Best Dynamic Application Security Testing (DAST) Software for ThreadFix
View:
Compare the Top Dynamic Application Security Testing (DAST) Software that integrates with ThreadFix as of November 2025
Sort By:
This a list of Dynamic Application Security Testing (DAST) software that integrates with ThreadFix. Use the filters on the left to add additional filters for products that have integrations with ThreadFix. View the products that work with ThreadFix in the table below.
What is Dynamic Application Security Testing (DAST) Software for ThreadFix?
Dynamic Application Security Testing (DAST) software is software that identifies and addresses vulnerabilities in web applications during runtime. Unlike static testing, which analyzes source code, DAST evaluates the security of running applications by simulating real-world attacks to detect issues such as SQL injection, cross-site scripting (XSS), and authentication flaws. This software helps security teams identify weaknesses in live applications and prioritize fixes based on the severity of potential threats. DAST tools are typically used during development, staging, or pre-production stages to ensure that applications are secure before being deployed to production. Compare and read user reviews of the best Dynamic Application Security Testing (DAST) software for ThreadFix currently available using the table below. This list is updated regularly.
-
1
Invicti
Invicti Security
Application security is noisy and overly complicated. The good news: you can relieve that unnecessary noise and dramatically reduce your risk of attacks with Invicti. Keeping up with security is more manageable with accurate, automated testing that scales as your needs shift and grow. That's where Invicti shines. With a leading dynamic application security testing solution (DAST), Invicti helps teams automate security tasks and save hundreds of hours each month by identifying the vulnerabilities that really matter. Combining dynamic with interactive testing (DAST + IAST) and software composition analysis (SCA), Invicti scans every corner of an app to find what other tools miss. With asset discovery, it's easier to discover all web assets — even ones that are lost, forgotten, or created by rogue departments. Through tried-and-true methods, Invicti helps DevSecOps teams get ahead of their workloads to hit critical deadlines, improve processes, and communicate more effectively. -
2
AppScan
HCLSoftware
HCL AppScan is a suite of application security testing platforms, technologies, and services that help organizations detect and remediate vulnerabilities throughout the software development lifecycle (SDLC). Powerful static, dynamic, interactive, and open-source scanning engines (DAST, SAST, IAST, SCA, API) quickly and accurately test code, web applications, APIs, mobile applications, containers, and open-source components with the help of AI and machine learning capabilities. Centralized dashboards provide visibility, oversight, compliance policies, and reporting. HCL AppScan’s scanning engines are maintained by expert security researchers and are continuously updated to remain current with recent technologies, vulnerabilities, and attack vectors. With HCL AppScan, organizations can manage their application security posture and reduce risk across their entire software supply chain.Starting Price: $296 -
3
Acunetix
Invicti Security
As the market leader in automated web application security testing, Acunetix by Invicti is the go-to security tool for Fortune 500 companies. DevSecOps teams can cut through the noise to uncover unseen risks and mitigate dangerous exploits, detecting and reporting on a wide array of vulnerabilities. With an industry-leading crawler that fully supports HTML5, JavaScript, and Single-page applications, Acunetix enables the auditing of complex, authenticated applications for deeper insight into an organization's risk posture. It's a leader for a reason: the technology behind Acunetix delivers the only product on the market that can automatically detect out-of-band vulnerabilities to enable comprehensive management, prioritization, and control for vulnerability threats by criticality. Plus, it's available both online and as an on-prem solution, integrating with popular issue trackers and WAFs so that DevSecOps teams don't have to slow down when building innovative apps. -
4
Black Duck
Black Duck
Black Duck, part of the Synopsys Software Integrity Group, is a leading provider of application security testing (AST) solutions. Their comprehensive portfolio includes tools for static analysis, software composition analysis (SCA), dynamic analysis, and interactive analysis, enabling organizations to identify and mitigate security vulnerabilities throughout the software development life cycle. By automating the discovery and management of open-source software, Black Duck ensures compliance with security and licensing standards. Their solutions are designed to help organizations build trust in their software by managing application security, quality, and compliance risks at the speed their business demands. Black Duck empowers businesses to innovate securely and deliver software with confidence. -
5
OpenText Static Application Security Testing (SAST) identifies and remediates security vulnerabilities in source code early in the software development lifecycle. It supports extensive language coverage and integrates seamlessly with popular CI/CD tools such as Jenkins, Azure DevOps, Jira, and Visual Studio. The platform uses advanced static code analysis and AI-driven insights to prioritize risks and reduce false positives, enabling developers to focus on fixing critical vulnerabilities efficiently. With its customizable code analysis and rule sets, it helps reduce development time by catching issues early. OpenText SAST complies with industry standards like OWASP and offers flexible deployment options including SaaS, private cloud, and on-premises. This comprehensive approach enhances application security without sacrificing development speed or accuracy.
