Checkmarx • Application security
Checkmarx DAST exercises running web, API, and mobile applications from the outside in with authenticated session handling, OWASP Top 10 coverage, and runtime business-logic testing, then routes findings into the same Checkmarx One backlog as SAST and SCA so AppSec works one queue instead of three.
A Merito Checkmarx DAST engagement points the scanner at staging or pre-prod, builds out authenticated session handling for the customer's actual SSO and OAuth flows, and feeds runtime findings into the same Checkmarx One backlog the SAST and SCA programs already work.
What it is
Checkmarx DAST is the dynamic analysis engine inside Checkmarx One. It runs against the deployed application, not the source code, exercising web apps through the UI, REST and GraphQL APIs through the network surface, and mobile apps through the runtime. The output catches what static analysis cannot see: runtime configuration flaws, broken authentication flows, server misconfiguration, business-logic vulnerabilities that only manifest when real requests cross the network boundary.
Authenticated scanning is the load-bearing capability. Most applications worth testing sit behind authentication, and DAST that cannot maintain session through SSO, multi-step login, or token refresh ends up scanning the public landing page and missing the application. Checkmarx DAST handles SAML, OAuth, OIDC, multi-factor flows, and custom session protocols so the scan reaches what the user reaches. Programs running unauthenticated DAST are not running DAST.
Cross-product correlation is the platform advantage. DAST findings cross-reference back to Checkmarx SAST findings on the same code path so AppSec sees both the source-level vulnerability and the runtime confirmation in one ticket. SCA reachability data informs which OSS dependencies the runtime actually exercises. Triage and Remediation clusters DAST findings together with related SAST and SCA findings on root cause. Programs running DAST as a standalone tool against a different vendor's SAST get fragmented findings; programs running Checkmarx DAST inside Checkmarx One get unified backlog math.
What breaks DAST adoption is environment access. DAST needs a runnable application with realistic data, working authentication, and network reachability from the scanner. Programs that run DAST against an empty staging environment with a generic test account scan a hollow shell. Merito's engagement starts with environment readiness (test data, authentication wiring, scan-window scheduling) before pointing the scanner at anything real, and tunes the policy to the specific application surface rather than running default rules across web, API, and mobile as if they were the same.
Ideal use cases
What it is best at
SAML, OAuth, OIDC, multi-factor, and custom session handling. The scanner reaches the application the user reaches. Tools that lose session after the first redirect end up testing nothing useful.
Same scanner covers web apps, REST and GraphQL APIs, and mobile-app backends. Programs stop stitching together specialist DAST tools per surface.
DAST findings cross-link to the SAST flow path that introduced them and the SCA dependency at the runtime layer. AppSec triages once, not three times.
Runtime exploration of multi-step flows surfaces business-logic flaws (broken authorization, IDOR, race conditions) that pure rule-based scanners miss.
Scans run against persistent staging environments with realistic data and authentication. The findings reflect what attackers will see, not what a synthetic dev environment exposes.
Core capabilities
What separates DAST that finds real issues from DAST that scans the public landing page.
Authenticated session handling
SAML, OAuth 2.0, OIDC, multi-factor, and custom session protocols. The scanner stays logged in across multi-step flows.
OWASP Top 10 and beyond
Coverage of injection, broken auth, misconfiguration, sensitive data exposure, and the rest of the OWASP catalog. Plus business-logic flaws caught through guided exploration.
API scanning (REST, GraphQL, SOAP)
Imports OpenAPI, GraphQL schema, or Postman collections and tests every endpoint with realistic auth and payload.
Mobile DAST
Native iOS and Android app scanning plus the backend services they call. Cross-references mobile findings with the API surface they consume.
Adapting the scanner to the customer's actual application surface rather than running defaults.
Application-specific tuning
Scan policies tunable per application, with web, API, and mobile policies separated rather than blended into one default.
Crawling depth and scope
Configurable crawl depth, allow-and-deny lists, and parameter handling so the scan covers what matters and skips what does not.
Scan windows and rate limiting
Configurable scan windows, request rate, and concurrency so DAST does not knock production-shaped staging environments offline.
DAST output flowing into the AppSec backlog with the rest of Checkmarx One.
Cross-product correlation
DAST findings cross-link to SAST flow paths and SCA dependencies. One ticket, not three.
Triage and Remediation clustering
Related DAST, SAST, and SCA findings cluster on root cause for single-fix remediation.
Build-gate and ticketing integration
DAST results gate the staging-to-prod promotion and flow into Jira, Azure Boards, and ServiceNow as work items.
Compliance reporting
Audit-ready evidence for PCI DSS, HIPAA, SOC 2, and ISO 27001 attestations.
Where it fits in the stack
Deployment and implementation
Licensing and packaging
Checkmarx One Advanced
Adds DAST, API Security, IaC Security, Malicious Package Protection, and Repository Health to the Essentials baseline.
Best for: Programs adding DAST and API Security to an existing SAST or SCA footprint.
Checkmarx One Enterprise
Advanced plus AI agents (Developer Assist, Triage and Remediation), AI Supply Chain Security, Software Supply Chain Security, and premium SLAs.
Best for: Enterprise programs running DAST inside a fully consolidated AppSec platform.
Merito services
Merito sells licenses and the delivery work around them. Pick the service that matches where you are in the lifecycle.
Tenant setup, authenticated-scanning wiring, policy tuning per application, and CI/CD integration.
Explore service02AppSec program scoping for Checkmarx DAST adoption alongside StackHawk, Bright, OWASP ZAP, and OpenText DAST.
Explore service03DAST scheduled and gated in Jenkins, GitHub Actions, GitLab CI, Azure DevOps, and Bitbucket pipelines.
Explore service04Developer enablement and AppSec champion programs around DAST findings.
Explore service05Named engineer, priority SLAs, and release-time coverage for Checkmarx DAST.
Explore service06Long-term run support including authenticated-scan maintenance, scan-window operation, and policy evolution.
Explore service07Role-based training for AppSec architects, security engineers, and developers consuming DAST output.
Explore service08Merito-placed AppSec engineers and Checkmarx specialists embedded on long-running programs.
Explore serviceCheckmarx DAST licensing
Checkmarx DAST pricing arrives with authenticated-session wiring, per-application policy tuning, scan-window scheduling, and CI/CD integration that turn the scanner into a working AppSec program.
Merito point of view
Merito has audited DAST programs that ran nightly against production-shaped staging, generated thousands of findings, and missed every business-logic flaw because the scanner lost session at the SSO redirect. Authenticated scanning is the difference between testing the application and testing the public landing page. Checkmarx DAST handles real session protocols; programs that adopt DAST without configuring authentication correctly are doing compliance theater.
Merito recommends Checkmarx DAST specifically when the AppSec program already has Checkmarx One or is consolidating onto it, when the runtime surface includes APIs and mobile alongside web, and when cross-product correlation with SAST and SCA matters. For web-only programs with strong open-source toolchains, OWASP ZAP plus a CI integration is sometimes enough; for programs that want managed cloud DAST without the rest of Checkmarx, StackHawk or Bright might fit better. Merito surfaces those alternatives honestly.
API DAST is where the program math changes. The API surface is usually the actual application; the web frontend is the easy half. Programs running DAST without API scanning are scanning the visible part and missing the structural risk. Merito's engagements include OpenAPI or GraphQL schema ingestion as a default, not an upsell.
What buyers usually underestimate
Related from Merito
Related solutions
Related services
Related products
Frequently Asked Questions
Consultation request
Share your application surface (web, API, mobile), authentication shape, and current DAST tool if any. A Merito Checkmarx specialist follows up within one business day.
Real authenticated scanning
SAML, OAuth, OIDC, multi-factor, and custom session protocols. Tools that lose session after the first redirect end up testing nothing useful.
Cross-product correlation
DAST findings cross-link to SAST flow paths and SCA dependencies inside Checkmarx One. AppSec triages once.
Next step
A Merito Checkmarx DAST engagement starts with authentication wiring and per-application policy tuning. Default-rule scans against landing pages are not DAST.