# Dynamic application security testing for small business buyers: what AI models recommend, October 2026

IT AI Recommendation Index, October 2026 Edition. Asked as "DAST tool" and as "dynamic web application security scanner", six framings each, to fourteen models with search on, on behalf of a small B2B company. Added to the October 2026 Edition on October 4, 2026; its answers are read by the distilled judge (ai-indexes-judge-qwen3-14b-run3), not the claude-opus-5 judge of the earlier categories. Page: https://it-ai-index.com/developer/dynamic-application-security-testing/smb/

**Standing:** OWASP ZAP leads with 43% of first choices; verdict clear leader. 56 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | OWASP ZAP | 43% | 17% | 70 |
| 2 | Intruder | 16% | 3% | 34 |
| 3 | StackHawk | 12% | 2% | 46 |
| 4 | Acunetix | 9% | 12% | 40 |
| 5 | Invicti | 5% | 43% | 28 |
| 6 | Astra Security | 4% | 29% | 14 |
| 7 | Detectify | 2% | 0% | 21 |
| 8 | Nuclei | 0% | 0% | 12 |
| 9 | Beagle Security | 0% | 0% | 10 |
| 10 | Aikido Security | 0% | 10% | 10 |
| 11 | Burp Suite | 0% | 44% | 41 |
| 12 | HCL AppScan | 0% | 80% | 10 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Intruder; alternatives Acunetix, Aikido Security, OWASP ZAP
- GPT-5.4 mini: Invicti Web + API, OWASP ZAP
- Gemini 3.5 Flash: StackHawk; alternatives Aikido Security, Astra Security, Escape
- Perplexity Sonar: StackHawk; alternatives Acunetix, Detectify, OWASP ZAP
- Grok 4.1 Fast: OWASP ZAP; alternatives Acunetix, Intruder, StackHawk
- Mistral Small: Acunetix, OWASP ZAP; alternatives Edgescan
- DeepSeek V4 Flash: Intruder; alternatives Beagle Security, OWASP ZAP
- Llama 4 Maverick: Acunetix
- Qwen 3.7 Flash: Invicti, Snyk; alternatives OWASP ZAP
- Kimi K2: StackHawk; alternatives Aikido Security, Intruder, OWASP ZAP
- GLM 4.7 FlashX: OWASP ZAP; alternatives Burp Suite, Detectify, StackHawk
- MiniMax M2.5: Acunetix, Edgescan; alternatives Checkmarx One
- GPT-6 Luna: OWASP ZAP; alternatives StackHawk
- Muse Glimmer 30B: OWASP ZAP; alternatives Acunetix, Burp Suite, Intruder, Invicti

## Sources the answers cite

76 of 84 answers came back with a source list, from 14 of 14 models. Sites named in the most answers:

- getastra.com: 51 answers, 62 citations
- stackhawk.com: 39 answers, 46 citations
- escape.tech: 38 answers, 47 citations
- beaglesecurity.com: 33 answers, 50 citations
- thectoclub.com: 29 answers, 29 citations
- securityboulevard.com: 28 answers, 33 citations
- aikido.dev: 27 answers, 33 citations
- checkmarx.com: 25 answers, 29 citations

Pages named in the most answers:

- https://getastra.com/blog/dast/tools (48 answers)
- https://stackhawk.com/blog/dynamic-application-security-testing-tools-comparison (34 answers)
- https://thectoclub.com/tools/best-dast-tools (28 answers)
- https://getautonoma.com/blog/dast-tools (25 answers)
- https://aikido.dev/blog/top-dynamic-application-security-testing-dast-tools (24 answers)
- https://escape.tech/blog/top-dast-tools (24 answers)
- https://checkmarx.com/learn/dast/dast-tools-key-features-and-12-solutions-to-know-in-2026 (22 answers)
- https://aimultiple.com/dast-tools (20 answers)
- https://beaglesecurity.com/blog/article/top-rated-dast-tools.html (20 answers)
- https://escape.tech/blog/dast-tools-buyers-guide (18 answers)

## Warned against

- Burp Suite: 18 of 41 labels negative. "Starts at ~$5,000/year and scales significantly with crawl concurrency. Generally out of reach for most small businesses" (MiniMax M2.5, negative prompt)
- Invicti: 12 of 28 labels negative. "Enterprise-focused with quote-based pricing, best suited for large organizations with 300+ apps." (MiniMax M2.5, negative prompt)
- HCL AppScan: 8 of 10 labels negative. "Avoid heavy enterprise legacy tools (like Micro Focus Fortify or HCL AppScan), which require a dedicated team to run." (Gemini 3.5 Flash, scale prompt)
- OWASP ZAP: 12 of 70 labels negative. "ZAP is known to produce more false positives than other DAST tools on this list, and it lacks enterprise-grade automation" (Claude Haiku 4.5, negative prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, October 2026 Edition, it-ai-index.com.