Runtime Application Validation

Now pick what to compare Nuclei against.

Nuclei clear

Open a name for its full profile

Burp Suite Professional
Capabilities only
PortSwigger · Commercial · 3 capabilities in this domain
Compare →
Invicti
Capabilities only
Invicti Security · Commercial · 3 capabilities in this domain
Compare →
Pentera
Capabilities only
Pentera · Commercial · 3 capabilities in this domain
Compare →
Bugcrowd Platform
Capabilities only
Bugcrowd · Commercial · 2 capabilities in this domain
Compare →
Burp Suite DAST
Capabilities only
PortSwigger · Commercial · 2 capabilities in this domain
Compare →
Cymulate
Capabilities only
Cymulate · Commercial · 2 capabilities in this domain
Compare →
HackerOne Platform
Capabilities only
HackerOne · Commercial · 2 capabilities in this domain
Compare →
Mayhem
Capabilities only
Mayhem Security · Commercial · 2 capabilities in this domain
Compare →
NodeZero
Capabilities only
Horizon3.ai · Commercial · 2 capabilities in this domain
Compare →
Nuclei
Capabilities only
ProjectDiscovery · Open Source · 2 capabilities in this domain
selected
Synack Platform
Capabilities only
Synack · Commercial · 2 capabilities in this domain
Compare →
ZAP
Capabilities only
Checkmarx · Open Source · 2 capabilities in this domain
Compare →
AFL++
Capabilities only
AFL++ Project · Open Source · 1 capabilities in this domain
Compare →
AttackIQ
Capabilities only
AttackIQ · Freemium · 1 capabilities in this domain
Compare →
Bright DAST
Capabilities only
Bright Security · Commercial · 1 capabilities in this domain
Compare →
CI Fuzz
Capabilities only
Code Intelligence · Commercial · 1 capabilities in this domain
Compare →
Cobalt Pentest as a Service
Capabilities only
Cobalt · Commercial · 1 capabilities in this domain
Compare →
Contrast Assess
Capabilities only
Contrast Security · Commercial · 1 capabilities in this domain
Compare →
OSS-Fuzz
Capabilities only
Google Open Source Security Team · Free · 1 capabilities in this domain
Compare →
Picus Security Validation Platform
Capabilities only
Picus Security · Commercial · 1 capabilities in this domain
Compare →

In Runtime Application Validation

Burp Suite DAST

PortSwigger · Runtime Application Validation

Close ×

CommercialCompany

Burp Suite DAST runs Burp's scanner across many sites with authentication, CI integration and reporting.

What it does3 capabilities · 2 at full coverage

2 of 3 at full coverage.

API Security TestingPartialAPI · level 2 · 12 providers
Authenticated DAST ScanningFullVALIDATE · level 3 · 4 providers
Dynamic Application Security TestingFullVALIDATE · level 2 · 8 providers

What it proves22 controls across 9 frameworks

Satisfied through its capabilities, not claimed by the vendor.

ASVS 5.07 / 17V1 V2 V3 V4 V6 V7 V8
API Top 105 / 10API2:2023 API3:2023 API5:2023 API7:2023 API8:2023
OWASP Top 102 / 10A01:2025 A07:2025
SAMM 2.02 / 90V-ST-1-B V-ST-2-B
SSDF 1.12 / 42PW.8.1 PW.8.2
CIS Controls1 / 18CIS 16
CNAS Top 101 / 10CNAS-2
CRA1 / 41Annex I Part II (3)
DSOMM1 / 19TV-Dynamic-Depth-Applications

What it stops3 techniques · 3 risks

3 techniques countered, 3 of them common

Broken Object Level Authorization ExploitationVery Common
Exploit Public-Facing ApplicationT1190Very Common
Injection ExploitationVery Common

3 risks reduced

API exposes data through broken authorizationCritical
Exploitable flaw in first-party application codeHigh
Exploitable issues in running applications remain undiscoveredHigh

Where it runs1 phase · 3 ways to deploy

Capabilities per lifecycle phase

Test3

How it is delivered

CI/CD integrationSaaSSelf-hosted

What it unlocks3 activities · reaches level 3

Program activities its capabilities support, reaching level 3. Supporting an activity is not completing it.

Level 2

Run DAST against ephemeral environmentsMedium effort

Level 3

Authenticated testing and a disclosure programMedium effort
Test object and function level authorizationMedium effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsPer application or scan target

LicensingPer application or scan target

Priced perapplication or target per year

BillingSubscription

Scales withApplications, APIs or web targets tested

Total cost

Microservices multiply targets; define what counts as an application.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at1 sibling

Same family

Burp Suite ProfessionalCommercial

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13