# Dynamic application security testing for enterprise buyers: what AI models recommend, October 2026

IT AI Recommendation Index, October 2026 Edition. Asked as "DAST tool" and as "dynamic web application security scanner", six framings each, to fourteen models with search on, on behalf of an enterprise B2B company. Added to the October 2026 Edition on October 4, 2026; its answers are read by the distilled judge (ai-indexes-judge-qwen3-14b-run3), not the claude-opus-5 judge of the earlier categories. Page: https://it-ai-index.com/developer/dynamic-application-security-testing/enterprise/

**Standing:** Invicti leads with 62% of first choices; verdict clear leader. 52 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | Invicti | 62% | 10% | 63 |
| 2 | Burp Suite DAST | 12% | 0% | 12 |
| 3 | Veracode DAST | 4% | 14% | 36 |
| 4 | HCL AppScan | 4% | 14% | 28 |
| 5 | Burp Suite | 4% | 52% | 23 |
| 6 | Rapid7 InsightAppSec | 2% | 7% | 28 |
| 7 | Burp Suite Enterprise Edition | 2% | 0% | 12 |
| 8 | Checkmarx One | 2% | 21% | 19 |
| 9 | StackHawk | 2% | 25% | 16 |
| 10 | Acunetix | 2% | 35% | 23 |
| 11 | Checkmarx DAST | 0% | 5% | 20 |
| 12 | OpenText Fortify WebInspect | 0% | 0% | 10 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Burp Suite DAST, Invicti; alternatives Acunetix, OX Security, StackHawk
- GPT-5.4 mini: Invicti; alternatives Burp Suite Enterprise Edition
- Gemini 3.5 Flash: Invicti; alternatives Burp Suite Enterprise Edition, Escape, StackHawk, Veracode DAST
- Perplexity Sonar: Invicti; alternatives Checkmarx DAST, Veracode DAST
- Grok 4.1 Fast: Invicti; alternatives Burp Suite Enterprise Edition, Checkmarx DAST
- Mistral Small: Invicti; alternatives Acunetix, Bright Security, Burp Suite, Rapid7 InsightAppSec
- DeepSeek V4 Flash: Invicti; alternatives Burp Suite, Checkmarx One, Veracode DAST
- Llama 4 Maverick: no first choice
- Qwen 3.7 Flash: Checkmarx One, Veracode DAST; alternatives Contrast Security, Invicti, PortSwigger Burp Suite Enterprise, Rapid7 InsightAppSec
- Kimi K2: Invicti; alternatives Burp Suite, HCL AppScan
- GLM 4.7 FlashX: Burp Suite, Invicti; alternatives HCL AppScan
- MiniMax M2.5: Aikido Security, Invicti; alternatives InsightAppSec
- GPT-6 Luna: Burp Suite DAST; alternatives Invicti, OWASP ZAP
- Muse Glimmer 30B: Invicti; alternatives Acunetix, PortSwigger Burp Suite Enterprise, Veracode DAST

## Sources the answers cite

77 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- invicti.com: 52 answers, 113 citations
- augmentcode.com: 49 answers, 51 citations
- getastra.com: 41 answers, 45 citations
- aikido.dev: 40 answers, 51 citations
- beaglesecurity.com: 32 answers, 46 citations
- stackhawk.com: 32 answers, 36 citations
- checkmarx.com: 29 answers, 39 citations
- appsecsanta.com: 28 answers, 29 citations

Pages named in the most answers:

- https://augmentcode.com/tools/best-dast-tools-for-enterprise-security (49 answers)
- https://invicti.com/blog/web-security/best-enterprise-dast-tools-for-large-enterprises-buyers-guide (40 answers)
- https://getastra.com/blog/dast/tools (39 answers)
- https://stackhawk.com/blog/dynamic-application-security-testing-tools-comparison (29 answers)
- https://aikido.dev/blog/top-dynamic-application-security-testing-dast-tools (25 answers)
- https://aikido.dev/blog/top-enterprise-dast-tools (23 answers)
- https://aimultiple.com/dast-tools (23 answers)
- https://cyberpress.org/dast-tools-by-use-case (19 answers)
- https://softwaretestinghelp.com/dynamic-application-security-testing-dast-software (19 answers)
- https://appsecsanta.com/dast-tools (17 answers)

## Warned against

- Burp Suite: 12 of 23 labels negative. "Per-user pricing ($49k/year for enterprise edition caps at 1,000 users) — becomes extremely costly at thousands of users" (DeepSeek V4 Flash, budget prompt)
- OWASP ZAP: 16 of 21 labels negative. "OWASP ZAP (Unmanaged) ... often inadequate as the *sole* solution for enterprise-wide automated testing" (Qwen 3.7 Flash, negative prompt)
- Invicti: 6 of 63 labels negative. "Claims 99.98% accuracy, but independent benchmarks measured 23% false-positive rate — the highest among tested enterprise tools" (Kimi K2, negative prompt)
- Acunetix: 8 of 23 labels negative. "Older generations of Acunetix or AppScan (prior to major JS engine upgrades) ... Traditional DAST tools often fail to render JavaScript" (Qwen 3.7 Flash, negative prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, October 2026 Edition, it-ai-index.com.