F5 Web application scanning

Name: F5 Web application scanning
Brand: F5
Rating: 4.7 (32 reviews)

Leader

We deliver and secure every app.

Est 1996|Valuation $25.9B|Raised $10K

LinkedIn 404K|Website|Web traffic 875K|FTEs 6,167|HQ Seattle, WA

MarketsApplication Security Testing (AST)

Published May 16, 2026

01Common complaints

- Requirement for a standalone DAST product without platform dependency: the scanning capability is associated with the Distributed Cloud platform and may require a base subscription. - Inability to provide authenticated access for testing: if creating test accounts or handling 2FA secrets is not possible, scan coverage will be limited. - Inability to accommodate scanner source traffic: if allowlisting required source IPs or adjusting rate limiting/bot defenses is not feasible, scans may fail or be incomplete. - Immediate need for public compliance artifacts: public sources reviewed did not provide clear, centrally documented certification artifacts for the scanning service; procurement requiring those artifacts upfront should prioritize vendors with explicit trust center documentation. - Requirement for extensive third-party case studies with named customer ROI: public evidence for detailed case studies and verifiable ROI was limited in the materials reviewed.

Deal disqualifiers (poor fit)

Very small teams seeking a simple, low-setup scanner with fully transparent self-service pricing.
Environments where allowlisting scanner IPs and providing credentials is infeasible for security or policy reasons.
Organizations with strict data residency requirements that cannot be met by vendor assurances provided during procurement.

Vendor-acknowledged limitations and operational constraints

Allowlisting requirements and scanner IP management: documentation specifies scanner IPs and describes an option for known IPs versus ephemeral IPs, which affects onboarding complexity.
Scan duration: average scan durations are on the order of multiple hours for non-trivial authenticated scans, which may not align with synchronous CI pipeline expectations.

Practical limitations common to DAST

Difficulty scanning single-page applications and complex JavaScript-driven state.
Challenges with multi-step or atypical authentication flows.
Interference from rate limiting, bot protections, and WAF controls that may require tuning.
Automated testing limitations for business-logic vulnerabilities that require manual analysis.

Roadmap signals

Vendor changelogs and release notes indicate ongoing feature additions, including enhancements for LLM discovery and testing.

02Why they buy

Key differentiators supported by product documentation

- Combined reconnaissance and scanning in a single service (EASM + DAST), enabling discovery of external assets and subsequent testing. - Authenticated scanning support including RFC 6238-based OTP generation for 2FA scenarios and support for multiple test user accounts to evaluate access control scenarios. - Reporting that includes screenshots and video evidence intended to assist validation and remediation workflows. - Features targeted at identifying and testing LLM integrations within web applications, mapped to relevant testing frameworks.

Areas where competitors may have advantages

Greater pricing transparency and self-service trial experiences for initial evaluation.
Longer track records in pure-play DAST for some enterprise customers and integration with mature vulnerability management ecosystems.

03Field reports

Gartner Peer Insights (summary of accessible listing)

Gartner Peer Insights shows a high average rating for the product listing with a moderate number of ratings. The listing includes both positive comments and notes about setup sensitivity. Example review excerpt visible in the listing preview describes detailed vulnerability detection for cloud and AI-enabled applications while noting that accurate setup is required. Limitations of the publicly visible Gartner snippet: full review texts often require click-through to view and the preview may not show lower-rated reviews or detailed critical feedback.

Community feedback (Reddit and other forums)

Direct public forum discussions specifically about Web App Scanning are limited. Relevant threads reference the product’s lineage and broader vendor ecosystem concerns that may be relevant to procurement risk, such as anecdotal negative sentiment about vendor support in other product lines and integration issues documented for other F5 products. Specific forum statements should be treated as anecdotal and used to inform vendor diligence rather than as definitive performance measures. Example community points: - Discussion about the Heyhack origin of the scanning technology and rebranding. - Anecdotal complaints about vendor support in other F5 product areas; these are relevant to vendor relationship risk but not specific to the scanning product.

TrustRadius / G2

TrustRadius reviews located for F5’s Distributed Cloud WAF reflect user experiences with WAF/WAAP rather than with the scanning service specifically. A clearly identifiable review page for F5 Distributed Cloud Web App Scanning on G2 was not found in the sources retrieved.

Reasons customers choose the product (inferred from reviews and positioning)

Based on review snippets and product positioning, common drivers for selection include:

Interest in a single service that combines domain reconnaissance and automated DAST with detailed evidence in reports.
The ability to integrate scanning results into DevOps workflows (Jira, Azure DevOps, GitHub integrations are documented).
Interest in scanning features targeting AI/LLM components in web applications.

Reasons some customers decline or leave (evidence and typical buyer friction)

Publicly accessible churn evidence specific to Web App Scanning was limited. Likely deal-breakers based on documentation and community commentary include: - The need to allowlist scanner IPs and manage test credentials/2FA secrets, which creates operational overhead. - Preference for established DAST incumbents (Invicti, Burp, Qualys, Rapid7) that may have deeper enterprise references or broader integrations for specific procurement stakeholders. - Platform bundling: requirement for a Distributed Cloud Base Package subscription may be an obstacle for buyers seeking a standalone scanning product.

