Dynamic application security testing
Asked as “DAST tool”, and as “dynamic web application security scanner”, on behalf of a mid-market B2B company. 51 first choices recorded across the direct, paraphrase, budget and scale prompts, fourteen models each. Added to the October 2026 Edition on October 4, 2026; its answers are read by the distilled judge (ai-indexes-judge-qwen3-14b-run3), not the claude-opus-5 judge of the earlier categories: how the two compare.
Standing · first-choice share
29%
Contested · Invicti 20%
29OWASP ZAP20Invicti12Acunetix39others
29% of first choices, contested.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all fourteen models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrantSince September 2026
Show the three products at 0%, ordered by negative rate
11
Rapid7 InsightAppSec0%16%19accepted challengernewNew since September 2026: not ranked then, 0% now.
Rapid7 InsightAppSec0%16%19accepted challengernewNew since September 2026: not ranked then, 0% now.The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
All twenty-eight head-to-head pages: the top eight products, each against each
OWASP ZAP vs Bright SecurityOWASP ZAP vs IntruderOWASP ZAP vs Burp SuiteOWASP ZAP vs Aikido SecurityInvicti vs AcunetixInvicti vs StackHawkInvicti vs Bright SecurityInvicti vs IntruderInvicti vs Burp SuiteInvicti vs Aikido SecurityAcunetix vs StackHawkAcunetix vs Bright SecurityAcunetix vs IntruderAcunetix vs Burp SuiteAcunetix vs Aikido SecurityStackHawk vs Bright SecurityStackHawk vs IntruderStackHawk vs Burp SuiteStackHawk vs Aikido SecurityBright Security vs IntruderBright Security vs Burp SuiteBright Security vs Aikido SecurityIntruder vs Burp SuiteIntruder vs Aikido SecurityBurp Suite vs Aikido Security
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
01
02
03
04B05
06B07
08
09
1011Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01OWASP ZAP29%
OWASP ZAP29%02Invicti20%
Invicti20%03Acunetix12%
Acunetix12%04StackHawk8%
StackHawk8%05Bright Security8%
06Intruder6%
Intruder6%07Burp Suite2%
08Aikido Security2%
Aikido Security2%09Checkmarx DAST0%
Checkmarx DAST0%10Astra Security0%
Astra Security0%11Rapid7 InsightAppSec0%
Rapid7 InsightAppSec0%What they warned about
Zero of fourteen models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX, MiniMax M2.5, GPT-6 Luna and Muse Glimmer 30B changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
OWASP ZAP30%
16 of 54 labels negative · 10 of 14 models · 1 hard negative
“**The Verdict:** **Avoid for CI/CD pipelines.** Use only if you have dedicated in-house pentesters.” GLM 4.7 FlashX, negative prompt
Burp Suite
18%
8 of 45 labels negative · 7 of 14 models · 1 hard negative
“**The Verdict:** **Avoid for automated scanning.** Use only for manual penetration testing.” GLM 4.7 FlashX, negative prompt
Acunetix13%
5 of 39 labels negative · 5 of 14 models
“excellent for complex web applications with 12,000+ vulnerability types, but has a premium price and potential for false positives” Claude Haiku 4.5, comparative prompt
Arachni
80%
4 of 5 labels negative · 4 of 14 models · 4 hard negative
“the project is entirely discontinued... Why avoid: Its embedded Ruby environment and browser engines are severely outdated.” Gemini 3.5 Flash, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the fourteen in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
78 of 84 answers in this category came back with a source list, from 14 of 14 models: citations where the model returns them, or the search results it consulted. 961 links across 170 sites, every framing counted. Ranked by the number of answers carrying the site or page. None of the 252 answers across every segment cited this index's own page for the category.
44 answers · 53 citations · 12 models
vendor site · Aikido34 answers · 41 citations · 11 models
vendor site · Beagle Security33 answers · 51 citations · 11 models
vendor site · StackHawk30 answers · 38 citations · 12 models
30 answers · 30 citations · 11 models
vendor site · Escape29 answers · 35 citations · 11 models
27 answers · 32 citations · 10 models
vendor site · Checkmarx26 answers · 34 citations · 10 models
vendor site · Invicti25 answers · 40 citations · 11 models
23 answers · 32 citations · 12 models
vendor site · Augment Code23 answers · 24 citations · 9 models
23 answers · 23 citations · 11 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
43 answers · 12 models
30 answers · 11 models
27 answers · 9 models
26 answers · 12 models
23 answers · 9 models
23 answers · 7 models
23 answers · 11 models
21 answers · 8 models
19 answers · 9 models
19 answers · 11 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best dast tool”, “dast tool”, “dast tools”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Paid search a month, est. | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|---|
| OWASP ZAP owasp.org | 29% | 177 | 3,600 | 122 | 365,222 | 1 | ||
| Invicti invicti.com | 20% | 137 | 90,500 | 83 | 54,568 | $50 | 24 | |
| Acunetix acunetix.com | 12% | 113 | 880 | 43 | 15,291 | 10 | ||
| StackHawk stackhawk.com | 8% | 142 | 590 | 10 | 8,458 | 8 | 6 | |
| Bright Security | 8% | 170 | 9 | |||||
| Intruder intruder.io | 6% | 231 | 27,100 | 8,557 | 49,562 | 43 | ||
| Burp Suite Enterprise Edition | 6% | 30 | 1 | |||||
| Burp Suite DAST | 4% | 170 | 13 | |||||
| Burp Suite | 2% | 12,100 | 681 | |||||
| Aikido aikido.dev Aikido Security 2% | 2% | 342 | 2,400 | 51 | 6,442 company | $936 | 120 |
Google's top ten for the three searches hold 21 sites; 4 of them are among the sites the models cited here (checkmarx.com, escape.tech, getautonoma.com, stackhawk.com). The first result for “best dast tool” is snyk.io.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best DAST tool for a mid-market B2B company?”Paraphrase“Which dynamic web application security scanner would you recommend to a mid-sized B2B company?”Comparative“What are the top DAST tools and how do they differ?”Budget-constrained“What is the best DAST tool for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a DAST tool. What should we look at?”Negative“Which DAST tools should I avoid or be cautious about?”
Claude Haiku 4.5InvictiAcunetixChangedno first choiceagainst: Acunetix, Burp Suite, Checkmarx One, OWASP ZAP, Veracode DASTOWASP ZAPno first choiceagainst: Burp Suite, Checkmarx One, Invicti, OWASP ZAP
Four alternatives
Acunetix, Intruder, OWASP ZAP, Rapid7 InsightAppSecThree alternatives
Bright Security, HCL AppScan, StackHawkOne alternative
StackHawkFour alternatives
Acunetix, Burp Suite, Nikto, w3afGPT-5.4 miniAcunetix, Invictiagainst: OWASP ZAPBurp SuiteChangedagainst: Tenable Nessus Expert with Web Application ScanningBurp Suite DASTOWASP ZAPagainst: StackHawkno first choicenothing named
One alternative
Burp SuiteOne alternative
OWASP ZAPThree alternatives
Burp Suite, Invicti, OWASP ZAPOne alternative
Burp SuiteGemini 3.5 FlashEscapeInvictiChangedno first choiceOWASP ZAPno first choiceagainst: Arachni, Fortify WebInspect, HCL AppScan, Nikto, Qualys WAS, w3af
Three alternatives
Astra Security, Invicti, StackHawkThree alternatives
Astra Security, Burp Suite Enterprise Edition, StackHawkEight alternatives
Astra Security, Black Duck Continuous Dynamic, Burp Suite, Checkmarx DAST, Escape, Invicti, OWASP ZAP, StackHawkThree alternatives
Aikido Security, Burp Suite, StackHawkPerplexity SonarBright SecurityAcunetixChangedagainst: OWASP ZAPInvictiOWASP ZAPagainst: Nucleino first choiceagainst: OWASP ZAP
Four alternatives
Acunetix, Beagle Security, Detectify, IntruderOne alternative
InvictiSeven alternatives
Acunetix, Burp Suite, Checkmarx DAST, IBM AppScan, OWASP ZAP, OpenText Fortify WebInspect, StackHawkTwo alternatives
Astra Security, Intruder Developer editionGrok 4.1 FastIntruderagainst: OWASP ZAPBurp Suite DASTChangedagainst: InvictiInvictiOWASP ZAPInvicti, StackHawkagainst: Acunetix, Astra Security, Burp Suite, OWASP ZAP
Two alternatives
Acunetix, Astra SecurityFour alternatives
Acunetix, Astra Security, OWASP ZAP, StackHawkFive alternatives
Acunetix, Burp Suite, Checkmarx One, OWASP ZAP, Veracode DASTFour alternatives
Burp Suite, Dastardly, Nuclei, StackHawkOne alternative
Checkmarx DASTMistral SmallBurp Suite Enterprise Edition, IntruderAikido Security, Burp Suite Enterprise EditionChangedInvictiOWASP ZAPno first choiceagainst: OWASP ZAP
One alternative
Aikido SecurityTwo alternatives
AppCheck, Bright SecurityFour alternatives
Aikido Security, Beagle Security, Burp Suite, StackHawkOne alternative
Burp SuiteDeepSeek V4 FlashStackHawkBright SecurityChangedno first choiceOWASP ZAPInvictiagainst: Burp Suite, OWASP ZAPagainst: Acunetix, Arachni, HCL AppScan, Nikto, OWASP ZAP, Qualys WAS, Skipfish, w3af
Three alternatives
Escape, Intruder, InvictiThree alternatives
Acunetix, Detectify, InvictiTen alternatives
