PortSwigger Burp Suite

Overview

Burp Suite, made by PortSwigger, is the standard toolkit for manual web application penetration testing. Burp Suite Professional combines an intercepting proxy, automated vulnerability scanner, Burp Intruder for customised attacks and authenticated API scanning, and it supports a large library of user extensions^[21]. PortSwigger says Burp Suite Professional was recognised as a Gartner Peer Insights Customers’ Choice for 2024^[21].

For organisations that want scheduled, automated scanning at scale, PortSwigger sells Burp Suite DAST, which runs parallel crawl and audit, carries authenticated sessions across scans, and supports bulk operations, locked scan policy templates and portfolio-level reporting across thousands of sites^[22]. PortSwigger names SAP, Microsoft, Amazon, NASA, Salesforce, FedEx and Oracle among organisations using Burp^[22]. It also runs the free Web Security Academy for training^[23].

Burp Suite Professional costs US$499 and can be tried free; Burp Suite DAST is quote-based^[21][23]. Professional is a tool for skilled testers rather than a turnkey scanner, so results depend heavily on the operator.

PortSwigger Burp Suite features

• Intercepting proxy for manual testing
• Automated web vulnerability scanner
• Burp Intruder for custom attacks
• Authenticated API scanning
• Large extension ecosystem
• Burp Suite DAST for scale

PortSwigger Burp Suite pricing

Burp Suite Professional: US$499, free trial available. Burp Suite DAST: quote-based.

PortSwigger Burp Suite strengths and limitations

Appears in

• Best Vulnerability Scanners in 2026 #11

PortSwigger Burp Suite alternatives and competitors

Alternatives to PortSwigger Burp Suite: companies ranked in the same lists.

• Wiz
• Microsoft Power BI
• Tenable
• Rapid7
• QQualys
• Aqua Security Trivy
• Detectify
• Greenbone OPENVAS
• Intruder
• Invicti (incl. Acunetix)
• ProjectDiscovery Nuclei
• Snyk