Checkmarx DAST review
A flexible DAST module for authenticated web, API, and internal-application testing.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Checkmarx DAST is a dynamic application security testing module for enterprise development and security teams. It scans live web applications and APIs for vulnerabilities, including REST, SOAP, and gRPC endpoints. The product supports authenticated testing through form-based, browser-based, recorder-driven, and TOTP authentication. It is delivered within the Checkmarx One application security platform rather than as a standalone product, making it a fit for organizations that need DAST alongside a broader Checkmarx One deployment.
Authentication depth is the clearest differentiator. Browser-recorded login flows can cover complex sequences, while TOTP support addresses two-factor authentication scenarios. Built-in tunneling extends scanning to internal, private, or firewall-protected applications. Scan configuration can use OpenAPI, Postman, HAR, SOAP, and GraphQL files, and risk reporting is organized by alerts and paths. These capabilities suit teams testing varied application architectures and authenticated areas that simpler scanners may not reach.
For delivery workflows, DAST CLI and Docker support enable CI/CD pipeline execution, with integrations for Azure Pipelines, CircleCI, GitHub, and Docker. The hybrid deployment model combines the Checkmarx One cloud service with locally run Docker, CLI, and tunneling components across web, Windows, macOS, and Linux environments. According to the vendor's published plan details, DAST is available as an add-on within Checkmarx One Professional or higher, with pricing based on organization-specific requirements. Teams needing complex authenticated and API testing should consider it; organizations seeking a standalone scanner or a self-serve purchase should choose an alternative.
Checkmarx DAST pros and cons
- Where it wins
- Supports browser-recorded, form-based, and TOTP authentication
- Tests REST, SOAP, and gRPC APIs with flexible scan inputs
- Runs through CLI, Docker, and built-in tunnels for CI/CD and internal apps
- Where it doesn't
- Requires Checkmarx One Professional or higher
- Sold by custom quote rather than a published plan price
- Not available as a standalone DAST product
Checkmarx DAST fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update