Checkmarx DAST
Checkmarx DAST: A flexible DAST module for authenticated web, API, and internal-application testing. Ranked #9 of 26 in Dynamic Application Security Testing Software by our editors (8.6/10); pricing: Pricing on request; best for security teams with complex authentication needs.
At a glance
- Editor score8.6 / 10
- PricingPricing on request
- Best forSecurity teams with complex authentication needs
- Authenticated scanningYes
- Founded2006
- Facts checked22 Sep 2026
Where it wins
- Supports browser-recorded, form-based, and TOTP authentication
- Tests REST, SOAP, and gRPC APIs with flexible scan inputs
- Runs through CLI, Docker, and built-in tunnels for CI/CD and internal apps
Where it doesn't
- Requires Checkmarx One Professional or higher
- Sold by custom quote rather than a published plan price
- Not available as a standalone DAST product
Our verdict on Checkmarx DAST
Checkmarx DAST is a dynamic application security testing module for enterprise development and security teams. It scans live web applications and APIs for vulnerabilities, including REST, SOAP, and gRPC endpoints. The product supports authenticated testing through form-based, browser-based, recorder-driven, and TOTP authentication. It is delivered within the Checkmarx One application security platform rather than as a standalone product, making it a fit for organizations that need DAST alongside a broader Checkmarx One deployment.
Authentication depth is the clearest differentiator. Browser-recorded login flows can cover complex sequences, while TOTP support addresses two-factor authentication scenarios. Built-in tunneling extends scanning to internal, private, or firewall-protected applications. Scan configuration can use OpenAPI, Postman, HAR, SOAP, and GraphQL files, and risk reporting is organized by alerts and paths. These capabilities suit teams testing varied application architectures and authenticated areas that simpler scanners may not reach.
For delivery workflows, DAST CLI and Docker support enable CI/CD pipeline execution, with integrations for Azure Pipelines, CircleCI, GitHub, and Docker. The hybrid deployment model combines the Checkmarx One cloud service with locally run Docker, CLI, and tunneling components across web, Windows, macOS, and Linux environments. According to the vendor's published plan details, DAST is available as an add-on within Checkmarx One Professional or higher, with pricing based on organization-specific requirements. Teams needing complex authenticated and API testing should consider it; organizations seeking a standalone scanner or a self-serve purchase should choose an alternative.
Your product? Our editors can test Checkmarx DAST in depth and publish a review, labelled as paid · from $149/mo →
Checkmarx DAST pricing
All 1 Checkmarx DAST plans and prices →
Checkmarx DAST fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Not verified |
| Authenticated scanning | Yes |
| API testing | Yes |
| Browser-based scanning | Yes |
| CI/CD integration | Yes |
| Deployment model | Hybrid |
| Included scan targets | Not verified |
| Deployment | Cloud, Self-hosted |
| Platforms | Web, Windows, macOS, Linux, Chrome extension |
| Compliance & security | SOC 2 |
| Support | Tickets, Docs |
| Built for | Enterprise (editorial estimate) |
| Integrations | 40+ integrations: GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, TeamCity … See all → |
| Pricing | Pricing on request (source) |
| Website | checkmarx.com |
| Facts checked | 22 Sep 2026 |
Checkmarx DAST integrations
Checkmarx DAST lists 40+ integrations on its own site — the 14 named here are the ones its pages call out.
- GitHub
- GitLab
- Bitbucket
- Azure DevOps
- Jenkins
- TeamCity
- GitHub Actions
- Bitbucket Pipelines
- CircleCI
- Bamboo
- AWS CodeBuild
- Jira
- Slack
- Microsoft Teams
See all Checkmarx DAST integrations →
Alternatives to Checkmarx DAST
- Safeguard DASTBroad authenticated web and API scanning with paid plans starting at $9/month.9.4
- OWASP ZAPA capable free DAST tool with broad web, API, browser, and automation coverage.9.3
- apPosture DASTEvidence-backed DAST for developers who need deep web and API testing.9.2
See all Checkmarx DAST alternatives →
Used Checkmarx DAST? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Checkmarx DAST for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Checkmarx DAST is listed in our Dynamic Application Security Testing Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/checkmarx-dast/"><img src="https://www.itechguides.com/best/badge/checkmarx-dast.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update