PortSwigger makes Burp Suite, the family of tools that penetration testers, AppSec teams and developers use to find vulnerabilities in web applications and APIs.
The problem it addresses is that web applications and APIs change constantly and face the internet, and finding their flaws takes both skilled people and automation. PortSwigger also trains testers and publishes original attack research, which feeds back into the tools.
At A Glance
| Vendor | PortSwigger |
|---|---|
| Category | Web application security testing |
| Deployment | Desktop tools; Burp Suite DAST as managed cloud or self-hosted |
| Agentic AI | Burp AI in Burp Suite Professional; Burp AT |
| Certifications | ISO 27001 |
| First Burp release | 2003 |
| Market classification | Application Security |
What PortSwigger Does
Web applications and APIs change constantly, and attackers look for the one flaw that slipped through. PortSwigger’s answer is to combine human testers with automation rather than pick one. A skilled tester decides where to look and what a finding means; automation covers the checks that can safely be repeated across every application and every code change. AI is added in the same spirit, as help for the tester rather than a replacement, so the person running the test stays in control of it.
Products
Burp Suite Professional
The toolkit for working penetration testers. It centres on an intercepting proxy, with Burp Intruder for customised attacks and a scanner for the checks that can safely be automated. BApp extensions written by the user community, installed from the BApp store and built on the Montoya API, add custom functionality.
Burp Suite DAST
Security teams responsible for dozens or hundreds of applications use Burp Suite DAST to scan them continuously. Scans run on a schedule, on pull request, on merge or on demand. It scans APIs from Postman Collections, OpenAPI, SOAP and GraphQL definitions, and handles Basic, Bearer Token, API Key and OAuth 2.0 Client Credentials authentication with session-aware scanning.
Burp Suite Community Edition
The entry point for people starting out in web security testing. It includes the proxy for HTTP(S) and WebSockets traffic, Repeater, Decoder, Sequencer and Comparer, with Intruder in demo form.
Web Security Academy
An online training resource with hands-on labs, from SQL injection (16 labs) to newer Web LLM attack labs.
How It Works
Burp Suite Professional and Community Edition run on the tester’s own machine, sitting between the browser and the target application. Burp Suite DAST is a server product. It runs as a managed cloud service or self-hosted, with Windows and Linux installers for the dashboard and scanning machines, support for air-gapped environments and a Helm chart for Kubernetes with auto-scaling scanning resources. Self-hosted scanning machines can be added to reach internal targets. In a pipeline, Burp Suite DAST runs as a CI step on each pull request, can block a merge by severity, and sends findings back to the engineer who opened the request.
Agentic AI Capabilities
Burp AI
Burp AI is built into Repeater, and AI-enhanced vulnerability scanning has started with Broken Access Control. Extension developers can call AI from their own BApps through the Montoya API. On data handling, Burp AI operates within PortSwigger’s trust boundary, data is not retained by its third-party AI provider or used for model training, and AI features can be switched off entirely in settings. Usage runs on an AI credit system.
Burp AT
Burp AT is PortSwigger’s agentic testing product. It extends human-led penetration testing with AI agents, keeping the tester in charge of the engagement while the agents take on parts of the work.
Integrations
| Area | Integrations |
|---|---|
| CI/CD | Jenkins, GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, CircleCI, TeamCity |
| Issue tracking | Jira, Jira Service Management, ServiceNow, Azure Boards, GitHub Issues |
| API platforms | Amazon API Gateway, Azure API Management, Google Apigee |
Company Background
| Founder | Dafydd Stuttard, Founder and Chief Executive Officer, who wrote the first version of Burp in 2003. |
|---|---|
| Legal entity | PortSwigger Ltd. |
| Research | PortSwigger Research publishes new web attack techniques and presents them at conferences such as Black Hat USA and DEF CON. |
| Recognition | Included in the Gartner Magic Quadrant for Application Security Testing. |
Note: This overview is compiled from PortSwigger’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.