Burp Suite DAST

What is Burp Suite DAST?

Burp Suite DAST is the automated web vulnerability scanner built by PortSwigger Ltd., aimed at organisations that need to scan an entire portfolio of applications and APIs on a recurring basis, not just during a one-off penetration test. It was called Burp Suite Enterprise Edition until April 2025, when PortSwigger renamed the product. Architecture: a central server holds the dashboard, scan policy and results, while dedicated scanning machines run scans in parallel, organised into pools. It runs as a PortSwigger-managed Cloud service, as a self-hosted installation on Windows or Linux, on a Kubernetes cluster with Helm and auto-scaling, or straight the pipeline in a Docker container. The scanning engine is the same Burp Scanner used in Burp Suite Professional, which keeps a pipeline finding reproducible on the analyst's workstation. According to PortSwigger, more than 18,000 organisations across more than 170 countries use Burp Suite.

Key features of Burp Suite DAST

Burp Suite DAST covers the full automated scanning cycle: discovery, authentication, parallel execution, result routing and access control over who sees what.

• Burp Scanner with browser-powered crawler — uses Chromium to navigate single-page applications and JavaScript-generated content, mapping routes a static HTML crawler never reaches.
• Authenticated scanning with persistent sessions — holds the session throughout the scan to cover internal areas of the application instead of stopping at the login screen.
• API coverage — accepts OpenAPI, GraphQL and SOAP definitions plus Postman collections to scan endpoints that never appear during user navigation.
• CI-driven scans — runs Burp Scanner in a Docker container inside the pipeline, writing results as JUnit or Burp XML, on Jenkins, TeamCity, GitHub Actions or any platform that runs Docker.
• Scanning machine pools — spreads concurrent scans across dedicated machines, with a configurable concurrency limit to control infrastructure consumption.
• Role-based access control — RBAC with users, roles and groups, plus group restriction to specific sites, separating who starts a scan who only reads results.
• Enterprise identity — SAML and LDAP single sign-on with SCIM provisioning, tested against Okta, Microsoft Entra ID and ADFS.
• GraphQL API and extensibility — automation and integration with in-house systems through the API, plus BChecks and BApp Store extensions that also apply to pipeline scans.

Benefits of Burp Suite DAST

Earlier findings come pipeline-driven scanning: Burp Scanner runs in a container before deployment and returns results as JUnit, so the build can be failed in CI instead of discovering the flaw in production. Coverage of modern applications comes the Chromium-powered crawler, which executes JavaScript and reaches single-page application routes a static crawler cannot see. Scale comes scanning machine pools and Kubernetes auto-scaling, which add resources as the concurrent scan queue grows and release them when it empties. And continuity with manual testing comes the shared engine: because it is the same Burp Scanner used in Burp Suite Professional, the analyst reopens the finding on the workstation and produces evidence with no translation between formats.

Who Burp Suite DAST is for

Burp Suite DAST is bought by AppSec teams, information security management and DevSecOps groups responsible for a set of applications rather than a single one. The day-to-day user is the AppSec engineer or the platform team that maintains the pipeline; results are also consumed by developers through tickets and by leadership through portfolio reporting. Three concrete scenarios: the company with dozens of web applications that relies on occasional external pentesting and wants recurring scanning between cycles; the DevSecOps group that needs an automated gate before deployment; and the organisation under continuous compliance monitoring that must evidence periodic scanning with an audit trail.

What sets Burp Suite DAST apart

The core differentiator is inherited depth: Burp Suite DAST uses the same scanning engine employed in professional manual testing, so the evidence the scanner delivers is the evidence a pentester would reproduce by hand. The second is topology freedom — managed Cloud, self-hosted on Windows or Linux, Kubernetes with Helm, or a dashboard-free pipeline container — which makes it possible to reach internal targets and meet infrastructure residency policy without changing product. The third is extensibility: BChecks and BApp Store extensions written by your team also apply to CI scans, so a rule created for one specific target starts running automatically across the whole portfolio.

