| Category | Function | Share | Rank | Negative rate | Labels | Quadrant | Since September 2026 |
|---|---|---|---|---|---|---|---|
| Dynamic application security testing | Developer platform | 2% | 9 of 58 | 18% | 45 | accepted challenger | |
| API security platforms | Security operations | 0% | 29 of 93 | 0% | 3 | under 10 labels · led by Aikido Security at 12% | |
| Vulnerability management platforms | Security operations | 0% | 30 of 77 | 0% | 1 | under 10 labels · led by Rapid7 InsightVM at 30% | =heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked. |
| Model | First choice | Alternative | Mention | Negative | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 1 | 1 | 2 | 4 |
| GPT-5.4 mini | 1 | 3 | 0 | 0 | 4 |
| Gemini 3.5 Flash | 0 | 3 | 0 | 0 | 3 |
| Perplexity Sonar | 0 | 1 | 0 | 0 | 1 |
| Grok 4.20 | 0 | 2 | 2 | 1 | 5 |
| Mistral Small | 0 | 2 | 1 | 0 | 3 |
| DeepSeek V4 Flash | 0 | 1 | 1 | 1 | 3 |
| Llama 4 Maverick | 0 | 0 | 2 | 0 | 2 |
| Qwen 3.7 Flash | 2 | 2 | 0 | 1 | 5 |
| Kimi K2 | 0 | 3 | 1 | 1 | 5 |
| GLM 4.7 FlashX | 1 | 2 | 1 | 1 | 5 |
| MiniMax M2.5 | 1 | 3 | 1 | 0 | 5 |
| GPT-6 Luna | 0 | 0 | 0 | 0 | 0 |
| Muse Glimmer 30B | 0 | 3 | 0 | 1 | 4 |
Verbatim evidence the judge attached to positive labels.
“commercial tools like Burp Suite Professional and Invicti catch more vulnerability types than open-source alternatives, with Burp Suite achieving ~29% coverage of critical vulnerabilities” MiniMax M2.5 · DAST · comparative prompt · first choice
“I'd generally recommend Burp Suite Professional if you want the best balance of capability, usability, and web-app-focused coverage” GPT-5.4 mini · DAST · paraphrase prompt · first choice
“Burp Suite Professional (PortSwigger): Best for manual testing + automated scanning hybrid. Excellent SPA support.” Qwen 3.7 Flash · DAST · negative prompt · first choice
“Burp Suite is the gold standard for manual exploration and validation.” GLM 4.7 FlashX · DAST · comparative prompt · first choice
Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.
“The Verdict: Avoid for automated scanning. Use only for manual penetration testing.” GLM 4.7 FlashX · DAST · negative prompt · hard negative
“Burp Suite Enterprise has complex setup and configuration requirements that often need dedicated security expertise” Claude Haiku 4.5 · DAST · negative prompt · soft negative
“Extremely manual and limited automation in the free version; Pro is better but still developer/pentester-focused.” Grok 4.20 · DAST · negative prompt · soft negative
“strong community support and an extensive plugin ecosystem, though it has a steep learning curve and complex UI” Claude Haiku 4.5 · DAST · comparative prompt · soft negative
Citations exist only for the models that return a source list, five of the fourteen in this edition, so these counts come from 112 of the 121 answers that named Burp Suite and are not a share of its labels.
No domain is on file for Burp Suite, so its own site is not marked.
Pages are listed as the models cited them.
Search figures are US estimates from DataForSEO, read October 5, 2026; AI search demand is its modeled, directional estimate, not a count of queries to any assistant. The answers are this edition's. Two measurements side by side: neither is read as the cause of the other.
An email the morning each edition publishes: where this product moved, where it held, and by how much against the noise floor. One address, confirmed by a click; a stop link in every email.
Already following? Everything you follow, with a stop for each.
Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Burp Suite's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Burp Suite, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.
A new claim receives the current edition's vendor brief for Burp Suite by email, built from the raw record of the edition. It shows: