Veracode
Crashtest Security (Veracode DAST Essentials) test
Dynamic Application Security Testing · Category 9. DAST · Tier 2
CL Listed — Visible
Methodology v3.5 · OLIR Schema
Avril 2026
Evaluation Tier:
Visible (Listed)
→
Verified (CAE)
→
Enterprise (EEE)
Layer 1-2 only · Documentary assessment · All capabilities vendor-claimed
⚡ Executive Summary 30 seconds
What it is
Lightweight cloud-based Dynamic Application Security Testing (DAST) solution designed for automated vulnerability scanning of web applications and APIs. Originally an independent German startup, now integrated into the Veracode platform as DAST Essentials, targeting SMBs and mid-market teams seeking quick OWASP Top 10 coverage.
Best for
OWASP Top 10 compliance (automated detection of injection, XSS, misconfigurations), PCI DSS Req. 6.2 (web application vulnerability scanning), CI/CD pipeline gating for agile teams. Ideal for small-to-medium development teams needing fast, self-service DAST without heavy infrastructure.
What it does NOT do
No static analysis (SAST), no source code review, no SCA (Software Composition Analysis), no runtime protection (RASP), no WAF, no API discovery, no mobile application testing. Not a full AppSec platform — focuses exclusively on dynamic web and API vulnerability scanning.
CL Recommendation
Crashtest Security is a pragmatic entry-level DAST for teams that need automated web scanning without enterprise complexity. Strong on OWASP Top 10 detection and CI/CD integration. Best suited for PCI DSS 6.x web scanning requirements and OWASP compliance. Combine with SAST (Cat. 9), WAF (Cat. 6), and SIEM (Cat. 12) for full application security coverage. Consider upgrading to full Veracode platform for enterprise-scale needs.
⚖ Regulatory Fit Per regulation verdict
PCI DSS v4.0
~14% of requirements
● Moderate — Req. 6.2 (web app scanning), Req. 6.4 (public-facing app protection)
DORA
~8% of obligations
△ Supporting only — Art. 8(5) ICT testing methodologies
NIS2
~6% of Art. 21
△ Supporting only — Art. 21(2)(e) vulnerability identification
GDPR
~3% of articles
△ Minimal — Art. 32 (security of processing via secure apps)
HIPAA
~4% of provisions
△ Minimal — §164.312(e) transmission security via app hardening
OWASP Top 10
~8 of 10 categories
✔ Strong — A01-A10 automated detection (injection, XSS, misconfig, SSRF)
PCI DSS v4.0 (PROPRIETARY)
| Focal | Obligation | OLIR Rel. | Hub Ref | Rationale |
|---|
| Req. 6.2.4 | Web application vulnerability scanning | Direct | RA-5 / ID.RA-01 | Functional |
| Req. 6.4.1 | Protect public-facing web apps | Contributing | SA-11 / PR.PS-06 | Semantic |
| Req. 11.3.1 | External vulnerability scans | Contributing | RA-5 / ID.RA-01 | Semantic |
DORA (OPEN_GOV)
| Focal | Obligation | OLIR Rel. | Hub Ref | Rationale |
|---|
| Art. 8(5) | ICT testing methodologies | Contributing | SA-11 / PR.PS-06 | Semantic |
| Art. 24(1) | Threat-led penetration testing | Contributing | CA-8 / RS.AN-02 | Semantic |
NIS2 (OPEN_GOV)
| Focal | Obligation | OLIR Rel. | Hub Ref | Rationale |
|---|
| Art. 21(2)(e) | Security in system acquisition/dev | Contributing | SA-11 / PR.PS-06 | Semantic |
| Art. 21(2)(d) | Supply chain security | Contributing | SR-3 / GV.SC-05 | Semantic |
Articles without contribution omitted. Full OLIR mapping available in Audit Pack export.
🎯 Buyer Guidance Decision support
✔ Consider When
- + Need lightweight automated DAST for OWASP Top 10 compliance
- + SMB or mid-market team without dedicated AppSec engineers
- + PCI DSS Req. 6.2/6.4 web application scanning requirement
- + CI/CD pipeline integration for continuous security testing
- + Quick setup required — no on-prem infrastructure available
- + Budget-conscious team needing affordable DAST entry point
❌ Avoid When
- − Enterprise-scale application security program needed
- − Need SAST, SCA, or IAST in addition to DAST
- − Complex authenticated scanning with multi-step workflows
- − Mobile application testing required
- − Need advanced API discovery and fuzzing capabilities
- − Require on-prem deployment for air-gapped environments
⚙ Capabilities 19 claimed · 4 groups · DR-2 Quality Tiers + Config Modifiers
Automated Scanning 4✓ 1● 0✗▼
✓OWASP Top 10 scanning
Automated detection of A01-A10 vulnerabilities
Specific Obl.Out-of-Box
✓Scheduled recurring scans
Cron-based automated scan scheduling
Control FamilyOut-of-Box
✓Multi-target scanning
Scan multiple domains/subdomains in parallel
Control FamilyConfig Change
✓Crawl-based discovery
Automatic sitemap and endpoint enumeration
Generic ControlOut-of-Box
●Authenticated scanning
Login-based scanning with session management
Control FamilyConfig Change
Vulnerability Detection 4✓ 1● 0✗▼
✓SQL injection detection
Error-based, blind, time-based SQLi
Specific Obl.Out-of-Box
✓XSS detection
Reflected, stored, DOM-based XSS
Specific Obl.Out-of-Box
✓Security misconfiguration
Headers, CORS, SSL/TLS, directory listing
Specific Obl.Out-of-Box
✓SSRF detection
Server-Side Request Forgery identification
Control FamilyOut-of-Box
●API vulnerability testing
REST API endpoint security testing
Control FamilyConfig Change
CI/CD Integration 4✓ 0● 0✗▼
✓Jenkins plugin
Native Jenkins pipeline integration
Control FamilyOut-of-Box
✓GitLab CI integration
YAML template for GitLab pipelines
Control FamilyConfig Change
✓GitHub Actions support
Marketplace action for GitHub workflows
Control FamilyConfig Change
✓REST API
Programmatic scan triggering and results retrieval
Control FamilyOut-of-Box
Reporting 4✓ 1● 0✗▼
✓OWASP Top 10 report
Pre-built compliance template with severity mapping
Specific Obl.Out-of-Box
✓PDF/HTML export
Downloadable scan results for auditors
Generic ControlOut-of-Box
✓Trend dashboard
Historical vulnerability trend tracking
Generic ControlOut-of-Box
✓Remediation guidance
Fix recommendations per vulnerability
Data SurfacedOut-of-Box
●Jira/ticketing integration
Auto-create tickets for findings
Control FamilyConfig Change
🛡 MITRE ATT&CK Mapping Layer 4 — Derived via SP 800-53
M1016
Vulnerability Scanning
Full (claimed)
M1050
Exploit Protection
Partial (claimed)
M1013
Application Developer Guidance
Partial (claimed)
Score: 2.8 / 5.0 (56%) — All vendor-claimed. Techniques addressed: T1190, T1059, T1203 (exploitation & injection family).
▼ Show ATT&CK techniques detail| Technique | Name | How Addressed | Provenance |
|---|
| T1190 | Exploit Public-Facing Application | DAST scanning identifies exploitable web app vulnerabilities before attackers | DERIVED via M1016 |
| T1059 | Command and Scripting Interpreter | Detects injection flaws (SQL, OS command injection) in running applications | DERIVED via M1016 |
| T1203 | Exploitation for Client Execution | Identifies XSS and client-side injection vulnerabilities | DERIVED via M1050 |
📄 Evidence Pack DR-2 §5.1 — Proof of value
✔DAST scan reports (PDF/HTML)
Detailed vulnerability findings with OWASP mapping. Exportable.
✔OWASP Top 10 compliance report
Pre-built compliance template with pass/fail per category.
✔CI/CD pipeline logs
Scan execution logs with pass/fail gate decisions.
✔Remediation recommendations
Fix guidance per vulnerability with code examples.
❌Third-party validation
No independent third-party testing publicly available.
⚠SOC 2 Type II report
Available via Veracode parent company.
Evidence level: Documentary review only (CL Listed). For verified evidence, upgrade to CAE (Examine + Interview) or EEE (+ Test).
⏱ Operational Metrics & Anti-Hype DR-2 §5.1 + §9.2
| Metric | Essentials (Single Target) | Professional (Multi-Target) | Enterprise (Full Veracode) |
|---|
| Implementation | 1-2 days | 1-2 weeks | 4-8 weeks |
| FTE Required | 0.1 FTE | 0.25 FTE | 0.5 FTE |
| Time to first value | Day 1 (first scan results within hours of signup) |
| Time to production | Week 1-4 (all targets onboarded, CI/CD gates active, scan schedules configured) |
Anti-Hype: Marketing vs. Reality
Full OWASP Top 10 coverage
Covers 8 of 10 categories effectively. A04 (Insecure Design) and A08 (Software Integrity) require manual review.
