Veracode Dynamic Analysis

Veracode Dynamic Analysis is an enterprise DAST platform that scales to hundreds of web applications. It runs alongside Veracode’s SAST and SCA products on a single platform with unified flaw tracking, policy management, and compliance reporting.

Named a Leader in the 2025 Gartner Magic Quadrant for Application Security Testing, Veracode has built its DAST offering around portfolio-scale management. The SaaS architecture means you can run parallel scans across your entire application inventory without managing scanning infrastructure.

The 2022 Crashtest Security acquisition added better JavaScript SPA support and developer-focused CI/CD integration.

What is Veracode Dynamic Analysis?

Veracode DAST performs black-box testing of running web applications and APIs. You configure scan targets through the Veracode platform or API, and the scanner crawls and attacks each application to find vulnerabilities.

Results feed into the same dashboard as Veracode Static Analysis and SCA findings. This means security teams see a single view of each application’s risk — what static analysis flagged in the code, what open-source vulnerabilities exist in dependencies, and what dynamic testing found exploitable at runtime.

For applications not accessible from the internet, Veracode offers Internal Scanning Management (ISM), a Docker-based agent that sits inside your network and connects outbound to the Veracode cloud. No inbound firewall rules needed.

Key Features

JavaScript SPA Testing

The Crashtest Security acquisition in 2022 brought better support for modern JavaScript frameworks:

• Full browser rendering for React, Angular, and Vue applications
• JavaScript event handling and AJAX request discovery
• Client-side form validation bypass
• DOM-based XSS detection

These capabilities matter for organizations with modern frontends that older DAST engines struggle to crawl properly.

API Security Testing

Veracode tests REST and SOAP APIs, with OpenAPI/Swagger spec import:

# API scan configuration example
scan:
  type: api
  specification:
    type: openapi
    url: https://api.example.com/openapi.json
  authentication:
    type: bearer_token
    token: ${API_TOKEN}
  endpoints:
    include:
      - /api/v1/*
    exclude:
      - /api/v1/health

GraphQL introspection and testing is also supported.

Custom Crawling with Selenium

For applications with complex navigation flows, Veracode supports Selenium-based crawl scripts. Record login sequences, multi-step workflows, and application-specific interactions that the automated crawler can’t figure out on its own.

Policy Management

Define security policies at the organization level and enforce them across all applications:

• Require no high-severity DAST findings before production deployment
• Set different thresholds for different application risk levels
• Automate policy checks in CI/CD pipelines
• Generate compliance evidence for auditors

Integrations

Veracode Platform

Veracode SAST

Veracode SCA

Veracode Fix

CI/CD & DevOps

GitHub Actions

GitLab CI

Jenkins

Azure DevOps

Ticketing & IDE

Jira

ServiceNow

VS Code

IntelliJ

Getting Started

CI/CD Integration

GitHub Actions

name: Veracode Dynamic Scan
on:
  push:
    branches: [main]

jobs:
  veracode-dast:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to staging
        run: ./deploy-staging.sh

      - name: Start Veracode Dynamic Scan
        env:
          VERACODE_API_ID: ${{ secrets.VERACODE_API_ID }}
          VERACODE_API_KEY: ${{ secrets.VERACODE_API_KEY }}
        run: |
          curl -s -X POST "https://api.veracode.com/was/configservice/v1/analyses" \
            -H "Authorization: VERACODE-HMAC-SHA-256 ..." \
            -H "Content-Type: application/json" \
            -d '{
              "name": "CI Build ${{ github.run_number }}",
              "scans": [{
                "scan_config_request": {
                  "target_url": {
                    "url": "https://staging.example.com"
                  }
                }
              }]
            }'

When to Use Veracode Dynamic Analysis

Veracode DAST is built for organizations managing large application portfolios. If you already use (or plan to use) Veracode SAST or SCA, adding DAST gives you a single dashboard for all three testing types with unified policy enforcement.

Good fit for:

• Large enterprises with hundreds of web applications to scan
• Teams already using other Veracode products (SAST, SCA)
• Organizations needing to scan internal/firewalled applications (via ISM)
• Compliance-driven programs wanting unified reporting across test types
• Teams scanning JavaScript SPAs built with React, Angular, or Vue

Not the best fit if:

• Budget favors open-source — ZAP and Nuclei are free
• You want a standalone DAST tool without a platform
• You have a handful of applications and don’t need portfolio management
• You prefer developer-first DAST tools over enterprise platforms

Frequently Asked Questions