The year so far: How Burp Suite DAST is leveling up enterprise security in 2025
Summary: PortSwigger recapped its first-half 2025 updates to Burp Suite DAST, including portfolio-wide recurring scan scheduling, custom asset tags, automatic authentication token refresh during API scans, and scan triggers from Postman Collections. The scanner engine was reworked to crawl and audit in parallel, improve handling of single-page app navigation, and the Jira integration was rebuilt with parent-child issue hierarchies.
Why it matters: The vendor's own framing is that attackers are shifting focus to APIs as they become the backbone of modern applications, and the token-refresh feature exists specifically to close a gap that previously required manual oversight or custom workarounds - so the question is how much of your API estate currently goes unscanned because authentication expires mid-test.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026