Partial
5-minute setup
Basic scan can start in minutes. Authenticated scanning and CI/CD integration require additional configuration.
Partial
Enterprise-grade DAST
SMB-focused tool. Lacks advanced features like macro recording, complex auth flows, and IAST correlation.
Misleading
Seamless Veracode integration
Integration with Veracode platform is ongoing post-acquisition. Some features still operate independently.
Partial
Zero configuration needed
Works out-of-box for simple sites. SPAs, APIs, and authenticated areas require significant configuration.
Misleading
⚖ Strengths & Cautions
✔ Strengths
- + Extremely fast time-to-value — first scan in minutes
- + SMB-friendly pricing and self-service model
- + Strong OWASP Top 10 automated detection
- + Native CI/CD integration (Jenkins, GitLab, GitHub Actions)
- + Cloud-native SaaS — no infrastructure required
- + Clean UI with actionable remediation guidance
- + Part of Veracode ecosystem for future growth path
⚠ Cautions
- ! Limited to DAST only — no SAST, SCA, or IAST
- ! Authenticated scanning capabilities are basic compared to enterprise tools
- ! Post-acquisition Veracode integration still maturing
- ! No on-prem deployment option
- ! Limited API testing depth — no GraphQL or gRPC support
- ! No mobile application testing capability
- ! All capabilities VENDOR-CLAIMED (no CL independent testing)
📈 Competitive Positioning Category 9 — DAST
| Capability | Crashtest Security (Veracode DAST Essentials) test | Invicti | HCL AppScan | Acunetix |
|---|
| OWASP Top 10 scanning | ✔ | ✔ | ✔ | ✔ |
| Authenticated scanning | ● | ✔ | ✔ | ✔ |
| API security testing | ● | ✔ | ✔ | ✔ |
| CI/CD integration | ✔ | ✔ | ✔ | ✔ |
| IAST capability | ✗ | ✔ | ✔ | ✗ |
| On-prem deployment | ✗ | ✔ | ✔ | ✔ |
| Pricing entry | SMB-friendly | Enterprise | Enterprise | Mid-market |
Competitive data based on public information. CL has not evaluated these alternatives — for detailed assessment, see individual CL Listings.
📑 Framework Views Hub: CSF 2.0 + 800-53r5 + ISO 27001
▼ Show NIST SP 800-53, CSF 2.0, ISO 27001 mapping tablesNIST SP 800-53 Rev 5
| Control | Name | Contribution | Provenance |
|---|
| RA-5 | Vulnerability Monitoring & Scanning | direct | DERIVED via PCI DSS 6.2 |
| SA-11 | Developer Testing & Evaluation | contributing | DERIVED via PCI DSS 6.4 |
| SI-10 | Information Input Validation | direct | DERIVED via OWASP A03 |
| CA-8 | Penetration Testing | contributing | CL-ORIGINAL |
NIST CSF 2.0
| Control | Name | Contribution | Provenance |
|---|
| IDENTIFY | ID.RA-01 Vulnerability identification | direct | DERIVED via RA-5 |
| PROTECT | PR.PS-06 Secure software development | contributing | DERIVED via SA-11 |
| DETECT | DE.CM-09 Software monitoring | contributing | CL-ORIGINAL |
| RESPOND | RS.AN-02 Impact analysis | contributing | CL-ORIGINAL |
ISO 27001:2022 Annex A
| Control | Name | Contribution | Provenance |
|---|
| A.8.29 | Security testing in dev & acceptance | direct | DERIVED via NIS2-ISO |
| A.8.8 | Management of technical vulnerabilities | direct | DERIVED via OWASP-ISO |
| A.8.25 | Secure development life cycle | contributing | CL-ORIGINAL |
| A.8.9 | Configuration management | contributing | CL-ORIGINAL |
| SSDF ID | Practice | Status |
|---|
| PW.1 | Risk-based secure design | Claimed |
| RV.2 | Timely vulnerability remediation | Claimed |
| PO.5 | Secure development environment | Claimed |
| PS.3 | SBOM available | Not stated |
| RV.1 | Vulnerability disclosure program | Claimed |
| PS.2 | Code signing | Unknown |
Compliance Labs · Software Listing v3.5 · OLIR Schema
Hub: CSF 2.0 ↔ 800-53r5 ↔ ISO 27001 · Avril 2026
