Tech skills 🇬🇧 Knutsford, United Kingdom Since 2008

PortSwigger

Maker of Burp Suite, with the free Web Security Academy and the BSCP exam.

Visit portswigger.net Try PortSwigger free All companies
free labs in the Web Security Academy
273
for the Burp Suite Certified Practitioner exam
$99
per user a year for Burp Suite Professional
$499
employees in three offices, 2026
177

About PortSwigger

PortSwigger is a British company from Knutsford, near Manchester, that makes Burp Suite, a toolkit for testing the security of web applications. Its Web Security Academy is a free online course with 273 interactive labs in 31 topics, from SQL injection to web LLM attacks. The Burp Suite Certified Practitioner exam costs $99, lasts four hours and needs a Burp Suite Professional licence. Burp Suite Community Edition is free, Professional costs $499 per user a year, and Burp Suite DAST is priced on a quote. Dafydd Stuttard registered the company in 2008, and in 2024 Brighton Park Capital invested $112 million for a minority stake.

PortSwigger makes Burp Suite, a set of tools that sits between a browser and a website and lets a tester read, change and replay the traffic. Community Edition has the manual tools for free. Professional adds the scanner, the full Intruder, project files and Burp Collaborator. Burp Suite DAST runs automated scans for companies across many applications.

Dafydd Stuttard wrote the first Burp tools as a side project to automate his own penetration testing. He released them in 2003 under the hacking handle PortSwigger and registered PortSwigger Ltd on 9 October 2008. He is the author of The Web Application Hacker’s Handbook. The first employee joined in 2012, and the first office opened in Knutsford in 2013.

In April 2019 PortSwigger launched the Web Security Academy, free training with labs, and in July 2021 added the Burp Suite Certified Practitioner exam. The company says it ran without outside money for 16 years. In June 2024 Brighton Park Capital invested $112 million for a minority stake. In 2025 PortSwigger opened offices in London and Atlanta, and in July 2026 it released Burp AT, AI agents inside Burp Suite Professional, as a public beta.

History

  1. 2003 Dafydd Stuttard releases the first Burp tools under the handle PortSwigger.
  2. 2007–2008 The first edition of The Web Application Hacker’s Handbook comes out. Burp Scanner launches.
  3. 2008 PortSwigger Ltd is registered at Companies House on 9 October, with Stuttard as the only employee.
  4. 2013 The first office opens in Knutsford, Cheshire.
  5. 2019 The free Web Security Academy launches in April. PortSwigger receives the Queen’s Award for Enterprise.
  6. 2021 The Burp Suite Certified Practitioner exam launches on 27 July. The new headquarters at Booths Park opens.
  7. 2024 Brighton Park Capital invests $112 million for a minority stake on 27 June, the first outside investment.
  8. 2025 Burp Suite Enterprise Edition is renamed Burp Suite DAST in April. Offices open in London and Atlanta.
  9. 2025 Receives the King’s Award for Enterprise in International Trade in May.
  10. 2026 Releases Burp AT, AI agents for human-led pentesting, as a public beta on 27 July.

PortSwigger funding and investors

$112 million raised in disclosed rounds
  1. 27 June 2024
    Growth, minority stake $112 million

    Lead: Brighton Park Capital Brighton Park Capital

    Source: PortSwigger blog, Paul, Weiss

PortSwigger calls it its first outside investment, after 16 years bootstrapped and profitable. The company says Brighton Park Capital is a minority shareholder and the founder keeps overall control. The valuation was not disclosed.

Leadership

  • Dafydd Stuttard Founder and CEO
  • James Kettle Director of Research

Stuttard has been a director of PortSwigger Ltd since 2008. The board, listed at Companies House, includes a director from Brighton Park Capital.

Careers

Workable
5Knutsford
5 open roles on 15 October 2026
  • Engineering1
  • Product1
  • Sales1
  • Finance1
  • AI1

How the Web Security Academy teaches

labs, all free
273
levels: Apprentice, Practitioner, Expert
3
for the certification exam
4 hrs
  • Free account with progress tracking
  • Learning paths
  • Text lessons with videos
  • Apprentice, Practitioner and Expert labs
  • Mystery lab challenge
  • Hall of Fame for first solvers
  • Leaderboard
  • Practice exam of two hours
  • Proctored certification exam
  • Labs open to Community Edition users

Web Security Academy topics

Server-side14

  • SQL injection
  • Authentication
  • Path traversal
  • Command injection
  • Business logic vulnerabilities
  • Information disclosure
  • Access control
  • File upload vulnerabilities
  • Race conditions
  • SSRF
  • XXE injection
  • NoSQL injection
  • API testing
  • Web cache deception

Client-side6

  • Cross-site scripting (XSS)
  • CSRF
  • CORS
  • Clickjacking
  • DOM-based vulnerabilities
  • WebSockets

Advanced10

  • Insecure deserialization
  • Web LLM attacks
  • GraphQL API vulnerabilities
  • Server-side template injection
  • Web cache poisoning
  • HTTP Host header attacks
  • HTTP request smuggling
  • OAuth authentication
  • JWT attacks
  • Prototype pollution

Topics as grouped on portswigger.net/web-security/all-topics on 15 October 2026, plus a separate Essential skills section. The all-labs page lists 273 labs: 61 Apprentice, 173 Practitioner and 39 Expert.

