Web Application Security Testing Software - Port Swigger
Summary: PortSwigger's page describes web application security testing as covering both automated and manual techniques, and defines four methodologies: DAST (black box, testing a running app from the outside), SAST (white box, reviewing static code), IAST (gray box, instrumenting a running app, which the page says should not be used in production), and OAST, which PortSwigger says it pioneered. The page states that SAST is prone to false positives requiring manual investigation, that IAST's invasive nature limits it to test environments, and that Burp Suite Professional has over 40,000 users.
Why it matters: The page's own comparison puts the trade-off plainly: SAST's false positives cost time and money and, like the boy who cried wolf, can train users to ignore its warnings, while IAST cannot be run in production at all. For a leader choosing tooling across a portfolio of web apps, that leaves the testing method's false-positive rate and its production safety as the deciding factors, not the feature list.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026