# Dynamic application security testing: what AI models recommend, October 2026

IT AI Recommendation Index, October 2026 Edition. Asked as "DAST tool" and as "dynamic web application security scanner", six framings each, to fourteen models with search on, on behalf of a mid-market B2B company. Added to the October 2026 Edition on October 4, 2026; its answers are read by the distilled judge (ai-indexes-judge-qwen3-14b-run3), not the claude-opus-5 judge of the earlier categories. Page: https://it-ai-index.com/developer/dynamic-application-security-testing/

**Standing:** OWASP ZAP leads with 29% of first choices; verdict contested. 51 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | OWASP ZAP | 29% | 30% | 54 |
| 2 | Invicti | 20% | 5% | 43 |
| 3 | Acunetix | 12% | 13% | 39 |
| 4 | StackHawk | 8% | 3% | 30 |
| 5 | Bright Security | 8% | 0% | 11 |
| 6 | Intruder | 6% | 0% | 13 |
| 7 | Burp Suite | 2% | 18% | 45 |
| 8 | Aikido Security | 2% | 0% | 11 |
| 9 | Checkmarx DAST | 0% | 0% | 11 |
| 10 | Astra Security | 0% | 8% | 12 |
| 11 | Rapid7 InsightAppSec | 0% | 16% | 19 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Invicti; alternatives Acunetix, Intruder, OWASP ZAP, Rapid7 InsightAppSec
- GPT-5.4 mini: Acunetix, Invicti; alternatives Burp Suite
- Gemini 3.5 Flash: Escape; alternatives Astra Security, Invicti, StackHawk
- Perplexity Sonar: Bright Security; alternatives Acunetix, Beagle Security, Detectify, Intruder
- Grok 4.1 Fast: Intruder; alternatives Acunetix, Astra Security
- Mistral Small: Burp Suite Enterprise Edition, Intruder; alternatives Aikido Security
- DeepSeek V4 Flash: StackHawk; alternatives Escape, Intruder, Invicti
- Llama 4 Maverick: Burp Suite Enterprise Edition; alternatives Aikido Security, AppCheck, Intruder
- Qwen 3.7 Flash: Intruder; alternatives Acunetix, Aikido Security, Invicti
- Kimi K2: Bright Security, StackHawk; alternatives Acunetix, Invicti
- GLM 4.7 FlashX: StackHawk; alternatives OWASP ZAP, Rapid7 InsightAppSec
- MiniMax M2.5: Invicti; alternatives Acunetix, Aikido Security, Burp Suite, OWASP ZAP
- GPT-6 Luna: Invicti; alternatives Burp Suite DAST, StackHawk
- Muse Glimmer 30B: Invicti; alternatives Acunetix, Burp Suite, OWASP ZAP

## Sources the answers cite

78 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- getastra.com: 44 answers, 53 citations
- aikido.dev: 34 answers, 41 citations
- beaglesecurity.com: 33 answers, 51 citations
- stackhawk.com: 30 answers, 38 citations
- aimultiple.com: 30 answers, 30 citations
- escape.tech: 29 answers, 35 citations
- securityboulevard.com: 27 answers, 32 citations
- checkmarx.com: 26 answers, 34 citations

Pages named in the most answers:

- https://getastra.com/blog/dast/tools (43 answers)
- https://aikido.dev/blog/top-dynamic-application-security-testing-dast-tools (30 answers)
- https://aimultiple.com/dast-tools (27 answers)
- https://stackhawk.com/blog/dynamic-application-security-testing-tools-comparison (26 answers)
- https://augmentcode.com/tools/best-dast-tools-for-enterprise-security (23 answers)
- https://beaglesecurity.com/blog/article/best-dast-tools.html (23 answers)
- https://getautonoma.com/blog/dast-tools (23 answers)
- https://checkmarx.com/learn/dast/dast-tools-key-features-and-12-solutions-to-know-in-2026 (21 answers)
- https://cyberpress.org/dast-tools-by-use-case (19 answers)
- https://expertinsights.com/application-security/the-top-dynamic-application-security-testing-dast-tools (19 answers)

## Warned against

- OWASP ZAP: 16 of 54 labels negative. "The Verdict: Avoid for CI/CD pipelines. Use only if you have dedicated in-house pentesters." (GLM 4.7 FlashX, negative prompt)
- Burp Suite: 8 of 45 labels negative. "The Verdict: Avoid for automated scanning. Use only for manual penetration testing." (GLM 4.7 FlashX, negative prompt)
- Acunetix: 5 of 39 labels negative. "excellent for complex web applications with 12,000+ vulnerability types, but has a premium price and potential for false positives" (Claude Haiku 4.5, comparative prompt)
- Arachni: 4 of 5 labels negative. "the project is entirely discontinued... Why avoid: Its embedded Ruby environment and browser engines are severely outdated." (Gemini 3.5 Flash, negative prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, October 2026 Edition, it-ai-index.com.