System requirements

In Cloud mode, PortSwigger hosts and maintains the whole infrastructure, and self-hosted scanning machines can be added to reach network-internal targets. In standard self-hosted mode there are installers for Windows and Linux, in single-machine or multi-machine architectures, with an external database recommended for production: PostgreSQL, Oracle, MySQL or MariaDB and Microsoft SQL Server, connected over JDBC. In Kubernetes mode, PortSwigger provides a Helm chart and requires an x86 cluster with an ingress solution and a PersistentVolume in ReadWriteMany mode, optionally with cluster-autoscaler enabled. Hardware sizing depends on the number of concurrent scans, the size of the applications, the expected issue volume and the number of active users; PortSwigger recommends spreading scans across several scanning machines.

Deployment options

There are four paths to the same software and the same scanning engine. Managed Cloud is the fastest route to a first scan, with PortSwigger handling deployment, configuration and maintenance. Standard self-hosted gives full control of the installation on physical or virtual machines, including headless servers. Kubernetes suits organisations already running their own cluster that want scanning capacity to scale by itself. And CI-driven with no dashboard needs no server at all: Burp Scanner runs in a pipeline container and results stay in CI, as JUnit or Burp XML.

For analyst-led manual testing, with an intercepting proxy and hands-on request manipulation, the product is Burp Suite Professional, licensed differently and with no upgrade path between the two.

How much does Burp Suite DAST cost?

Burp Suite DAST is licensed as an annual subscription with a scoped quote, and the technical basis of the licence is concurrent scan capacity, not headcount: every subscription includes unlimited users, and PortSwigger states that you do not pay per URL. The licence key itself records the expiry date and the number of concurrent scans included, and that capacity can be increased during the contract term. The EULA provides for three formats: a classic licence with a defined number of concurrent scans; a usage-based model charged per hour of scanning; and an unlimited model with no cap on concurrent scans during the term.

The counting rule that most often prevents sizing errors is the instance rule: one instance of Burp Suite DAST requires one licence, regardless of how many scanning machines are deployed — but separate instances require separate licences. A company with one production instance and another dedicated to staging needs two licences, even if the second uses only a few machines. There is no list price because the investment depends on the chosen format, the concurrent scan capacity, the deployment model, the contract term and whether it is a new purchase or a renewal. To buy Burp Suite DAST in Brazil, OSB Software scopes this with you, sends the commercial proposal, issues the Brazilian invoice and delivers the licences; request a quote to receive the exact figure for your scenario.

Frequently asked questions

Is Burp Suite DAST the same as the former Burp Suite Enterprise Edition? Yes. PortSwigger renamed Burp Suite Enterprise Edition to Burp Suite DAST in April 2025; the product and its architecture remain the same.

How many licences are needed for several scanning machines? Just one. The licence is per Burp Suite DAST instance; the number of scanning machines and scans run does not multiply it. Only separate instances require additional licences.

Can internal applications be scanned without exposing them to the internet? Yes. In Cloud mode you can add self-hosted scanning machines to reach internal targets, and the self-hosted and Kubernetes modes run entirely on company infrastructure.

Can scans run in the pipeline without installing the server? Yes, through the CI-driven no-dashboard option: Burp Scanner runs in a Docker container in the pipeline and writes results as JUnit or Burp XML, with no Burp Suite DAST server required.

Why buy Burp Suite DAST OSB Software?

OSB Software is an official PortSwigger partner in Brazil and supplies 100% genuine Burp Suite DAST licenses to companies, with Brazilian invoicing, local contracting in Portuguese and full legal compliance — the safe way to buy imported software under a Brazilian corporate entity, with no risk of irregular licensing.

When you buy Burp Suite DAST OSB Software, you get:

• Consultative, specialist support — specialists who size your concurrent scan capacity licensing to your actual operation, avoiding over- or under-buying.
• Fast, secure processes — purchase order to delivery of genuine licenses, traceable at every step.
• Dedicated commercial follow-up — quote to delivery and renewal, with advance notice before your license expires.
• Invoicing that fits your company — Brazilian invoicing and terms adapted to your corporate procurement process.
• Proven track record — thousands of customers served across Brazil.

If you are looking for where to buy Burp Suite DAST in Brazil with legal certainty and properly licensed imported software, request a quote: OSB Software delivers reliable technology, qualified support and a simple, transparent purchase.