt
Burp Suite
48%
14 of 29 labels negative · 9 of 14 models · 4 hard negative
“Models to Avoid at Your Scale ... Per-user (Burp Suite Pro: ~$449/user/year) | 1,000 users = $449K/year; linear cost growth” Kimi K2, budget prompt
StackHawk33%
7 of 21 labels negative · 6 of 14 models · 1 hard negative
“Tools to Avoid for This Specific Use Case ... Developer-based SaaS DAST tools (e.g., StackHawk” Gemini 3.5 Flash, budget prompt
Invicti11%
7 of 65 labels negative · 6 of 14 models
“Tools with high measured false-positive rates and/or a gap between vendor accuracy claims and independent benchmarks, e.g. Invicti/Acunetix showing 23% false positives” Muse Glimmer 30B, negative prompt
What they cite
Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted.
Sites the answers cite
75 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 901 links across 185 sites, every framing counted. Ranked by the number of answers carrying the site or page. 51 of the 252 answers across every segment cited this index's own page for the category; the method page measures whether that reading tilts an answer.
vendor site · Invicti46 answers · 89 citations · 13 models
vendor site · Checkmarx31 answers · 37 citations · 12 models
vendor site · Aikido26 answers · 28 citations · 11 models
25 answers · 33 citations · 10 models
vendor site · Augment Code25 answers · 26 citations · 12 models
23 answers · 24 citations · 9 models
vendor site · Escape22 answers · 31 citations · 10 models
vendor site · Safeguard22 answers · 30 citations · 10 models
21 answers · 44 citations · 8 models
vendor site · ImmuniWeb19 answers · 24 citations · 8 models
19 answers · 19 citations · 8 models
vendor site · G218 answers · 24 citations · 9 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
26 answers · 11 models
25 answers · 12 models
20 answers · 9 models
20 answers · 9 models
19 answers · 8 models
19 answers · 9 models
19 answers · 8 models
18 answers · 8 models
15 answers · 9 models
15 answers · 9 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best dast tool”, “dast tool”, “dast tools”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| Invicti invicti.com | 58% | 161 | 90,500 | 83 | 54,568 | $50 | 24 | |
| Burp Suite DAST | 10% | 170 | 13 | |||||
| Checkmarx checkmarx.com Checkmarx DAST 4%, Checkmarx One 0% | 4% | 159 | 260 | 3 | 54,982 company | 61 | 3 | |
| HCL AppScan hcl-software.com | 4% | 59 | 260 | 13 | 49,667 | 38 | ||
| Burp Suite Enterprise Edition | 4% | 30 | 1 | |||||
| Burp Suite | 4% | 12,100 | 681 | |||||
| Rapid7 parent site Rapid7 InsightAppSec 2% | 2% | 63 | 14,800 | 798 | ||||
| Qualys qualys.com Qualys Web Application Scanning 2% | 2% | 40 | 9,900 | 15,172 | 26,929 company | 46 | ||
| Veracode veracode.com Veracode DAST 2% | 2% | 43 | 4,400 | 194 | 12,543 company | 17 | ||
| Bright Security | 2% | 170 | 9 |
Google's top ten for the three searches hold 21 sites; 4 of them are among the sites the models cited here (checkmarx.com, escape.tech, g2.com, safeguard.sh). The first result for “best dast tool” is snyk.io.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best DAST tool for an enterprise B2B company?”Paraphrase“Which dynamic web application security scanner would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade DAST tools and how do they differ?”Budget-constrained“What is the best DAST tool for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a DAST tool. What should we look at?”Negative“Which DAST tools should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5no first choiceInvictiChangedno first choiceagainst: StackHawkCheckmarx DAST, HCL AppScanno first choiceagainst: Bright Security, Burp Suite Enterprise Edition, OWASP ZAP, StackHawk
Two alternatives
Burp Suite DAST, Checkmarx DASTThree alternatives
Checkmarx DAST, Invicti, Veracode DASTOne alternative
InvictiGPT-5.4 miniInvictiagainst: OWASP ZAPInvictiHeldBurp Suite DAST, Invictiagainst: OWASP ZAPBurp Suite DASTno first choicenothing named
Two alternatives
Burp Suite DAST, Rapid7 InsightAppSecOne alternative
Burp Suite DASTTwo alternatives
Acunetix, Checkmarx DASTOne alternative
InvictiGemini 3.5 FlashInvictiInvictiHeldInvictiBurp Suiteagainst: OWASP ZAP, Rapid7 InsightAppSec, StackHawk, Veracode DASTno first choiceagainst: Arachni, Burp Suite, Fortify WebInspect, Grabber, HCL AppScan, Nuclei, OWASP ZAP, Rapid7 InsightVM, Skipfish, Tenable, Tenable Nessus, Vega, Wapiti, w3af
Five alternatives
Bright Security, Burp Suite, Rapid7 InsightAppSec, StackHawk, Veracode DASTFour alternatives
OpenText Fortify WebInspect, Qualys Web Application Scanning, Rapid7 InsightAppSec, Veracode DASTSeven alternatives
Burp Suite Enterprise Edition, Checkmarx DAST, Escape, HCL AppScan, OpenText Fortify WebInspect, StackHawk, Veracode DASTOne alternative
InvictiPerplexity SonarInvictiagainst: OWASP ZAPInvictiHeldagainst: OWASP ZAPInvictiHCL AppScanagainst: GitLab DAST, OWASP ZAP, Rapid7 InsightAppSecno first choiceagainst: Burp, Checkmarx DAST, HCL AppScan, Invicti, Nuclei, OWASP ZAP, Qualys Web Application Scanning, Rapid7 InsightAppSec, StackHawk, Tenable.io WAS
Four alternatives
Burp Suite DAST, Checkmarx DAST, Escape, StackHawkThree alternatives
Burp Suite DAST, Checkmarx DAST, Rapid7 InsightAppSecSeven alternatives
Burp Suite DAST, Checkmarx DAST, HCL AppScan, Qualys Web Application Scanning, Rapid7 InsightAppSec, StackHawk, Veracode DASTOne alternative
Checkmarx DASTGrok 4.20Invictiagainst: OWASP ZAPInvictiHeldagainst: OWASP ZAPInvictiagainst: OWASP ZAPInvictiagainst: Burp, Escape, OWASP ZAP, Rapid7 InsightVM, StackHawk, Veracode DASTInvicti, Rapid7 InsightAppSecagainst: Burp Suiteagainst: Burp Suite, HCL AppScan, Invicti, OWASP ZAP, Qualys Web Application Scanning, Rapid7 InsightAppSec, Veracode DAST
Five alternatives
Aikido Security, Burp Suite, Checkmarx DAST, HCL AppScan, Rapid7 InsightAppSecThree alternatives
Acunetix, HCL AppScan, Qualys Web Application ScanningThree alternatives
Burp Suite Enterprise Edition, Checkmarx DAST, Veracode DASTTwo alternatives
Acunetix, HCL AppScanFour alternatives
Bright Security, Checkmarx One, Qualys Web Application Scanning, Veracode DASTMistral SmallInvictiInvicti, Qualys Web Application ScanningChangedInvictiBright Security, Invictino first choiceagainst: Qualys DAST, Rapid7 InsightAppSec
Four alternatives
Burp Suite, Cycode, Escape, StackHawkThree alternatives
Burp Suite, Checkmarx One, Fortify WebInspectFive alternatives
Detectify, HCL AppScan, PortSwigger Burp Suite Enterprise, Qualys Web Application Scanning, Rapid7 InsightAppSecTwo alternatives
Burp Suite, Qualys Web Application ScanningDeepSeek V4 FlashInvictiBurp SuiteChangedInvictiInvictiagainst: Burp Suite, Detectify, HCL AppScan, OWASP ZAP, Rapid7 InsightAppSecno first choiceagainst: Acunetix, Burp Suite, Nessus WAS, OWASP ZAP, Qualys Web Application Scanning
Five alternatives
Checkmarx DAST, Checkmarx One, HCL AppScan, Rapid7 InsightAppSec, Veracode DASTFour alternatives
