A 12-Month Launch Sequence for a DAST Company

Before you write a single paragraph of the plan, decide which of three businesses you are actually starting, because the timeline, the budget and the funding source all change with that one choice.

Ranges are Avvale planning estimates built from the cost lines further down this page. Most first-time founders we work with start with the managed service or the hybrid, then build proprietary tooling once they have 30 or more paying applications and know which vulnerability classes their customers actually care about. A product company can absolutely be the right call, but it is a venture-funded play, and the plan has to be written for equity investors rather than a bank.

Month-by-month plan (managed or hybrid model)

• Month 1, company and paperwork: incorporate, open a business account, buy professional indemnity and cyber liability cover, and have a solicitor or attorney draft three documents: a master services agreement, a statement of work, and an authorisation-to-test letter that names every hostname and IP range in scope.
• Month 2, tooling and lab: license Burp Suite Professional seats, stand up OWASP ZAP in containers for pipeline scanning, and build a deliberately vulnerable lab (OWASP Juice Shop, DVWA, crAPI for APIs) so every scan profile is tuned before it touches a client.
• Month 3, two design partners: scan two friendly SaaS companies at a steep discount in exchange for a reference and permission to anonymise their before-and-after metrics.
• Months 4–5, credentials: start SOC 2 Type I readiness (US buyers) or ISO 27001 and Cyber Essentials Plus (UK buyers). In the UK, begin the CREST membership application if public-sector or financial-services clients are in the target list.
• Month 6, packaging: publish three tiers by number of applications and scan depth. Add an annual manual web application test as an upsell.
• Months 7–9, channel partners: sign referral agreements with two or three managed IT providers and one compliance automation consultancy. They meet companies at the exact moment an auditor asks for evidence of application testing.
• Months 10–12, second analyst: hire once the first analyst passes roughly 12 to 14 applications under continuous management. Past that point, triage quality drops and false positives start reaching client developers.

For a product company the sequence is different: crawler and authentication handling first (this is where most DAST engines fail), then the vulnerability check library, then CI/CD integrations for GitHub Actions, GitLab and Jenkins, then a free tier to generate developer sign-ups. Plan for 12 months of engineering before meaningful revenue.

Launch Budget & Where the Money Comes From

A managed DAST firm is a people business with a tooling bill attached. The single biggest line is payroll runway: the months you pay an analyst before retainers cover the salary. Everything else is modest compared with a physical business, which is why lenders sometimes struggle with these plans. There is little collateral, so the forecast and the contract pipeline carry the whole application.

Line-by-line breakdown

On licences specifically: published reviews put Invicti enterprise licensing at roughly $15,000 to $60,000 a year for one to ten targets, rising to $60,000 to $250,000 for ten to fifty (Beagle Security, 2026). StackHawk's paid plan is billed per contributing developer, reported at $42 per contributor per month (WeavAI, 2026). Those figures matter twice in your plan: once as your own cost if you resell an engine, and again as the price anchor your customers compare you against.

Funding routes that fit a DAST business

• SBA 7(a) loans (US): a testing firm will normally register under NAICS 541519 (Other Computer Related Services) or 541511 (Custom Computer Programming Services). Both carry a $34 million average-receipts size standard (NAICS List, 2026), so virtually every founder qualifies as small. The problem is collateral, not eligibility. Lenders will want signed client contracts or letters of intent in the appendix.
• Start Up Loans (UK): up to £25,000 per founder at a 6% fixed rate. Enough to cover the lean budget for a two-founder team; the plan and 12-month cash flow forecast are mandatory parts of the application.
• SEIS and EIS angel rounds (UK): the most common route for UK hybrid and product companies. Angels who have worked in security often invest £10K to £50K each.
• Venture capital (product model): the DAST software segment is still attracting rounds. StackHawk raised $12 million from Sapphire and Costanoa in May 2025 (Help Net Security, 2025), and Paris-based Escape closed an $18 million Series A led by Balderton in March 2026 (SecurityWeek, 2026).
• Customer prepayment: annual upfront billing on per-app contracts is the cheapest capital available. Offer a 10% to 15% discount for it and model the cash effect separately in the forecast.

What a lender or angel will check first

Credit teams and angels read security-services plans with a specific set of worries, and the plan should answer each one before it is asked:

• Founder credibility: years of hands-on testing, named certifications (CRT, OSCP, BSCP, CREST CCT), and any prior client relationships that could move with you. Check your previous employment contract for non-solicitation clauses first.
• Contracted or committed revenue: letters of intent from design partners, with the number of applications and the agreed monthly price.
• Liability exposure: what happens if a scan takes a client's production site offline. Show insurance limits, a scan-window policy and a liability cap in your MSA.
• Concentration risk: no single client above 25% of revenue by month 12, or a clear explanation of why it is acceptable.
• Hiring plan: salary assumptions grounded in published wage data, with a realistic recruitment lead time of six to ten weeks for experienced testers.

The Scanning and Delivery Stack

Investors and enterprise buyers both ask the same question: what do you actually run, and what do you add on top of it? Your plan should name the tools, explain why each one is there, and be honest that the scanner itself is rarely the differentiator. Triage, authentication handling and the speed of verified retests are.

Consolidation is reshaping this stack. Snyk bought Porto-based Probely in November 2024 and later reported 245% quarter-over-quarter growth in DAST annual recurring revenue booked after the deal closed (FinTech Global, 2024). Checkmarx brought the three ZAP project leaders on board, and GitHub already partners with StackHawk (Codacy, 2025). For a service founder, that is good news: platform vendors increasingly sell DAST as a feature inside a bigger suite, and many of their customers still need somebody to configure authenticated scans and separate real issues from noise.

For a product founder, it is a warning. The plan must explain why a buyer would choose a standalone engine over the one bundled with their existing code-scanning licence. The credible answers we see are narrow: deep API and GraphQL coverage, business-logic testing driven by AI agents, or a specific regulated vertical such as healthcare or payments.

Authorisation, Licences & Compliance

DAST is unusual among software businesses: the core activity, sending attack payloads at somebody else's system, is a criminal offence in most countries unless you hold written permission. Your plan needs a short legal section that a lender's credit team or an investor's lawyer can read in two minutes and come away reassured.

United States

• No federal DAST licence: there is no national permit to run security scans. The controlling law is the Computer Fraud and Abuse Act (18 U.S.C. § 1030), which makes access "without authorization" the offence. Every engagement needs a signed authorisation that names the owner of each target, including any cloud-hosted or third-party assets.
• Cloud provider rules: AWS, Azure and Google Cloud each publish penetration testing policies. Your SOW should confirm the client's targets fall within them, especially for load-heavy scans.
• PCI DSS v4.0.1: the standard does not name DAST, but scan output supports Requirement 6.2.4 (preventing common software attacks) and contributes to the authenticated internal scanning required under 11.3.1.2. The future-dated requirements, including 6.4.2's automated protection for public-facing web apps, became mandatory on 31 March 2025 (Linford & Co, 2025). That deadline drove a wave of first-time buyers among merchants and payment SaaS firms.
• SOC 2 Type II: not a legal requirement, but mid-market buyers ask for it before they will give an outside firm credentials to their staging environments. Budget for it in year two.
• Federal work: selling scanning software to US agencies typically means FedRAMP authorisation, a multi-year effort only a funded product company should put in the plan.

United Kingdom

• Computer Misuse Act 1990: section 1 makes unauthorised access an offence. A signed scope letter is your defence, so keep it on file for at least six years alongside the scan logs.
• CREST: not legally required, but many UK banks, insurers and public bodies will only buy from CREST member companies. Application fees start at £1,200, and the CREST Application Security Testing programme carries an additional £2,000 annual fee on top of membership (Astra, 2026). Individual exams such as CRT cost around £600.
• NCSC CHECK: required for testing many government systems; CREST acts as a delivery partner for CHECK and for the Bank of England's CBEST scheme.
• UK GDPR and ICO registration: scans touch personal data in test accounts and HTTP responses. Pay the ICO data protection fee, sign a data processing agreement with each client, and set a retention period for evidence.
• Cyber Essentials Plus: a low-cost credential that opens up public-sector supply chains and reassures smaller buyers.

Singapore and the EU

• Singapore: penetration testing is a licensable service under Part 5 of the Cybersecurity Act, administered by the Cybersecurity Services Regulation Office. The licence costs S$2,500 for a business entity or S$1,250 for an individual, and providing the service without one can bring a fine of up to S$50,000, up to two years in prison, and an inability to recover fees in court (GoBusiness Singapore, 2026). If your hybrid model includes human-led testing for Singapore clients, the licence goes in the plan.
• EU Cyber Resilience Act: from 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities within 24 hours, and all CRA requirements apply from 11 December 2027 (White & Case, 2025). For a DAST business this is demand, not burden: software vendors selling into Europe need documented pre-release security testing.
• EU DORA: financial entities must run regular digital resilience testing, including threat-led penetration testing for the largest firms, which opens a premium tier for hybrid providers with financial-sector experience.

Pricing Per App, Margins & Analyst Capacity

The commercial unit in this business is the application, not the scan. A scan is something a machine does at 2am. An application under management is something a customer can budget for, and it carries the analyst time needed to configure authentication, tune scan policies, verify findings and retest fixes. Price per scan and you train customers to scan less; price per application and you get paid for coverage.

Revenue streams to model

• Managed DAST retainers: $250 to $1,500 per application per month, depending on authenticated roles, API surface and scan frequency (Avvale estimate from client plans). This is the recurring core.
• Human-led web application tests: a standard UK web application test runs £5,000 to £15,000, with complex applications above £15,000 (Fortbridge, 2026). Senior CREST-certified testers bill £1,200 to £1,800 a day, juniors at smaller firms £800 to £1,000.
• Onboarding fee: a one-off charge of $1,000 to $3,000 per application for scan profile setup, authentication scripting and the baseline report.
• Verified retests: included in higher tiers, sold separately in the entry tier.
• Software subscriptions (product model): per-target or per-developer pricing; typical published anchors are listed in the cost section above.
• Reseller margin: some service firms resell an enterprise engine to clients who want their own licence, typically keeping 15% to 25%.

Worked example: one year of a managed DAST firm

Here is how we would model a two-analyst firm at the end of its first full year. All numbers are an Avvale composite, built for illustration.

That 43% gross margin is lower than the 55% to 70% a mature managed DAST firm reaches, and the reason is visible in the table: 40 applications across two analysts is only 20 each, with a lot of manual testing mixed in. Push each analyst to 14 managed applications at a higher average price, move manual tests to a contractor bench paid per day, and the same firm crosses 60%. This is the single most useful insight to put in front of a lender: show the margin today, then show the capacity lever that improves it, with the hiring trigger written down.

Capacity rules of thumb

• Applications per analyst: 12 to 15 under continuous management with weekly authenticated scans and monthly verified reports.
• Onboarding effort: 1 to 3 analyst days per application, mostly spent on login flows, multi-factor authentication workarounds and API schemas.
• False-positive rate target: under 5% of findings reaching the client. Above that, developer trust collapses and churn follows within two renewals.
• Net margin at steady state: 18% to 30% after sales, admin, insurance and compliance, based on the service-firm plans we have built.

BLS data gives you the wage benchmark to defend those payroll lines: information security analysts earned a median $124,910 in May 2024, and employment is projected to grow 29% between 2024 and 2034 (Wagedex, BLS data, 2025). Entry-level DAST analysts cost less than that median, but the growth figure is a warning that retention and pay rises belong in the forecast.

How Big the DAST Market Is, and Where It Is Growing

Mordor Intelligence values the global dynamic application security testing market at $4.18 billion in 2026, growing at a 15.59% CAGR to $8.63 billion by 2031 (Mordor Intelligence, 2026). Other houses size the software segment alone at $3.08 billion in 2024 with an 18.7% CAGR to 2032 (Metastat Insight, 2025). Use one source consistently in your plan and footnote the other; investors notice when a deck mixes them.

What the numbers mean for a founder

• Cloud-delivered is the default. With 73.5% of 2025 revenue coming from cloud platforms, an on-premise scanner pitch needs a specific reason (air-gapped defence or government networks) to make sense.
• North America is the largest buyer pool at 42.8% of the market, so even UK founders should plan for US clients by year two, with US-dollar pricing and a US-law MSA variant.
• Asia-Pacific is the fastest-growing region. A Singapore entity, with the CSA licence above, is a sensible year-three expansion line for a hybrid firm.
• The incumbents are large and broad. Mordor lists IBM, Synopsys, Veracode, Checkmarx and OpenText (Fortify) as the major players. Small firms win on service depth, speed and specialisation, not breadth.

The UK picture

The UK government's 2026 sectoral analysis counts an estimated 2,603 cyber security firms generating £14.7 billion in revenue and employing close to 70,000 people, with revenue up 11% on the previous year's £13.2 billion (DSIT, UK Cyber Security Sectoral Analysis 2026). London and the South East hold the largest cluster, with strong secondary hubs around Manchester, Leeds, Bristol, Cheltenham and Belfast. For a DAST firm, regional location matters less for sales than for hiring: Cheltenham and Manchester have deep pools of testers with government and financial-services experience.

Who actually buys

Winning the first 20 clients

Almost nobody searches for a DAST provider until a deadline forces the issue. The founders who grow fastest position themselves at those deadlines instead of competing for generic "web vulnerability scanner" traffic against vendors with eight-figure marketing budgets. Four channels consistently produce first customers in the plans we write:

• Compliance automation partners. Firms running SOC 2 or ISO 27001 projects meet clients at exactly the moment the auditor asks for application testing evidence. A referral fee of 10% of first-year revenue is common and still leaves the deal profitable.
• Recently funded SaaS companies. A Series A announcement is a reliable signal that enterprise security questionnaires will follow within months. Outbound to the CTO or head of engineering, with a free external baseline scan as the opener, converts far better than cold outreach to random companies.
• Development agencies. Agencies building client platforms increasingly need a security sign-off before handover. A white-label pre-release scan, priced per project, gives you recurring volume without your brand appearing at all.
• Technical content. Write-ups on authenticated scanning of single-page applications, GraphQL testing or reducing false positives attract exactly the engineering leads who sign contracts. One detailed article a month, with real (anonymised) findings, outperforms generic security news.

Your plan should put a number on each channel: expected leads per quarter, conversion rate, average applications per new client, and the cost of acquisition. A lender reading a DAST plan wants to see that the founder knows where client number 15 comes from, not just client number one.

Named competitors to map in your plan include Invicti (which also owns Acunetix), StackHawk, Bright Security, Detectify, Escape, Rapid7 InsightAppSec, PortSwigger's Burp Suite DAST, Veracode and HCL AppScan on the software side, and PTaaS providers on the service side. For a deeper look at the wider category, see our application security business plan template and the companion DevSecOps business plan template; once the plan is done, the DAST marketing plan guide covers go-to-market in more detail.

Managed DAST Revenue Calculator

Plug in your own assumptions to see what a year of managed scanning looks like before you open the template. The calculator uses the same logic as the worked example above: retainers plus manual tests, minus delivery payroll and tooling. It does not include sales, admin or tax, so treat the output as gross profit, not net income.

Try two scenarios before you commit to a pricing page. First, halve the price per app and double the number of applications: revenue looks similar, but the analyst count jumps, and margin falls. Second, raise analyst capacity from 14 to 20: this is what automation and better triage tooling buy you, and it is the strongest argument for building proprietary software once the service is profitable.

Sample Plan Extract: A Bristol Managed DAST Firm

Below is how the opening of a plan built with this template reads, using a fictional company. Names and numbers are illustrative.

Inside the Template: Sections Built for a Testing Business

The standard Avvale structure, with prompts rewritten for companies that test other people's software.

• Executive Summary: model choice (service, hybrid or product), applications under management at month 12, funding ask and use of funds.
• Company Overview: founder testing background, certifications held, legal entity, and where scan infrastructure is hosted.
• Market Analysis: global DAST sizing with one consistent source, your target region, and the compliance triggers (SOC 2, PCI DSS, CRA) that create buyers.
• Customer Analysis: buyer segments, typical number of applications per customer, the security questionnaire moment, and who signs the contract.
• Competitor Analysis: platform vendors, standalone DAST tools, PTaaS firms and traditional consultancies, with a positioning grid.
• Service Design: scan frequency, authenticated coverage, triage standard, false-positive target and retest promise.
• Legal and Compliance: authorisation workflow, MSA and SOW summary, insurance limits, CREST or SOC 2 roadmap, data retention policy.
• Marketing Plan: partner channels, technical content, conference calendar and outbound to recently funded SaaS companies.
• Operations Plan: analyst capacity rules, hiring triggers, contractor bench, tool stack and incident procedure if a scan causes an outage.
• Management Team: founder bios, advisors with enterprise security buying experience, and planned hires.

The Financial Forecast add-on (included in the $300/£250 and $1,000/£800 packages) gives you a 5-year Excel model with per-application revenue, analyst capacity, income statement, cash flow, balance sheet and break-even. You can also browse the general free business plan template if you are still deciding on a model, or read how other founders used their plans in our case studies.

DAST Business Questions, Answered

Useful Links & Resources

• Facebook
• Instagram
• LinkedIn
• YouTube