Acunetix, Bright Security, Burp Suite, Detectify, Intruder, Invicti, OWASP ZAP, Qualys Web Application Scanning, Rapid7 InsightAppSec, StackHawkTwo alternatives
Intruder, StackHawkFour alternatives
Checkmarx DAST, HCL AppScan, Rapid7 InsightAppSec, Veracode DASTLlama 4 MaverickBurp Suite Enterprise EditionAppCheckChangedno first choiceOWASP ZAPno first choiceagainst: OWASP ZAP
Three alternatives
Aikido Security, AppCheck, IntruderTwo alternatives
Acunetix, OpenText FortifyOne alternative
DetectifyQwen 3.7 FlashIntruderAcunetixChangedBurp SuiteOWASP ZAPagainst: Burp Suite, HCL AppScan, Rapid7 InsightAppSecno first choiceagainst: Acunetix, AppScan, Arachni, Nikto, OWASP ZAP, Qualys Web Application Scanning, Tenable.io DAST, w3af
Three alternatives
Acunetix, Aikido Security, InvictiThree alternatives
AppCheck, OWASP ZAP, PortSwigger Burp Suite EnterpriseSix alternatives
Acunetix, Astra Security, Beagle Security, Invicti, OWASP ZAP, Qualys Web Application ScanningOne alternative
NucleiKimi K2Bright Security, StackHawkagainst: Checkmarx One, OWASP ZAP, Veracode DASTInvictiChangedagainst: OWASP ZAPInvictiOWASP ZAPno first choiceagainst: Burp Suite, HCL AppScan, OWASP ZAP, Qualys WAS, Rapid7 InsightAppSec
Two alternatives
Acunetix, InvictiOne alternative
Burp SuiteFour alternatives
Burp Suite, OWASP ZAP, Qualys WAS, StackHawkFour alternatives
Aikido Security, Burp Suite, Nuclei, WapitiGLM 4.7 FlashXStackHawkOWASP ZAPChangedBurp Suite, OWASP ZAPOWASP ZAPno first choiceagainst: Acunetix, Burp Suite, OWASP ZAP, Tenable Nessus
Two alternatives
OWASP ZAP, Rapid7 InsightAppSecThree alternatives
Acunetix, Burp Suite, Qualys Web Application ScanningSeven alternatives
Acunetix, Checkmarx DAST, Contrast Security, Invicti, Qualys Web Application Scanning, StackHawk, Tenable.io Web App ScanningThree alternatives
Burp Suite, Detectify, IntruderMiniMax M2.5InvictiAcunetix, Bright SecurityChangedBurp Suite, InvictiOWASP ZAPno first choicenothing named
Five alternatives
Acunetix, Aikido Security, Burp Suite, OWASP ZAP, Rapid7 InsightAppSecTwo alternatives
Burp Suite, IntruderSix alternatives
Aikido Security, Nuclei, OWASP ZAP, Qualys WAS, StackHawk, Veracode DASTOne alternative
Burp SuiteGPT-6 LunaInvictiBurp Suite DASTChangedno first choiceOWASP ZAPno first choiceagainst: Arachni, Nikto, Nuclei
Two alternatives
Burp Suite DAST, StackHawkTwo alternatives
Invicti, OWASP ZAPSix alternatives
Burp Suite DAST, Invicti, OWASP ZAP, Qualys WAS, Rapid7 InsightAppSec, StackHawkMuse Glimmer 30BInvictiAcunetix, InvictiChangedno first choiceOWASP ZAPagainst: Burp Suiteno first choiceagainst: Qualys DAST, Rapid7 InsightAppSec
Three alternatives
Acunetix, Burp Suite, OWASP ZAPOne alternative
Burp SuiteSix alternatives
Acunetix, Burp Suite, Checkmarx DAST, Invicti, OWASP ZAP, StackHawkFour alternatives
Dastardly, Nikto, Nuclei, WapitiBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Eighty-four rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 00:46 | yes | 9 | 9 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:22 | yes | 5 | 6 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 00:20 | yes | 17 | 30 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-05 01:27 | yes | 21 | 4 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-04 23:53 | yes | 21 | 11 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-04 23:10 | yes | 5 | 4 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 00:43 | yes | 22 | 24 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:42 | yes | 5 | 4 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-04 22:15 | yes | 12 | 51 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-04 23:11 | yes | 11 | 20 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 23:33 | yes | 7 | 61 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 01:41 | yes | 13 | 24 s |
| Direct recommendation | GPT-6 Luna | gpt-6-luna | 2026-10-05 01:27 | yes | 3 | 19 s |
| Direct recommendation | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-05 01:24 | yes | 13 | 20 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-04 23:52 | yes | 9 | 8 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-04 23:55 | yes | 3 | 4 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 00:54 | yes | 11 | 24 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-04 23:17 | yes | 21 | 3 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-04 22:57 | yes | 21 | 8 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 00:57 | yes | 9 | 5 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 01:43 | yes | 22 | 18 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-04 23:53 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 00:57 | yes | 5 | 20 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 00:27 | yes | 19 | 19 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-05 00:45 | yes | 20 | 24 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 22:45 | yes | 8 | 36 s |
| Paraphrase | GPT-6 Luna | gpt-6-luna | 2026-10-04 23:46 | yes | 3 | 18 s |
| Paraphrase | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-04 22:54 | yes | 12 | 15 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-04 23:36 | yes | 10 | 9 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-04 23:05 | yes | 6 | 6 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-04 23:51 | yes | 19 | 30 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-05 00:06 | yes | 21 | 7 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 01:02 | yes | 22 | 10 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 01:35 | yes | 7 | 7 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-04 22:28 | yes | 23 | 49 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:42 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 00:51 | yes | 5 | 19 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 00:07 | yes | 15 | 27 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-05 00:06 | yes | 23 | 28 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 22:14 | yes | 11 | 27 s |
| Comparative | GPT-6 Luna | gpt-6-luna | 2026-10-05 01:26 | yes | 7 | 38 s |
| Comparative | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-05 00:00 | yes | 13 | 26 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 01:46 | no | 0 | 4 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-04 22:57 | yes | 2 | 4 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 01:16 | yes | 12 | 26 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-05 01:13 | yes | 36 | 3 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-04 23:35 | yes | 14 | 5 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 01:39 | yes | 5 | 4 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 01:29 | yes | 17 | 37 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 00:52 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 00:52 | yes | 5 | 18 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-04 22:20 | yes | 13 | 18 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 22:51 | yes | 15 | 29 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 23:50 | yes | 5 | 48 s |
| Budget constrained | GPT-6 Luna | gpt-6-luna | 2026-10-04 23:55 | yes | 2 | 10 s |
| Budget constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-05 01:35 | yes | 14 | 19 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-04 22:36 | no | 0 | 6 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:38 | no | 0 | 7 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 01:15 | no | 0 | 17 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-04 22:15 | yes | 20 | 3 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-04 23:07 | yes | 19 | 11 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-04 22:28 | no | 0 | 7 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 01:11 | yes | 17 | 46 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-04 22:11 | yes | 5 | 2 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 00:20 | no | 0 | 28 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-04 23:31 | yes | 14 | 18 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-05 01:27 | yes | 8 | 16 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 23:37 | yes | 5 | 17 s |
| Scale constrained | GPT-6 Luna | gpt-6-luna | 2026-10-05 00:01 | yes | 1 | 17 s |
| Scale constrained | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-05 01:05 | yes | 14 | 26 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 01:12 | yes | 17 | 9 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:18 | yes | 4 | 7 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 01:40 | yes | 14 | 22 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-04 22:10 | yes | 17 | 3 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 00:02 | yes | 19 | 11 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 01:22 | yes | 5 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 01:36 | yes | 22 | 66 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 00:42 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-04 22:28 | yes | 7 | 31 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-04 22:49 | yes | 24 | 28 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 22:48 | yes | 21 | 46 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 01:09 | yes | 14 | 19 s |
| Negative framing | GPT-6 Luna | gpt-6-luna | 2026-10-05 01:46 | yes | 3 | 18 s |
| Negative framing | Muse Glimmer 30B | meta/muse-glimmer-30b via togetherai | 2026-10-04 23:57 | yes | 22 | 29 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
Aikido read as Aikido Security
Astra read as Astra Security
Checkmarx read as Checkmarx One
OpenText WebInspect read as OpenText Fortify WebInspect
Qualys read as Qualys Web Application Scanning
Qualys Web App Scanning read as Qualys Web Application Scanning
Rapid7 read as Rapid7 InsightAppSec
Veracode read as Veracode DAST
Unresolved, counted raw
Acu
Checkmarx Protect
Checkmarx XPA
IBM AppScan
Indusface WAS
Intruder Developer edition
PortSwigger Cloud
Qualys DAST
Tenable Nessus Expert with Web Application Scanning
Tenable.io DAST
Tenable.io Web App Scanning
Discontinued, still offered
No shut-down product was recommended here.