# Dynamic application security testing for small business buyers: what AI models recommend, November 2026

Gane Index, November 2026 Edition. Asked as "DAST tool" and as "dynamic web application security scanner", six framings each, to fourteen models with search on, on behalf of a small B2B company. Added to the November 2026 Edition. Page: https://www.gane.ai/index/it/developer/dynamic-application-security-testing/smb

**Standing:** OWASP ZAP leads with 51% of first choices; verdict clear leader. 53 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [OWASP ZAP](https://www.gane.ai/index/it/vendors/owasp-zap/index.md) | 51% | 9% | 75 |
| 2 | [Intruder](https://www.gane.ai/index/it/vendors/intruder/index.md) | 17% | 0% | 39 |
| 3 | [StackHawk](https://www.gane.ai/index/it/vendors/stackhawk/index.md) | 13% | 2% | 49 |
| 4 | [Acunetix](https://www.gane.ai/index/it/vendors/acunetix/index.md) | 8% | 47% | 34 |
| 5 | [Probely](https://www.gane.ai/index/it/vendors/probely/index.md) | 4% | 0% | 17 |
| 6 | [Detectify](https://www.gane.ai/index/it/vendors/detectify/index.md) | 2% | 0% | 17 |
| 7 | [Nuclei](https://www.gane.ai/index/it/vendors/nuclei/index.md) | 2% | 7% | 14 |
| 12 | [Aikido Security](https://www.gane.ai/index/it/vendors/aikido-security/index.md) | 0% | 20% | 10 |
| 13 | [Astra Security](https://www.gane.ai/index/it/vendors/astra-security/index.md) | 0% | 20% | 10 |
| 15 | [Burp Suite](https://www.gane.ai/index/it/vendors/burp-suite/index.md) | 0% | 38% | 37 |
| 43 | [Invicti](https://www.gane.ai/index/it/vendors/invicti/index.md) | 0% | 43% | 37 |
| 57 | [Rapid7 InsightAppSec](https://www.gane.ai/index/it/vendors/rapid7-insightappsec/index.md) | 0% | 69% | 13 |

Rank is by share of first choices among all 58 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Acunetix; alternatives HCL AppScan, Intruder, OWASP ZAP
- GPT-5.4 mini: Acunetix; alternatives OWASP ZAP
- Gemini 3.5 Flash: StackHawk; alternatives Nuclei, OWASP ZAP, Probely
- Perplexity Sonar: OWASP ZAP; alternatives Aikido Security, Detectify, Intruder, StackHawk
- Grok 4.20: Intruder; alternatives Aikido Security, Astra Security, Detectify, Probely
- Mistral Small: OWASP ZAP; alternatives Intruder, StackHawk
- DeepSeek V4 Flash: Intruder; alternatives OWASP ZAP, StackHawk
- Llama 4 Maverick: OWASP ZAP; alternatives Aikido Security, Intruder
- Qwen 3.7 Flash: Intruder; alternatives OWASP ZAP, SOOS, StackHawk
- Kimi K2: OWASP ZAP; alternatives Intruder, Probely, StackHawk
- GLM 4.7 FlashX: Intruder; alternatives Astra Security, Burp Suite, Detectify, OWASP ZAP
- MiniMax M2.5: OWASP ZAP; alternatives Acunetix, Beagle Security, Invicti
- GPT-6 Luna: StackHawk; alternatives OWASP ZAP
- Muse Glimmer 30B: Intruder, OWASP ZAP; alternatives StackHawk

## Sources the answers cite

72 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- safeguard.sh: 45 answers, 75 citations
- softwaretestinghelp.com: 34 answers, 35 citations
- securityboulevard.com: 22 answers, 29 citations
- comparitech.com: 22 answers, 23 citations
- gane.ai/index: 22 answers, 23 citations
- aimultiple.com: 20 answers, 26 citations
- g2.com: 19 answers, 34 citations
- thectoclub.com: 19 answers, 19 citations

Pages named in the most answers:

- https://softwaretestinghelp.com/dynamic-application-security-testing-dast-software (34 answers)
- https://safeguard.sh/resources/blog/best-dast-tools-for-web-application-security-testing (32 answers)
- https://comparitech.com/net-admin/dast-tools (22 answers)
- https://gane.ai/index/it/developer/dynamic-application-security-testing/smb (22 answers)
- https://safeguard.sh/resources/blog/dast-tools-list (22 answers)
- https://securityboulevard.com/2026/04/dast-tools-complete-buyers-guide-10-solutions-to-know-in-2026 (19 answers)
- https://thectoclub.com/tools/best-dast-tools (19 answers)
- https://geekflare.com/cybersecurity/best-dast-scanners (17 answers)
- https://aimultiple.com/dast-tools (14 answers)
- https://checkmarx.com/learn/dast/dast-tools-key-features-and-12-solutions-to-know-in-2026 (13 answers)

## Warned against

- Burp Suite: 14 of 37 labels negative. "Starts at ~$5,000/year and scales significantly with crawl concurrency... "generally out of reach for most small businesses."" (GLM 4.7 FlashX, negative prompt)
- Invicti: 16 of 37 labels negative. "Enterprise-focused with quote-based pricing; best suited for large organizations with 300+ apps. Strong negative sentiment" (GLM 4.7 FlashX, negative prompt)
- Acunetix: 16 of 34 labels negative. "enterprise-grade with pricing that often requires custom quotes and scales poorly for small portfolios" (Grok 4.20, negative prompt)
- HCL AppScan: 9 of 10 labels negative. "Legacy Enterprise "Heavyweights" ... Why to be cautious: Cost: Annual licensing frequently runs tens of thousands of dollars per application" (Gemini 3.5 Flash, negative prompt)

## Movement since October 2026

Floor: 11 points of share, measured on the calibration repeat.
Same leader: OWASP ZAP at 51%.

- OWASP ZAP: 43% to 51%, +8. Inside the floor by 3 points · rank 1 of 58, unchanged.
- Invicti: 5% to 0%, −5. Inside the floor by 6 points · rank 5 → 43 of 58.
- Probely: 0% to 4%, +4. Inside the floor by 7 points · rank 16 → 5 of 58.
- Astra Security: 4% to 0%, −4. Inside the floor by 7 points · rank 6 → 13 of 58.
- Nuclei: 0% to 2%, +2. Inside the floor by 9 points · rank 12 → 7 of 58.
- Intruder: 16% to 17%, +1. Inside the floor by 10 points · rank 2 of 58, unchanged.
- StackHawk: 12% to 13%, +1. Inside the floor by 10 points · rank 3 of 58, unchanged.
- Acunetix: 9% to 8%, −1. Inside the floor by 10 points · rank 4 of 58, unchanged.
- Detectify: 2% to 2%, ±0. Inside the floor by 11 points · rank 8 → 6 of 58.
- Beagle Security: 0% to 0%, ±0. Inside the floor by 11 points · rank 13 → 11 of 58.
- Aikido Security: 0% to 0%, ±0. Inside the floor by 11 points · rank 14 → 12 of 58.
- Burp Suite: 0% to 0%, ±0. Inside the floor by 11 points · rank 19 → 15 of 58.

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.