Checkmarx DAST, HCL AppScan, Invicti, Rapid7 InsightAppSecSix alternatives
Aikido Security, Burp Suite Enterprise Edition, Checkmarx DAST, HCL AppScan, Qualys Web Application Scanning, Rapid7 InsightAppSecLlama 4 MaverickInvictiInvictiHeldno first choiceAstra Security, ImmuniWeb Neuronagainst: Burp Suite, Invictino first choiceagainst: OWASP ZAP
Four alternatives
Burp Suite DAST, Checkmarx DAST Scanner, OWASP ZAP, Veracode DASTQwen 3.7 FlashInvictiPortSwigger Burp Suite Enterprise EditionChangedInvictiInvictiagainst: Burp Suite, Checkmarx One, Micro Focusno first choiceagainst: Acunetix, Burp Suite, Invicti, Nuclei, OWASP ZAP, Qualys VMS, Tenable Nessus
Six alternatives
Checkmarx DAST, Escape, PortSwigger Burp Suite Enterprise, Qualys Web Application Scanning, Rapid7 InsightAppSec, StackHawkFour alternatives
Contrast Security, Invicti, Qualys Web Application Scanning, Tenable Vulnerability ManagementFive alternatives
Checkmarx DAST, HCL AppScan, PortSwigger Burp Suite Enterprise, Qualys Application Scan, Rapid7 InsightAppSecTwo alternatives
AppCheck NG, SnykKimi K2Invicti, Veracode DASTInvictiChangedagainst: Burp SuiteInvictiInvictiagainst: Burp Suite, Veracode DASTno first choiceagainst: Nikto, OWASP ZAP, Qualys DAST
Two alternatives
Burp Suite, HCL AppScanFour alternatives
Burp Suite, Qualys Web Application Scanning, Rapid7 InsightAppSec, Veracode DASTFive alternatives
Burp Suite Enterprise Edition, Checkmarx DAST, HCL AppScan, Qualys Web Application Scanning, Rapid7 InsightAppSecTwo alternatives
Qualys Web Application Scanning, StackHawkGLM 4.7 FlashXInvictiBurp Suite Enterprise EditionChangedBurp Suite, ImmuniWeb NeuronBurp Suite DASTagainst: Invictino first choiceagainst: Acunetix, Burp Suite, FuzzDB, Nessus (Tenable) – DAST add‑on, Netsparker, OWASP ZAP, Wapiti
Six alternatives
Bright Security, Burp Suite Enterprise Edition, Fortify WebInspect, HCL AppScan, Qualys Web Application Scanning, Rapid7 InsightAppSecThree alternatives
Bright Security, Checkmarx DAST, Veracode DASTOne alternative
Qualys Web Application ScanningMiniMax M2.5InvictiBurp Suite Enterprise Edition, InvictiChangedInvictiInvictiCheckmarx DAST, Invictiagainst: Burp Suite
Four alternatives
Checkmarx DAST, HCL AppScan, Rapid7 InsightAppSec, Veracode DASTTwo alternatives
Checkmarx DAST, Rapid7 InsightAppSecSix alternatives
Acunetix, Checkmarx One, HCL AppScan, PortSwigger Burp Suite Enterprise Edition, Qualys Web Application Scanning, Rapid7 InsightAppSecTwo alternatives
Detectify, PII ToolsTwo alternatives
Rapid7 InsightAppSec, StackHawkGPT-6 LunaBurp Suite DASTBurp Suite DASTHeldno first choiceBurp Suite DASTagainst: StackHawkno first choiceagainst: Arachni, Nikto, OWASP ZAP
One alternative
InvictiOne alternative
HCL AppScan 360°Seven alternatives
Burp Suite DAST, Checkmarx DAST, HCL AppScan, Invicti, Qualys Web Application Scanning, Rapid7 InsightAppSec, Veracode DASTOne alternative
InvictiMuse Glimmer 30BInvictiInvictiHeldagainst: AcunetixInvicti, NetsparkerEscape, Offensive360 DASTagainst: Burp Suite, Checkmarx DAST, Invicti, StackHawkno first choiceagainst: Acunetix, Burp Suite, Invicti, OWASP ZAP
One alternative
PortSwigger Burp Suite DASTOne alternative
Burp Suite Enterprise EditionFive alternatives
Acunetix, Burp Suite DAST, HCL AppScan, PortSwigger Burp Suite Enterprise, Qualys Web Application Scanning WASBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency.
