Static analysis can tell you a SQL query is built with string concatenation. It cannot tell you that staging is terminating TLS and forwarding plain HTTP to the app server, or that an admin route survived a refactor and is still reachable with no auth check in front of it. Catching that class of bug means throwing real requests at a running deployment, which is the whole point of dynamic application security testing (DAST).
I went through six DAST tools and priced them off their own current pages rather than trusting last year's numbers anyone else might be quoting. I wrote the full breakdown on DevToolLab with screenshots of every pricing page; this is the condensed version with the numbers that matter most.
The price spread is enormous
Burp Suite Professional: $499 per user for a one-year subscription. StackHawk's Wingman tier: $10 per user per month. ZAP, Nuclei and Wapiti: $0, licensed Apache-2.0, MIT and GPL-2.0 respectively. Detectify publishes a full ladder, but in euros, from a €0 starter tier up to €15,000/year for Enterprise. All of that was pulled straight from vendor pages on September 21, 2026.
One correction that keeps getting missed in roundups: ZAP is not an OWASP project anymore. ZAP's own blog carries a banner stating it's "now supported by Checkmarx and is not part of any foundation." If a post you're reading still calls it "OWASP ZAP," it's working from stale information.
On adoption, there's no clean industry survey for this category the way CNCF runs one for Kubernetes, so GitHub stars are the least-bad public signal available: Nuclei sits at 31,395, ZAP at 15,797, Nikto at 10,735, Wapiti at 1,864 (checked the same day). Nuclei is also the most actively committed-to of the four.
Doing the per-seat math
Per-seat pricing and flat platform fees cross over at a team size most comparisons skip entirely. Running the numbers with each vendor's published rate:
Tool 1 dev 5 dev 20 dev 50 dev
------------------------------------------------------------------
Burp Suite Professional $499 $2,495 $9,980 $24,950
StackHawk Wingman $120 $600 $2,400 $6,000
ZAP / Nuclei / Wapiti $0 $0 $0 $0
Burp runs about 4.2x StackHawk per seat, and a 20-developer team pays roughly $7,580/year more choosing Burp over StackHawk at list price. But the license total isn't the number that should drive the decision. A scanner that hands you 400 findings on a mid-sized Rails app, 380 of which are the same reflected parameter reported repeatedly, costs an engineer a full day of triage. That's the real reason free tools aren't automatically the cheap option; see the DevToolLab post for the full walkthrough of that tradeoff.
The tools, briefly
ZAP (Zed Attack Proxy) is the default free pick, Apache 2.0, version 2.17.0 (Dec 2025), still getting commits days before this was written. It runs as a proxy, a headless scanner, or a CI-driven daemon via its Automation Framework, and the add-on marketplace covers a lot of ground commercial tools charge for, including auth handling and OpenAPI import. The catch: default active scans are noisy against modern SPAs, and tuning it to a trustworthy signal is a real project, not an afternoon.
Nuclei isn't a crawler and shouldn't be compared to ZAP head-to-head. It's a template engine, MIT licensed, 31,395 stars, version 3.11.1 (Aug 2026): point it at a target with a YAML template describing a request and a matcher, and it tells you if the condition holds. That makes it the fastest way to sweep many hosts for one specific CVE the morning it drops, but it won't discover your app's forms or parameters on its own.
Wapiti is the readable black-box option, GPL-2.0, 1,864 stars, version 3.3.2 tagged Aug 2026 (its own site still lists 3.3.1 as current, so trust the release tag). It crawls a live app, collects inputs, and fuzzes them for SQL/XPath/LDAP injection, XSS, file disclosure, command execution, XXE and CRLF injection. No commercial support and a much smaller contributor base than ZAP is the tradeoff.
Burp Suite Professional is priced for a human tester, $499/user/year. Repeater, Intruder and the manual proxy workflow are the actual product; the automated scanner is good but not the reason people buy it. It's a desktop app for one person, not CI infrastructure - PortSwigger sells a separate, sales-quoted product for pipeline scanning.
StackHawk has pivoted hard into the AI-coding-agent workflow. Wingman is $10/user/month, unlimited apps, 50 agentic scans per user per month, after a 14-day trial. The pitch is the scanner runs beside Claude Code, Cursor or Copilot so findings surface while the developer still remembers the feature. The 50-scan cap is the thing to watch if your CI config is chatty.
Detectify is the rare vendor that publishes a real ladder: €0 (Starter, up to 5 users), €2,500 (Standard), €5,000 (Professional), €15,000 (Enterprise) - all annual platform fees, all in euros. It leans on a Crowdsource network of external researchers for detection modules rather than an in-house rule set alone. The platform fee is a floor: API and Apex scanning cost extra per target, and PCI ASV scanning is a separate €500/year.
Picking one without buying twice
- Confirm you actually need DAST this quarter - if there's no SAST, no dependency scanning and no secrets detection yet, those find more per hour of setup on an unscanned codebase.
- Run ZAP against staging before spending anything. It costs an afternoon and tells you your real finding volume - 12 findings and 900 findings are different buying decisions.
- Price the triage time, not just the license. Estimate minutes per finding from step 2 and weigh that against $499/seat; for most teams, engineer time is the bigger line item.
- Decide whether you need authenticated scanning - anonymous-only coverage misses most real business logic, and this is where free tools cost the most setup time.
- Match the pricing unit to your shape: per-seat punishes large teams with few apps, per-application/platform fees punish small teams running many services.
If you're already carrying a DAST finding into remediation, a couple of DevToolLab's utilities save the rescan round-trip: the Security Headers Checker confirms a missing CSP or HSTS header without waiting on a full scan, and the SSL Certificate Checker rules out a TLS chain problem before you chase a false positive.
Bottom line
The real story this year is that the cheap commercial tier got genuinely cheap - StackHawk at $120/developer/year is close enough to free that self-hosting ZAP purely to dodge a bill is worth reconsidering against your actual triage hours. Before renewing anything, ask how many findings from last quarter's scans an engineer actually acted on. Under ten, and you're paying for scan volume nobody's using - the fix is better tuning, not a bigger plan.
Top comments (0)