Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

apPosture DAST review

#3 of 26 in Dynamic Application Security Testing SoftwareApplication Security Posture Management SoftwareApplication Security Orchestration Platforms

Evidence-backed DAST for developers who need deep web and API testing.

9.2/10Editor score
Visit apPosture
apPosture DAST9.2 Visit apPosture

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

apPosture DAST actively tests running web applications and APIs for application security and security teams. Its browser-driven crawler covers JavaScript, single-page applications, XHR, GraphQL and REST surfaces, while authenticated scanning reaches applications behind login. The product also supports API testing through REST, GraphQL and OpenAPI/Swagger, with CI/CD security gates and pipeline scanning for development workflows. Deployment options include self-hosted, the customer's own cloud account and a managed dedicated instance.

The published annual-billing plans position DAST differently by tier. Essentials costs $35 per developer per month and includes SAST, SCA, Secrets, IaC and Container scanning, plus a Monitor-mode CI/CD gate and self-hosted deployment; DAST is available as an add-on, with no DAST targets included. Platform costs $70 per developer per month and adds DAST with 5 target URLs, API security, cloud posture, ASPM correlation, attack-chain features, Monitor-to-Block gating and PR decoration. Enterprise costs $90 per developer per month and includes 10 DAST target URLs, STRIDE threat modeling, a fail-closed gate, webhook and queue support, air-gapped deployment and 24×7 SLA support. A 30-day free trial is available, but there is no free plan.

Its clearest differentiator is the depth of finding validation. DOM-XSS execution proof, differential and arithmetic SQL injection confirmation, out-of-band confirmation for blind vulnerabilities, and proof-of-concept requests and responses are designed to give teams evidence for triage. The integration list covers GitHub, GitLab, Jenkins, Azure Pipelines and Bitbucket, with OpenAPI and Swagger support for API workflows. apPosture DAST suits teams that want authenticated, browser-based and API-focused testing with deployment flexibility. Teams seeking DAST included in the entry tier should look to Platform or Enterprise instead of Essentials.

apPosture DAST pros and cons

  • Where it wins
    • Browser-driven crawling covers JavaScript and SPA applications.
    • Proof-of-exploit findings include request and response evidence.
    • Supports authenticated web, REST, GraphQL and OpenAPI testing.
  • Where it doesn't
    • Essentials includes no DAST targets and requires a DAST add-on.
    • The free trial lasts 30 days; there is no free plan.
    • Some advanced capabilities require higher-priced developer tiers.

apPosture DAST fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update