One DAST platform for the whole application.
Map APIs from source, crawl in a real browser, test fully authenticated, and return evidence developers and agents can use.
One loop: source intelligence, scan, remediation and learning.
Run it from your pipeline on every pull request or deploy, or from the coding agent you already use. Fundamentals: our application and API security testing guide.
Find the apps
Start from your domain to find the web apps and APIs tied to it, or point NightVision at a URL you already know.
Read the source
Source intelligence maps the API routes your frameworks declare in under 20 seconds and hands that map to the API scan.
Test fully authenticated
Recorded Playwright login, MFA included, with a login-check gate. AI endpoints get their own tests.
Fix, prove, carry forward
Your coding agent drafts the fix, a rescan proves it, and false positives you mark stay suppressed.
Go deeper: API discovery from source code, authenticated scanning and remediation and learning.
Find the apps nobody onboarded.
Start from your domain to find the web apps and APIs tied to it, including ones nobody onboarded. Confirm which ones are yours, then turn them into scan targets.
Available on Enterprise. How app discovery works →
Start where you are. Add source and agents when you are ready.
The same engine runs underneath all four. Teams usually start at the first rung: a URL is enough, so it is the fastest way to test the apps that app discovery finds. They climb as access and appetite allow.
Black box
Point it at a running app. A URL or an uploaded spec is enough, fully authenticated with MFA, no source access and nothing for the app's builder to install.
Gray box
Add the source. Repo-derived routes feed the same scan, and source-discovered API findings carry Code Traceback to file and line.
CI/CD
Gate every build. GitHub, GitLab, Jenkins, Azure DevOps, and Bitbucket, with results landing as SARIF in GitHub Security Alerts.
Agent-ready
Any MCP-capable coding agent launches the scan, reads the evidence, drafts the fix, and rescans before a human merges.
The first rung is how security teams cover applications built outside engineering. The fourth is where coding agents plug in.
A DAST platform built around a crawler for modern apps
Modern apps are JavaScript-rendered, validation-gated, and stateful, so legacy crawlers die at the first form. Three mechanisms fix that:
Forms that actually submit
Each rendered form is filled with valid, internally consistent values, so validation-gated submits fire the underlying API. How intelligent form handling works →
No blind timeouts
The crawler advances only when network and DOM activity quiesce: standards-based waiting, no hardcoded sleeps. Why intelligent waits matter →
Every state once
DOM, URL, and action signatures collapse templated screens into one logical state, so crawl budget goes to new surface. The research behind it →
AI endpoints get their own tests. AI endpoint security testing →
Go deeper: DAST built for modern apps. Evaluating vendors? See NightVision vs HCL AppScan and NightVision vs Checkmarx.
Evidence developers and agents can act on
Code Traceback
On supported API scans backed by source intelligence, request-level findings can link to the file and line that defined the endpoint. How source-linked DAST works →
Where developers look
SARIF lands findings in GitHub Security Alerts and the pull request; Validate with Curl replays the request.
Agent fix, verification scan
Your coding agent drafts the change; a rescan shows what is fixed, new and still open before the code enters human review.
Carry it forward
Mark a finding false positive or won't fix once and it stays suppressed in future scans of that app, matched by check, path, method and parameter.
Repository permissions and branch protections still govern what ships. Go deeper: Remediation and learning.
Ready for enterprise review
SOC 2 Type 2 attestation (report available under NDA), plus the controls your security and IT teams already run.
Read what our SOC 2 exam means for you, or see all integrations.
"We demonstrated developer teams executing a DAST scan on a web app … during build time, with tickets for findings opened automatically with Engineering."Steve McKinnon · Senior Application Security Engineer, BeyondTrust
Platform questions, answered.
What is DAST?
Dynamic Application Security Testing tests a running application from the outside, sending real requests and analyzing responses to find vulnerabilities like SQL injection, XSS, and authentication flaws. NightVision retains HTTP evidence on request-level findings so teams investigate observed behavior, not predictions.
How does NightVision run fully authenticated scans with MFA?
Record the login once as a Playwright script; credentials are automatically extracted and vaulted. Scans complete TOTP-based MFA at scan time, and a login-check gate fails the pipeline instead of silently scanning logged out. See authenticated scanning.
How does NightVision run DAST in CI/CD?
Native integrations with GitHub Actions, GitLab CI, Jenkins, Azure DevOps, and Bitbucket. Findings surface in the PR and in GitHub Security Alerts via SARIF; supported source-discovered API scans can add endpoint file and line context.
Can coding agents use NightVision?
Yes. The public MCP server exposes targets, scans, checks, and source intelligence to coding agents, and open-source Agent Skills guide the workflow. Agents can propose fixes and rescan; repository controls govern review and merge. See NightVision for coding agents.
Does NightVision find apps we have not onboarded?
Yes. App discovery starts from your domain to find the web apps and APIs tied to it, including ones nobody onboarded. You confirm which ones are yours, then turn them into scan targets. App discovery is available on Enterprise, and we turn it on for your proof of concept.
See your app the way an attacker maps it.
Map attack surface from the browser and source, and return runtime evidence to the people and agents who own the fix.