Vendor-published narratives (limited independently verifiable detail)

Vendor-published materials available publicly for this report did not include detailed case studies with named customers and independently verified ROI metrics for Web App Scanning. Materials located include vendor solution overviews describing intended benefits such as continuous visibility and audit-friendly reporting. Some industry write-ups include adoption or award mentions without independent verification of customer lists or measurement methodologies. Critical evaluation guidance: treat vendor adoption and impact claims as directional until validated through: - customer reference calls, - independent analyst reports, or - contract-level SLAs and documentation.

04Best fit

Company sizes

Best fit: mid-market through large enterprise organizations (multiple hundreds to many thousands of employees) that operate multiple internet-facing applications and APIs. Smaller organizations may be a fit if they already use the Distributed Cloud Base Package and can utilize the included entitlement for a limited number of apps.

Industries

Sectors with continuous external exposure and audit requirements such as finance, healthcare, e-commerce, and SaaS are likely fits.

Roles/personas

Decision makers: CISO, Head of AppSec, Director of Security Engineering.
End users: AppSec engineers, security testers, DevSecOps practitioners, and vulnerability management teams.

Pain points addressed

Discovery of unknown or forgotten public-facing applications and APIs.
Need for more frequent automated testing than periodic manual penetration tests.
Requirement for reproducible evidence to support audit and remediation workflows.

Qualification criteria (good fit)

Capability to provision test accounts and manage 2FA secrets for authenticated testing.
Established processes to triage findings and create remediation tickets.
Interest in integrating findings with protective controls such as WAAP/WAF rules within the same vendor environment.

05The pitch

What the product does (objective value proposition)

F5 Distributed Cloud Web App Scanning is a cloud-delivered security service that combines: - External Attack Surface Management (EASM) ("Recon"): discovers public-facing applications, APIs, and services across a company’s domains and highlights exposures such as server fingerprints, ownership, and known CVEs. - Dynamic Application Security Testing (DAST) ("Scan"): executes automated penetration tests against web applications and APIs (including authenticated flows) and produces findings that include screenshots and videos along with remediation guidance. F5 describes the product as providing continuous identification of vulnerabilities across an organization’s external footprint (web applications and APIs), intended to complement (not replace) WAF/WAAP controls that mitigate exploitation. Key functional items reported by vendor documentation: OWASP-aligned testing; authenticated testing (including support for OTP-based 2FA); capture of screenshots and videos as evidence; scheduling capabilities; integrations into SDLC tooling; and recent support for LLM/AI testing mapped to OWASP Top 10 for LLM Applications.

Target market and positioning

Primarily mid-market to enterprise security teams (AppSec, SecOps) that require scalable, continuous scanning of many internet-exposed applications and APIs across multi-cloud and hybrid environments.
Also marketed toward organizations deploying AI-enabled web applications with LLM integrations, given messaging around discovering and testing LLM exposure.

Get a comprehensive analysis of F5 Web application scanning including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published May 16, 2026

01Common complaints

Requirement for a standalone DAST product without platform dependency: the scanning capability is associated with the Distributed Cloud platform and may require a base subscription.
Inability to provide authenticated access for testing: if creating test accounts or handling 2FA secrets is not possible, scan coverage will be limited.
Inability to accommodate scanner source traffic: if allowlisting required source IPs or adjusting rate limiting/bot defenses is not feasible, scans may fail or be incomplete.
Immediate need for public compliance artifacts: public sources reviewed did not provide clear, centrally documented certification artifacts for the scanning service; procurement requiring those artifacts upfront should prioritize vendors with explicit trust center documentation.
Requirement for extensive third-party case studies with named customer ROI: public evidence for detailed case studies and verifiable ROI was limited in the materials reviewed.

Deal disqualifiers (poor fit)

Very small teams seeking a simple, low-setup scanner with fully transparent self-service pricing.
Environments where allowlisting scanner IPs and providing credentials is infeasible for security or policy reasons.
Organizations with strict data residency requirements that cannot be met by vendor assurances provided during procurement.

Vendor-acknowledged limitations and operational constraints

Allowlisting requirements and scanner IP management: documentation specifies scanner IPs and describes an option for known IPs versus ephemeral IPs, which affects onboarding complexity.
Scan duration: average scan durations are on the order of multiple hours for non-trivial authenticated scans, which may not align with synchronous CI pipeline expectations.

Practical limitations common to DAST

Difficulty scanning single-page applications and complex JavaScript-driven state.
Challenges with multi-step or atypical authentication flows.
Interference from rate limiting, bot protections, and WAF controls that may require tuning.
Automated testing limitations for business-logic vulnerabilities that require manual analysis.

Roadmap signals

Vendor changelogs and release notes indicate ongoing feature additions, including enhancements for LLM discovery and testing.