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 19:07 | no | 0 | 5 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 08:40 | yes | 4 | 5 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 15:29 | no | 0 | 17 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-11-01 14:18 | yes | 10 | 4 s |
| Direct recommendation | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 13:51 | yes | 5 | 11 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 11:28 | yes | 5 | 4 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 12:09 | yes | 19 | 54 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 13:42 | yes | 5 | 4 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 17:50 | yes | 5 | 27 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 13:04 | yes | 10 | 39 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 09:32 | yes | 11 | 27 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 17:32 | yes | 5 | 32 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-11-01 11:32 | yes | 3 | 12 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 14:33 | yes | 25 | 24 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 16:56 | yes | 16 | 9 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 14:26 | yes | 2 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 11:53 | no | 0 | 16 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-11-01 13:06 | yes | 10 | 4 s |
| Paraphrase | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 19:19 | yes | 5 | 9 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 11:00 | yes | 5 | 5 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 11:41 | yes | 23 | 22 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 09:08 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 13:28 | no | 0 | 28 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 19:28 | yes | 19 | 23 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 18:50 | yes | 25 | 110 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:27 | yes | 5 | 26 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-11-01 18:56 | yes | 3 | 13 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 14:26 | yes | 14 | 22 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 11:19 | yes | 10 | 10 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 09:34 | yes | 6 | 10 s |
| Comparative | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 17:25 | yes | 9 | 29 s |
| Comparative | Perplexity Sonar | sonar | 2026-11-01 09:59 | yes | 10 | 7 s |
| Comparative | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:04 | yes | 5 | 13 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 12:33 | yes | 5 | 7 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 18:58 | yes | 23 | 46 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 11:55 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 10:35 | no | 0 | 30 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 13:13 | yes | 15 | 34 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 18:52 | yes | 25 | 36 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 11:25 | yes | 10 | 31 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:29 | yes | 8 | 30 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 17:48 | yes | 15 | 26 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 13:48 | yes | 14 | 9 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 17:14 | yes | 3 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 11:51 | yes | 12 | 19 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-11-01 14:49 | yes | 10 | 4 s |
| Budget constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 19:24 | yes | 9 | 10 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 12:18 | yes | 5 | 5 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 15:29 | yes | 25 | 25 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 15:02 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 18:52 | yes | 15 | 71 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 09:25 | yes | 19 | 68 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 11:29 | yes | 24 | 206 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 14:41 | yes | 9 | 56 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 11:53 | yes | 2 | 12 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 14:54 | yes | 20 | 33 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 11:45 | yes | 18 | 12 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 19:33 | no | 0 | 8 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 10:24 | no | 0 | 22 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-11-01 11:51 | yes | 10 | 8 s |
| Scale constrained | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 17:01 | yes | 10 | 21 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 10:12 | no | 0 | 8 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 17:42 | yes | 23 | 75 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 13:46 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 16:36 | yes | 10 | 28 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 10:13 | yes | 18 | 28 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 10:37 | yes | 19 | 30 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 19:18 | yes | 10 | 27 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-11-01 15:09 | yes | 2 | 22 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 19:06 | yes | 13 | 25 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-11-01 16:46 | yes | 20 | 11 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-11-01 16:36 | no | 0 | 5 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.6-flash (asked for gemini-3.5-flash; the API answered as this version) | 2026-11-01 09:22 | yes | 11 | 26 s |
| Negative framing | Perplexity Sonar | sonar | 2026-11-01 11:00 | yes | 10 | 6 s |
| Negative framing | Grok 4.20 | spacexai/grok-4.20-non-reasoning via xai | 2026-11-01 14:56 | yes | 14 | 15 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-11-01 16:59 | yes | 18 | 12 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-11-01 17:25 | yes | 22 | 45 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-11-01 18:34 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-11-01 17:45 | yes | 24 | 62 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-11-01 19:11 | yes | 24 | 44 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-11-01 14:06 | yes | 13 | 37 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-11-01 17:29 | yes | 16 | 51 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-11-01 13:28 | yes | 6 | 18 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-11-01 18:58 | yes | 23 | 28 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Aikido read as Aikido Security
Astra read as Astra Security
Checkmarx read as Checkmarx One
ImmuniWeb read as ImmuniWeb Neuron
Qualys WAS read as Qualys Web Application Scanning
Qualys WAS (Web Application Scanner) read as Qualys Web Application Scanning
Qualys Web App Scanning read as Qualys Web Application Scanning
Rapid7 read as Rapid7 InsightAppSec
Veracode read as Veracode DAST
Veracode Dynamic Analysis read as Veracode DAST
Unresolved, counted raw
AppCheck NG
Burp
Burp Enterprise
Checkmarx DAST Scanner
FuzzDB
Grabber
HCL AppScan 360°
NTT Application Security (formerly WhiteHat)
Nessus (Tenable) – DAST add‑on
Nessus WAS
Offensive360 DAST
OpenText Dynamic Application Security Testing
PII Tools
Pentest-Tools
PortSwigger (Burp Suite Enterprise)
PortSwigger Burp Suite DAST
Qualys Application Scan
Qualys VMS (Web Module)
Qualys Web Application Scanning WAS
Rapid7 AppSpider
Truvo Cyber
Discontinued, still offered
No shut-down product was recommended here.