The first version of Burp came with actual burping sounds. It was 2003, and Dafydd Stuttard was building a hobby tool for the peculiar work of pulling apart web applications. The joke did not become the business. The workflow did: catch a browser’s request, inspect it, alter it, send it again, and watch where the application’s assumptions split open.
PortSwigger, the company Stuttard founded in 2008, still lives inside that loop. Its customers range from students running their first legal lab to bug bounty hunters, penetration-testing firms and the teams responsible for sprawling corporate web estates. The company says more than 90,000 security professionals use Burp Suite and more than 18,000 organizations across 170-plus countries rely on its products. Its customer roll includes Microsoft, Amazon, NASA, Barclays, Salesforce and Samsung. In 2025, SAP Sovereign Cloud Services said it would use Burp’s enterprise scanner across a thicket of cloud products and regional environments.
The flywheel is the product
It is tempting to call PortSwigger a vulnerability-scanner vendor. That misses the interesting bit. The company runs an in-house research group that hunts for classes of web attacks, not merely individual bugs. Research director James Kettle’s work has ranged from server-side template injection and web-cache poisoning to HTTP request smuggling and race conditions. Those techniques feed the scanner and manual toolkit. Then the Web Security Academy turns them into explanations and deliberately vulnerable labs. A learner can read the theory, attack a safe target and return to Burp with better instincts.
The copyable idea: make expertise move through the company instead of trapping it in a research PDF, a product backlog or a marketing funnel.
This arrangement solves two expensive problems at once. Security tools go stale when they only recognize yesterday’s bugs. Security training goes stale when it teaches tidy textbook examples. PortSwigger shortens the distance between a strange finding, a usable technique and an operator who understands it. Its more than 300 BApp Store extensions add a second stream of field knowledge: users can bolt on specialist behavior, while Bambdas and BChecks let testers customize analysis and scanning.
“Hand off the repetition. Keep the judgment.”PortSwigger’s succinct pitch for human-led AI testing
One target, three ways in
The commercial ladder begins at zero. Community Edition provides the core manual workbench and gives learners something real to use alongside the free Academy. Professional adds the scanner, advanced manual features, reporting, customization and AI assistance; PortSwigger advertised it at $499 per user in September 2026. DAST - the product previously called Enterprise Edition - automates scanning across a portfolio, slots into CI pipelines and charges according to the number of websites covered. Unlike Professional, a DAST subscription permits unlimited platform users.
The distinctions matter. Professional sits beside the tester and rewards curiosity: intercept this request, replay that edge case, write a custom check. DAST is for the AppSec manager who cannot manually inspect every release from every team. It schedules, repeats and centralizes. The SAP deployment makes the point neatly. The problem was not teaching one clever person to find SQL injection; it was achieving consistent coverage across services such as Ariba, HANA Cloud and S/4HANA in restricted environments spanning several countries.
The main alternatives reveal PortSwigger’s shape. OWASP ZAP is the obvious free, open-source rival for proxying and scanning. Invicti and Acunetix, Rapid7 InsightAppSec, HCL AppScan, Checkmarx, StackHawk and Veracode compete for commercial application-security budgets. PortSwigger’s advantage is strongest when hands-on testers influence the buying decision: many already know the controls, the extension ecosystem and the odd corners of HTTP that Burp handles. Its enterprise task is to translate that practitioner affection into the reporting, automation and governance a security program needs.
Fifteen years saying no
Stuttard describes an improbable early run: a hobby project that became a business, bootstrapped for roughly 15 years, with broad adoption and little sales or marketing. When people emailed, he replied. Word of mouth did the hauling. By 2011 to 2014, Burp was being downloaded more than 10,000 times a month; later came the BApp Store, the research unit, Enterprise Edition and the Academy, which reached one million users about a year after launch.
What failed first was not the tool. It was the comfortable assumption that a small, self-funded company could keep matching the scale of the problem. Faster software releases created more applications to test, deployment layers hid bugs that source review could miss, and qualified security labor remained scarce. Stuttard says he ignored dozens of investor approaches each week. In June 2024 he finally chose Brighton Park Capital, which invested $112 million for a minority stake. PortSwigger kept overall control.
The money was earmarked for faster product development, more research and community work, enterprise customer support, hiring and a United States presence. Offices in London and Atlanta followed the established Knutsford base. The choice was less a founder discovering the charms of finance than a capacity decision: serve much larger security teams without forcing them to hire an impossible number of specialists.
The beast gets a cage
PortSwigger’s current wager is that AI will do more of a penetration test, but should not be allowed to grade its own homework. Burp AI began with opt-in assistance inside familiar tools: analyze a request, explain an unfamiliar technology, investigate a scanner result. In July 2026, Burp AT entered public beta for Professional users and moved from assistant to agent. Give it a defined testing goal and it can select Burp tools, inspect project context, form hypotheses and adapt as evidence arrives.
The useful design choice sits outside the model. Burp itself enforces scope, tool access and approval rules. A model may propose an action, but cannot use a tool the operator has blocked. Requests and tool activity are recorded with the project, so a tester can inspect and reproduce the work. The caveat is important: users still need to set scope carefully, review destructive actions, control scripting tools and verify every finding. Production targets are not playgrounds, however persuasive the chatbot sounds.
This direction grew from research, too. Kettle built an autonomous system that encoded parts of his own research method: generate attack hypotheses, test them with specialist tools, interpret the result, then pursue the oddities. The system could explore more leads; Kettle supplied the judgment about which anomalies mattered. PortSwigger’s product lesson was characteristically practical. A capable model is not enough. It needs sharp tools, relevant context, a method, and boundaries it cannot talk its way around.
A culture written like code
In 2013, before the team grew large, Stuttard wrote six principles on the wall of the first Knutsford office and called them a culture unit test: have fun; work hard; make Burp as good as possible; exceed customer-service expectations; be fair and generous; do not follow the herd. Employees call themselves “Swiggers,” an affectation that should be intolerable and somehow fits a company named after drinking port.
The updated version emphasizes purposeful learning, direct questions to leadership, psychological safety, generous knowledge sharing and contribution over categorization. PortSwigger says it rewards above market and offers share options, while measuring achievement rather than hours. Those are the company’s claims, not a guarantee of every employee’s Tuesday. Still, the operating choices line up: free Community software, free Academy labs, unrestricted research publications and a product built to be extended rather than sealed.
There is a useful playbook here for technical founders. Start with a workflow practitioners repeat all day. Give beginners a real on-ramp, not a toy. Publish the difficult knowledge. Build a route by which every research breakthrough improves the paid product and the free curriculum. Delay outside capital if patience sharpens the product - but notice when market scale, not investor flattery, changes the equation. It works when the company owns genuine expertise and can keep teaching faster than the subject moves. Without that expertise, the flywheel is only content marketing drawn as a circle.