02Why they buy

Key differentiators supported by product documentation

Combined reconnaissance and scanning in a single service (EASM + DAST), enabling discovery of external assets and subsequent testing.
Authenticated scanning support including RFC 6238-based OTP generation for 2FA scenarios and support for multiple test user accounts to evaluate access control scenarios.
Reporting that includes screenshots and video evidence intended to assist validation and remediation workflows.
Features targeted at identifying and testing LLM integrations within web applications, mapped to relevant testing frameworks.

Areas where competitors may have advantages

Greater pricing transparency and self-service trial experiences for initial evaluation.
Longer track records in pure-play DAST for some enterprise customers and integration with mature vulnerability management ecosystems.

03Field reports

Gartner Peer Insights (summary of accessible listing)

Gartner Peer Insights shows a high average rating for the product listing with a moderate number of ratings. The listing includes both positive comments and notes about setup sensitivity.

Example review excerpt visible in the listing preview describes detailed vulnerability detection for cloud and AI-enabled applications while noting that accurate setup is required.

Limitations of the publicly visible Gartner snippet: full review texts often require click-through to view and the preview may not show lower-rated reviews or detailed critical feedback.

Community feedback (Reddit and other forums)

Example community points:

Discussion about the Heyhack origin of the scanning technology and rebranding.
Anecdotal complaints about vendor support in other F5 product areas; these are relevant to vendor relationship risk but not specific to the scanning product.

TrustRadius / G2

Reasons customers choose the product (inferred from reviews and positioning)

Based on review snippets and product positioning, common drivers for selection include:

Interest in a single service that combines domain reconnaissance and automated DAST with detailed evidence in reports.
The ability to integrate scanning results into DevOps workflows (Jira, Azure DevOps, GitHub integrations are documented).
Interest in scanning features targeting AI/LLM components in web applications.

Reasons some customers decline or leave (evidence and typical buyer friction)

Publicly accessible churn evidence specific to Web App Scanning was limited. Likely deal-breakers based on documentation and community commentary include:

The need to allowlist scanner IPs and manage test credentials/2FA secrets, which creates operational overhead.
Preference for established DAST incumbents (Invicti, Burp, Qualys, Rapid7) that may have deeper enterprise references or broader integrations for specific procurement stakeholders.
Platform bundling: requirement for a Distributed Cloud Base Package subscription may be an obstacle for buyers seeking a standalone scanning product.

Vendor-published narratives (limited independently verifiable detail)

Critical evaluation guidance: treat vendor adoption and impact claims as directional until validated through:

customer reference calls,
independent analyst reports, or
contract-level SLAs and documentation.

04Best fit

Company sizes

Best fit: mid-market through large enterprise organizations (multiple hundreds to many thousands of employees) that operate multiple internet-facing applications and APIs. Smaller organizations may be a fit if they already use the Distributed Cloud Base Package and can utilize the included entitlement for a limited number of apps.

Industries

Sectors with continuous external exposure and audit requirements such as finance, healthcare, e-commerce, and SaaS are likely fits.

Roles/personas

Decision makers: CISO, Head of AppSec, Director of Security Engineering.
End users: AppSec engineers, security testers, DevSecOps practitioners, and vulnerability management teams.

Pain points addressed

Discovery of unknown or forgotten public-facing applications and APIs.
Need for more frequent automated testing than periodic manual penetration tests.
Requirement for reproducible evidence to support audit and remediation workflows.

Qualification criteria (good fit)

Capability to provision test accounts and manage 2FA secrets for authenticated testing.
Established processes to triage findings and create remediation tickets.
Interest in integrating findings with protective controls such as WAAP/WAF rules within the same vendor environment.

05The pitch

What the product does (objective value proposition)

F5 Distributed Cloud Web App Scanning is a cloud-delivered security service that combines:

External Attack Surface Management (EASM) ("Recon"): discovers public-facing applications, APIs, and services across a company’s domains and highlights exposures such as server fingerprints, ownership, and known CVEs.
Dynamic Application Security Testing (DAST) ("Scan"): executes automated penetration tests against web applications and APIs (including authenticated flows) and produces findings that include screenshots and videos along with remediation guidance.

F5 describes the product as providing continuous identification of vulnerabilities across an organization’s external footprint (web applications and APIs), intended to complement (not replace) WAF/WAAP controls that mitigate exploitation.

Key functional items reported by vendor documentation: OWASP-aligned testing; authenticated testing (including support for OTP-based 2FA); capture of screenshots and videos as evidence; scheduling capabilities; integrations into SDLC tooling; and recent support for LLM/AI testing mapped to OWASP Top 10 for LLM Applications.

Target market and positioning

Primarily mid-market to enterprise security teams (AppSec, SecOps) that require scalable, continuous scanning of many internet-exposed applications and APIs across multi-cloud and hybrid environments.
Also marketed toward organizations deploying AI-enabled web applications with LLM integrations, given messaging around discovering and testing LLM exposure.

Get a comprehensive analysis of F5 Web application scanning including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →