Vooki Pro is a desktop DAST scanner with local, on-device AI-assisted triage for web applications and REST APIs. Burp Suite is PortSwigger's web security toolkit, split across two distinct products: Burp Suite Professional (manual-first desktop pentesting with an on-demand scanner) and Burp Suite DAST (PortSwigger's separate automation-focused product). This page compares Vooki Pro against each separately — the two aren't interchangeable.
Vooki Pro's 6-step wizard takes you from target and discovery strategy through authentication, policy and schedule to a review screen before anything runs. Burp Suite Professional's scan launcher covers scan type, scope, scan configuration and application logins, but not recurring scheduling — that is a Burp Suite DAST feature.
Vooki Pro's AI triage (ThreatLens) runs entirely offline on your machine after a one-time model download. Burp AI runs on PortSwigger's AI infrastructure — confirmed "not currently" usable offline. In Burp Suite Professional it is metered by per-user AI credits (unused credits expire 12 months after purchase); in Burp Suite DAST, AI-enhanced scanning and AI-powered recorded logins are documented for Cloud instances and are off until an administrator enables them.
Burp Suite Professional generates HTML reports and XML issue exports. PDF output and compliance-mapped reports (OWASP Top 10:2025, PCI DSS v4.0.1) are in the separate Burp Suite DAST product. Vooki Pro ships four standard formats and seven compliance and security-reference report mappings in one license.
| Capability | Vooki Pro | Burp Suite Professional | Burp Suite DAST |
|---|---|---|---|
| Deployment | Desktop (macOS, Windows, Linux AppImage) | Desktop only | Cloud-hosted, self-hosted, or CI-container-only |
| Guided scan setup | Included — 6-step wizard: target, discovery, authentication, policy, schedule, review | Step-based scan launcher: scan type, optional AI enhancements, scan details and scope, scan configuration, application logins, resource pool. No scheduling step | A site is set up first (scan configuration and logins live in its settings); scans are then created from the Sites menu by choosing targets, start time and repeat frequency |
| REST API scanning | Included | Included | Included |
| Scheduled / recurring scans | Included | No recurring scans. The task scheduler can pause and resume Burp's task execution engine at set times, once or on a repeating interval | Included — each scan has a start time and repeat frequency (weekly by default) |
| AI-assisted triage | Included — local, offline (ThreatLens) | Included ("Burp AI," Professional 2025.2+) — AI prompts in Repeater, Explore Issue, Explainer, broken-access-control false-positive reduction, AI-powered recorded logins, AI-powered extensions. Runs on PortSwigger's AI infrastructure, metered by per-user AI credits; not currently usable offline | AI-enhanced scanning (Burp AI investigates selected issues for real, exploitable risk and adds evidence and remediation steps) and AI-powered recorded logins. Documented for Cloud instances; off by default, enabled by an administrator; runs on PortSwigger's AI infrastructure. The DAST docs don't describe a credit system |
| Automated retest of a finding | Included — re-runs the originating detector | Manual — PortSwigger documents Burp Repeater for manually verifying issues reported by Burp Scanner | Included — manual, automatic, and API-triggered retest |
| Standard report formats | HTML, PDF, DOCX, JSON | HTML and XML only | HTML, PDF |
| Compliance-mapped reports | Included — seven compliance and security-reference mappings (OWASP Top 10 2021, PCI DSS v4, NIST SP 800-53 Rev. 5, ISO/IEC 27001:2013 (legacy), HIPAA, GDPR, SOC 2 — 2017 TSC, selected controls) | Not available | OWASP Top 10:2025, PCI DSS v4.0.1 (2 frameworks) |
| CLI / CI-CD | Included — vooki-pro-cli, JSON-configured, severity-threshold exit codes, HTML/JSON/SARIF/DOCX/PDF output | PortSwigger provides CI-driven scanning through Burp Suite DAST, including a CI container that runs without a DAST server | Built for CI/CD pipelines |
| Licensing | Annual license per domain (covers all subdomains), no seat limits — see pricing | $499 per user, per year | Quote-based; all subscriptions include unlimited users |
Competitor capabilities are described from each vendor's public documentation as of 23 October 2026. Compliance-mapped reports, from any product in this table, are evidence of testing, not a compliance certification.
Vooki Pro's wizard asks for your target, discovery approach, authentication, scan policy, and schedule in sequence, ending in a review screen before anything runs. Burp Suite Professional's scan launcher is also step-based — scan type, scope, scan configuration, application logins and resource pool — and suits testers who launch scans on demand inside a manual workflow. Recurring scans are not part of it: Professional's task scheduler pauses and resumes its task engine, while scheduled scanning is a Burp Suite DAST feature.
ThreatLens downloads a local language model (Qwen3-8B, 4-bit quantized GGUF, ~5GB) once, with a resumable download and a mirror fallback, and runs entirely on your CPU or GPU after that — no scan traffic leaves your machine for AI analysis, and scans still run on rule-based detection alone if the model isn't downloaded. Burp AI's own capabilities page states customer data "stays within PortSwigger's secure AI platform" and that offline use is "not currently" supported; PortSwigger's AI trust page applies the same infrastructure to both Burp Suite Professional and Burp Suite DAST, and notes that Burp AI does not automatically redact data sent to AI providers. For teams where scan traffic itself is sensitive — session tokens, internal hostnames, personal data surfaced in responses — that architectural difference is worth weighing.
Burp Suite Professional doesn't inherit Burp Suite DAST's reporting. Its report-settings documentation lists HTML reports and XML issue export — no PDF, DOCX or compliance-framework mapping. Compliance-mapped output (OWASP Top 10 2025, PCI DSS v4.0.1) exists only in Burp Suite DAST, a separately licensed product from Professional. Whichever tool produces it, a framework-mapped report is evidence of testing, not a compliance certification — your assessor decides what it means for your programme.
PortSwigger itself frames Professional and DAST as solving different problems — manual/on-demand testing versus organization-wide scheduled automation. Vooki Pro doesn't require that upfront choice: guided automated scanning, scheduling, and compliance reporting live in the same license.
Runs on your machine. Applications, scans, findings and reports are stored in a local database by default and are not automatically uploaded to Vookify. Selected finding details and HTTP evidence leave your machine only through integrations you configure — a ticketing platform (tickets include the request and response evidence), Slack or a webhook — or in reports you export. Scanning needs no internet beyond the target. Two separate network operations do need a connection, and neither sends scan data: the license re-validates roughly once a day while online (about a week of offline tolerance), and ThreatLens needs a one-time model download (~5GB).
Desktop application; project data is stored locally in files you manage yourself. $499 per user, per year.
PortSwigger-hosted cloud, self-hosted (AWS/Azure/GCP/Kubernetes), or CI-container-only. Even self-hosted deployments reach portswigger.net:443 for license activation. Quote-based.
Every Vooki Pro license includes direct support from the Vooki Pro team through the support portal and support@vookify.com. PortSwigger provides a Support Center for Burp Suite customers.
You want one tool covering guided web + API scanning, scheduled automation, compliance reporting, and local AI triage under one annual per-domain price, and you'd rather sensitive scan data stay on your machine by default, leaving it only through integrations you configure or reports you export.
Your team's core workflow is hands-on, manual penetration testing — Burp's Repeater, Intruder, and Proxy form a widely-used, deeply capable manual toolkit, and the on-demand scanner is a secondary feature inside that workflow.
You need organization-wide scheduled scanning across many applications with centralized dashboards and multi-user management at scale, and you're prepared for a separate, quote-priced product from your manual testing license.
More answers are in the documentation · or contact us
PortSwigger — Burp report settings
PortSwigger — Burp Suite Professional ($499)
PortSwigger — licensing model (per user)
PortSwigger — Burp Suite DAST pricing
PortSwigger — DAST reports reference
PortSwigger — Burp AI capabilities
PortSwigger — Burp AI (Professional)
PortSwigger — AI credits (Professional)
PortSwigger — Burp AI (DAST)
PortSwigger — configuring AI-enhanced scanning (DAST)
PortSwigger — recorded logins, incl. AI-powered (DAST)
PortSwigger — AI trust and data handling
PortSwigger — manage scheduled scans (DAST)
PortSwigger — retest issues (DAST)
PortSwigger — scan launcher steps (Professional)
PortSwigger — Tasks settings: Schedule tasks (Professional)
PortSwigger — Burp Repeater (Professional)
PortSwigger — creating scans (DAST)
PortSwigger — CI-driven scans (DAST)
Vooki Pro documentation: Reports & Compliance · CLI & CI/CD · Integrations · Features
Last reviewed 23 October 2026.
No credit card required — submit a request and the team will send your trial license and installation instructions.