-
6
OpenText Dynamic Application Security Testing (DAST) is an automated solution that simulates real-world attacks on live applications, APIs, and services to identify exploitable vulnerabilities. It operates on running production environments, requiring no source code or staging setup. Designed for modern DevSecOps teams, the platform prioritizes vulnerabilities for root cause analysis and integrates seamlessly through REST APIs and an intuitive user interface. OpenText DAST supports automation in CI/CD pipelines, reducing manual efforts while accelerating security feedback. It covers modern web technologies like HTML5, JSON, AJAX, JavaScript, and HTTP2 to ensure comprehensive testing. Flexible deployment options allow organizations to run the solution on public cloud, private cloud, or on-premises environments.
-
7
Tenable One
Tenable
Tenable One radically unifies security visibility, insight and action across the attack surface, equipping modern organizations to isolate and eradicate priority cyber exposures from IT infrastructure to cloud environments to critical infrastructure and everywhere in between. The world’s only AI-powered exposure management platform. See every asset across your entire attack surface—from cloud environments to operational technologies, infrastructure to containers, and remote workers to modern web-apps with Tenable's market-leading vulnerability management sensors. With more than 20 trillion aspects of threat, vulnerability, misconfiguration and asset information, Tenable’s machine-learning powered predictions reduce remediation efforts by enabling you to focus first on the risks that matter most. Drive improvements required to reduce the probability of a business-impacting cyber event from occurring by communicating objective measures of risk. -
8
OWASP ZAP
OWASP
OWASP ZAP (Zed Attack Proxy) is a free, open-source penetration testing tool being maintained under the umbrella of the Open Web Application Security Project (OWASP). ZAP is designed specifically for testing web applications and is both flexible and extensible. At its core, ZAP is what is known as a “man-in-the-middle proxy.” It stands between the tester’s browser and the web application so that it can intercept and inspect messages sent between browser and web application, modify the contents if needed, and then forward those packets on to the destination. It can be used as a stand-alone application, and as a daemon process. ZAP provides functionality for a range of skill levels – from developers, to testers new to security testing, to security testing specialists. ZAP has versions for each major OS and Docker, so you are not tied to a single OS. Additional functionality is freely available from a variety of add-ons in the ZAP Marketplace, accessible from within the ZAP client. -
9
Contrast Assess
Contrast Security
A new kind of security designed for the way software is created. Resolve security issues minutes after installation by integrating security into your toolchain. Because Contrast agents monitor code and report from inside the application, developers can finally find and fix vulnerabilities without requiring security experts. That frees up security teams to focus on providing governance. Contrast Assess deploys an intelligent agent that instruments the application with smart sensors. The code is analyzed in real time from within the application. Instrumentation minimizes the false positives that slow down developers and security teams. Resolve security issues minutes after installation by integrating security into your toolchain. Contrast Assess integrates seamlessly into the software life cycle and into the tool sets that development and operations teams are already using, including native integration with ChatOps, ticketing systems and CI/CD tools, and a RESTful API. -
10
Veracode
Veracode
Veracode offers a holistic, scalable way to manage security risk across your entire application portfolio. We are the only solution that can provide visibility into application status across all testing types, including SAST, DAST, SCA, and manual penetration testing, in one centralized view.
- Previous
- You're on page 1
- Next