Fluid Attacks

Fluid Attacks combines automated application security testing with optional pentester-led services. The distinction between its two plans matters: Essential is automated , while Advanced adds manual security testing and expert support.

The platform covers SAST, SCA, DAST, MAST, CSPM and secret scanning. Advanced also includes PTaaS, secure code review and reverse engineering.

Key features at a glance

What is Fluid Attacks?

Fluid Attacks is broader than a standalone DAST tool . Its automated scanners cover source code, dependencies, running applications, mobile applications, cloud configuration and secrets.

The current plans separate that automated coverage from manual services. Essential is the automated tier; Advanced adds pentesters, secure code review, reverse engineering and assistance with complex vulnerabilities.

Automated and manual testing

Fluid Attacks publishes separate scanners and containers for SAST, SCA, DAST, MAST and CSPM. Its current scanner documentation also lists dedicated GitHub Actions for those workflows and for CI Gate.

The SAST product page currently lists 13 supported technologies: Python, Java, Go, JavaScript, HTML, TypeScript, PHP, Ruby, Scala, C#, Dart, Kotlin and Swift. The vendor’s supported-technology list also names REST, GraphQL and WebSockets for API-related coverage.

Manual work belongs to the Advanced plan. According to the reattack documentation , manual reattacks are available for vulnerabilities originally reported by a pentester; automated reattacks are a separate path.

Accuracy and false positives

Fluid Attacks advertises low false-positive rates, but it does not publish a normalized platform-wide false-positive percentage that I could verify. The platform also provides a false-positive request process , so an automated finding should not be described as already human-confirmed by default.

The documented Accuracy SLA applies to Advanced and uses severity and quantity F-scores under stated conditions. It is not a promise that every automated alert receives manual review.

Fluid Attacks also publishes an OWASP Benchmark result for its SAST scanner. That result concerns a specific SAST benchmark and should not be generalized to DAST or to every platform finding.

Connectivity options

Fluid Attacks documents three connection mechanisms :

• Cloud: Direct access to repositories and environments from the Fluid Attacks cloud
• Egress: Access from published static IP addresses that customers can allowlist
• Connector: An agent deployed inside a private network to provide access to in-scope resources

The Connector avoids exposing a private target directly to the public internet. Private DAST targets still require network reachability from the runner or scanning environment.

How to use Fluid Attacks

CI/CD integration

The current DAST GitHub Action documentation uses a dedicated action and a YAML scanner configuration:

name: DAST
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: fluidattacks/dast-action@<version>
        with:
          scan_config_path: .github/dast-config.yaml

Replace <version> with the current release tag from GitHub Marketplace. The documented DAST configuration supports SARIF or CSV output, target URLs and strict build-failure behavior.

Because DAST findings do not map to a source file and line, the vendor recommends storing the result file as a workflow artifact instead of uploading it to GitHub’s code-scanning view.

What does Fluid Attacks integrate with?

The integration catalog covers Jira, Azure DevOps and GitLab for issue tracking; VS Code, IntelliJ and Cursor for editor workflows; and an API, webhooks and an MCP server for automation.

CI Gate works with GitHub, GitLab, Azure, Bitbucket, Jenkins and other Docker-capable CI/CD systems. This makes the platform suitable for teams that want findings and deployment policy in the same workflow.

Development

GitLab

Azure DevOps

Jira Cloud

VS Code

IntelliJ

When to use Fluid Attacks

Fluid Attacks is a fit when a team wants several AppSec testing methods in one commercial platform. Essential covers automated scanning; Advanced is the relevant tier when continuous pentesting or manual code review is required.

Good reasons to evaluate it include:

• Automated SAST, SCA, DAST, MAST, CSPM and secret scanning in one platform
• Severity-based deployment controls through CI Gate
• IDE, issue-tracker, API, webhook and MCP integrations
• Pentester-led testing and review through the Advanced plan
• Direct, static-IP and private-network connection options

Teams looking only for an open-source DAST scanner may prefer ZAP . Teams centered on a manual web-testing workflow may also compare Burp Suite .

For a broader comparison of testing approaches, see SAST vs DAST vs IAST .

How much does Fluid Attacks cost?

Fluid Attacks publishes the structure of its Essential and Advanced plans, but I could not verify a current numerical list price on the vendor’s site. Essential has a 21-day trial, subject to the vendor’s eligibility requirements.

The billing documentation bases subscription usage on authors with activity in registered repositories during the month. Bots can count when they modify in-scope files, and the plans page states a minimum of 10 authors.

Advanced requires contacting sales. Scope and pentester-led services therefore need to be confirmed in a quote rather than inferred from Essential-plan coverage.

What are alternatives to Fluid Attacks?

The closest alternative depends on which part of Fluid Attacks matters:

• Burp Suite : Compare for manual web security testing and extensibility.
• Invicti : Compare for enterprise DAST and proof-based scanning workflows.
• Acunetix : Compare for commercial web vulnerability scanning.
• ZAP : Compare when an open-source DAST scanner is the priority.
• Veracode : Compare for a broader enterprise application security platform.

Compare current target coverage, private-network access, CI policy, manual-service scope and contract terms during evaluation.

Frequently Asked Questions