Performance analysis of PTaaS tools : A study on how PTaaS providers can compare the performance of DAST scanners

As dynamic web applications become increasingly complex, cybersecurity providersoffering Penetration Testing as a Service (PTaaS) face growing pressure to selectefficient and effective vulnerability scanning tools. Dynamic Application SecurityTesting (DAST) scanners are commonly used in automated security assessments,but empirical comparisons are often limited and rarely tied to investment decision-making.This thesis evaluates the performance of two DAST scanners using real-worlddata collected from 45 production-grade web applications. Scanner performance isassessed using a structured framework of four dimensions: detection rate, vulnerabil-ity coverage, false positives, and credential handling. Findings are categorized usinga general vulnerability categorization and the OWASP Top 10 (2021) framework.The results show that one scanner significantly outperforms the other in bothdetection rate (61.44% vs. 19.87%) and category coverage, but also produces ahigher volume of false positives. Chi-squared tests confirm that these differencesare statistically significant. The study demonstrates that performance metrics canmeaningfully support scanner selection and investment decisions in PTaaS, especiallywhen trade-offs between detection capability and operational cost are considered.This thesis contributes a practical decision-making framework for security teamsevaluating automated tools in operational settings by using real-world applicationdata and grounding the evaluation in technical and business-relevant metrics.