Q&A from The Future of AppSec Webinar

Portswigger recently wrapped up their biggest-ever webinar, The Future of AppSec: PortSwigger’s Vision, with thousands of security professionals tuning in live; the questions came thick and fast. Q&A topics range from on-prem deployments of Burp Suite DAST to AI models and product roadmaps.

Whether you’re curious about how Burp AI works behind the scenes, Burp Suite DAST support, or just wondering what’s next for Burp Suite, this Q&A is for you.

Burp Suite DAST Q&A

Q: When is Burp Suite DAST expected to be available for enterprise usage? Interested to get a deep dive demo.
A: You’re in luck, it already is! Burp Suite Enterprise Edition is now called Burp Suite DAST. We renamed it to provide greater clarity around the product’s purpose. Burp Suite DAST continues to be trusted by leading global organizations for scalable, automated security testing, and we’ll keep innovating to add new capabilities.

Keep an eye out for a follow-up webinar with a live demo illustrating the value of Burp Suite DAST.

Q: If you need to follow a specific workflow in the API, could Burp Suite DAST handle it?
A: Yes. Burp Suite DAST can scan APIs defined via OpenAPI, SOAP, Postman collections, and more. For stateful workflows, you can use recorded login sequences or authenticated sessions.

Q: How does this DAST tool compare to traditional DAST solutions and API security tools?
A: Burp Suite DAST delivers deep, accurate scanning of both web apps and APIs. We support REST and SOAP APIs, either in isolation or as part of a broader web app scan. Unlike generic tools, Burp Suite DAST focuses on delivering high-quality results where it matters most.

Burp AI Q&A

Q: Is Burp AI a part of Burp Suite Professional, or do you need to pay for it separately?
A: Burp AI is included in Burp Suite Professional, so no extra subscription is necessary. However, using Burp AI features relies on a built-in credits system, with all users receiving 10,000 free AI credits.

Q: Will user data and methodology be used to train the AI model, or is there privacy?
A: No, user data and methodologies will not be used to train the AI models. We have zero-retention agreements with our AI providers to ensure your data is not stored or used for model training.

Q: Is the AI going to be able to run airgapped and offline?
A: Not at this time. The current AI features rely on cloud-based models that require significant compute power, making offline operation infeasible. However, we’re engaging with users to understand this need for future considerations.

Q: Do you plan to provide the possibility of connecting your own AI model to Burp Suite Pro?
A: Not within the official product or BApp Store extensions. However, you can build a private Burp extension outside the BApp Store that connects to your preferred AI backend.

Q: So, is it possible to NOT have AI implemented out of the box on this new update?
A: Yes, you can disable AI features from the settings menu in Burp Suite Professional.

Q: Do you plan to create an AI-assisted report builder?
A: You can already generate AI-assisted reports using the ReportLM BApp—created by Tom SL. Check it out in the BApp Store!

General Portswigger Q&A

Q: How many of the new features in Burp Suite DAST will be available in Pro?
A: Burp Suite DAST is built using the same scanner in Burp Suite Professional but scaled for automation. The feature set differs as DAST is designed for continuous coverage.

Q: Are you planning to switch the Burp Suite core from Java to Rust or Go?
A: While a language switch has been discussed, our focus is on optimizing and innovating within our current architecture. A complete rewrite would take significant time with marginal benefits.

Burp Suite DAST

Automated DAST scanning without limits. Built on the Burp technology your security teams already trust.

Join Live Walkthrough

LOGON is a Portswigger partner. Take a deep dive into Burp Suite Enterprise Edition Architecture, and discover how you gain complete visibility of your attack surface, empowering your developers.