Application Testing / DAST
Find vulnerabilities by testing the application as it runs.
Assess running web applications and APIs to discover security weaknesses through dynamic testing and understand how those issues appear from an external application perspective.
-
Manual and scheduled scans
Run scans on demand or set a regular schedule.
-
Authenticated scanning
Test areas behind a login, on Growth and Scale.
-
API scanning
Test API endpoints, on Growth and Scale.
-
Scan history
Keep results to compare over time, up to 180 days on Scale.
Application Testing
Dynamic Application Security Testing (DAST)
Placeholder: the real product screenshot will replace this image Review the weaknesses observed while testing a running application, with the context to investigate them.
The problem
Source-code analysis cannot show every behavior that emerges when an application is running. Teams also need to test how the application responds to requests and interacts with its exposed functionality.
How it works
Dynamic testing interacts with a running application in a configured test environment and evaluates observed behavior for supported security weaknesses.
What you can do
- Assess running web applications.
- Test supported API endpoints.
- Review dynamic security findings.
- Use relevant finding context in follow-up security investigation.
What you get
A view of security weaknesses observed during application testing, with context that can support investigation and remediation.
Where it fits
Dynamic findings can provide context for targeted static analysis, helping teams investigate relevant code paths.
Pricing
Choose a DAST plan
DAST is an add-on, separate from your SAST plan. Features and limits follow the plan you choose.
| Feature | Starter | Growth | Scale |
|---|---|---|---|
| Price / month | IDR 299,000 | IDR 999,000 | IDR 1,499,000 |
| Active targets | 1 | 5 | 10 |
| Scans per month | 4 | 20 | 40 |
| Max pages per scan | 50 | 100 | 200 |
| Manual & scheduled scans | Yes | —Not listed for this plan | —Not listed for this plan |
| Authenticated scanning | —Not listed for this plan | Yes | —Not listed for this plan |
| Advanced authentication | —Not listed for this plan | —Not listed for this plan | Yes |
| API scanning | —Not listed for this plan | Yes | Yes |
| Concurrent scans (max) | —Not listed for this plan | 2 | 4 |
| Scan history | —Not listed for this plan | 90 days | 180 days |
Test types and coverage follow the product capabilities available on your plan. Contact us for needs beyond this table.
FAQ
Related questions
What is the difference between SAST and DAST?
SAST (Static Application Security Testing) analyzes source code without running the application, so security and quality issues surface as code is written. DAST (Dynamic Application Security Testing) tests a running web application or API from the outside, the way an attacker sees it. The two complement each other.
Is DAST included in the SAST price?
No. DAST is a separate add-on with three plans, starting at IDR 299,000/month.
What is the difference between DAST Starter, Growth, and Scale?
Starter (IDR 299,000/month): 1 active target, 4 scans/month, up to 50 pages per scan. Growth (IDR 999,000/month): 5 active targets, 20 scans/month, up to 100 pages, authenticated scanning, API scanning, 2 concurrent scans, 90-day history. Scale (IDR 1,499,000/month): 10 active targets, 40 scans/month, up to 200 pages, advanced authentication, API scanning, 4 concurrent scans, 180-day history.
Is the Dedicated Runner required?
No. The Shared Runner is included in Free and Team. The Dedicated Runner is an optional add-on, and buying DAST does not require it.
Make security easier to understand, and easier to act on.
Bring your code, applications, dependencies, infrastructure, and security governance into one connected platform.