The professional web security tester's tool of choice, plus an enterprise scanner.
Burp Suite Professional is the standard toolkit for manual web application penetration testing — intercepting proxy, repeater, intruder, scanner and an extension ecosystem. Burp Suite Enterprise adds scheduled automated scanning across many applications with CI integration.
Best for
From $475 per user/year (Professional)
PaidFree tier: Community Edition is free but omits the scanner and rate-limits key tools.
What drives the bill: Professional is inexpensive for what it does; Enterprise is quote-based by scanning agents and applications.
Check current pricing on PortSwigger’s siteFigures are indicative and were last reviewed August 2026. Vendors change pricing often; confirm before you commit.
No reviews of Burp Suite yet. If you have used it in anger, yours would be the first.
If Burp Suite is not the right fit, these solve the same problem differently.
Security Testing
The free, open-source DAST scanner that attacks your running application.
Security Testing
DAST with proof-based scanning that confirms a vulnerability is real before reporting it.
Security Testing
Enterprise application security platform: SAST, SCA, DAST, IaC and API security.