Products

  • Web Security Academy Free online training with 273 interactive labs in 31 topics. Each topic explains a vulnerability in text, many add a video, and the labs are deliberately vulnerable websites to attack. A free account tracks progress. All labs
  • Burp Suite Certified Practitioner A proctored four-hour exam with two vulnerable applications. In each one the candidate takes over a user account, reaches the admin panel and reads a secret file from the server. The certificate is valid for five years. How the exam works
  • Burp Suite Community Edition The free edition with the HTTP and WebSockets proxy, Repeater, Decoder, Sequencer, Comparer and a demo of Intruder. The Academy points learners to it for labs that need a tool. Download
  • Burp Suite Professional The paid desktop edition for pentesters, with the web vulnerability scanner, the full Intruder, project files, Burp Collaborator and Pro-only BApp extensions. It costs $499, €475 or £419 per user a year, and the BSCP exam needs it. Buy Professional
  • Burp AT AI agents inside Burp Suite Professional that work through Burp’s tools, the project data and a skills library built with PortSwigger Research. The tester sets the scope and approves the conclusions. Public beta since July 2026. Launch post
  • Burp Suite DAST Automated scanning for companies, formerly Burp Suite Enterprise Edition. It runs self-hosted or in PortSwigger’s cloud, has no limit on users and connects to Jira, GitLab, Splunk, Slack and CI/CD pipelines. Prices come on a quote. DAST plans

How much is PortSwigger?

  • Community Edition $0/year Free, manual tools only
  • Free trial Professional, 1 year $499/year $499 per user, €475 or £419 per user
  • Professional, 3 years $1,497 per user €1,425 or £1,257, paid upfront
  • Professional, 10 years $4,990 per user €4,750 or £4,190, paid upfront
  • BSCP exam $99 one exam, €89 or £69, Professional needed
  • Burp Suite DAST Custom quote, unlimited users

Is PortSwigger free?

The Web Security Academy is free with an account. Burp Suite Community Edition is a free download. Burp Suite Professional has a free trial without a credit card, requested with a work email address.

Prices on the PortSwigger checkout pages on 15 October 2026, in US dollars, with euro and pound prices from the same pages. Burp Suite Professional is priced per user, and each user needs their own licence. PortSwigger requires prepayment for all orders. Burp Suite DAST is sold on a quote.

Refunds and renewals

Terms for Professional
  • portswigger.net account ↗
    1. Log in to your PortSwigger account
    2. Open the Your Subscription page
    3. Use the auto-renewal toggle to control renewal
  • Renewals run through Manage Subscription and Renew in the account dashboard, or through a reseller.
  • Licence transfers to another user go to hello@portswigger.net.
  • PortSwigger requires prepayment for all orders.

Refund rules

Burp Suite Professional
Fees are non-cancellable and non-refundable unless the terms or the order say otherwise.
BSCP exam, consumers
Cancel within 14 days of purchase by emailing hello@portswigger.net. No refund once the exam has been taken.
Exam cancelled by PortSwigger
With 48 hours’ notice, the candidate can retake the exam for free, without an automatic refund.
Disputes
English law and the courts of England and Wales.

From the Burp Suite Professional terms, the certification terms and the customer FAQs on portswigger.net, checked on 15 October 2026.

PortSwigger for Business

Plans for companies
  • 01Burp Suite Professional is licensed per user, and a licence cannot be shared between people.
  • 02Admins add users to an existing licence from the PortSwigger account, priced pro rata for the days left.
  • 03Burp Suite DAST has no limit on users and runs self-hosted or in PortSwigger’s cloud.
  • 04DAST connects to Jira, Trello, GitLab, Splunk and Slack, with SSO, SCIM and role-based access.
  • 05Companies buy BSCP exams for several employees through the sales team.

Professional costs $499 per user a year on 15 October 2026. DAST prices come on a quote.

Latest news

  1. Introducing Burp AT: agentic AI, built on two decades of Burp Suite
  2. PortSwigger receives the King’s Award for Enterprise in International Trade
  3. Burp Suite Enterprise Edition becomes Burp Suite DAST
  4. Investing to deliver more: Brighton Park Capital invests in PortSwigger
  5. Introducing the Burp Suite Certified Practitioner accreditation

Contacts and company data

Legal entity
PortSwigger Ltd, 6 Booths Park, Chelford Road, Knutsford, WA16 8ZS, United Kingdom
Company number
06719143, Companies House
Registered
9 October 2008
VAT number
GB948563085
Activity
SIC 62012, business and domestic software development
Latest accounts
Group accounts for the year to 31 December 2025, filed 28 May 2026

Programs and documentsPractice examExam preparation stepsFind a resellerCertification terms

Alternatives to PortSwigger

How we built this profile

  1. Sources. Facts come from the company’s own website, press room, imprint and careers page, from Wikipedia, the App Store, Google Play and Trustpilot. Every source is listed on the page.
  2. Checks. Kinescope checked every number on 15 October 2026. Prices, ratings and job counts change, and we refresh them with each update.
  3. Our words. Descriptions are written by the Kinescope team. Quotes from reviews are marked with the author and source, and we do not rate the company ourselves.
  4. Corrections. The company can send new facts or corrections, and we update the profile.

Other tech skills companies

All 19 tech skills companies

More EdTech from United Kingdom

Is this your company?

Send us new facts, products, numbers or a fresh logo, and we will update the PortSwigger profile on the EdTech map.

Update this profile Add another company
Featured on Kinescope EdTech Map
Show the badge on your website <a href="https://kinescope.com/edtech-map/portswigger"><img src="https://kinescope.com/images/edtech-badge.svg" alt="Featured on Kinescope EdTech Map" width="220" height="56"></a>

PortSwigger FAQ

A British company from Knutsford, near Manchester, that makes Burp Suite, a toolkit for web application security testing. It also runs the free Web Security Academy and the Burp Suite Certified Practitioner exam. Dafydd Stuttard registered the company in 2008.

Yes. All lessons and all 273 labs are free, and a free account at portswigger.net tracks progress. For labs that need a tool, the Academy points to the free Burp Suite Community Edition. The certification exam is paid.

On 15 October 2026 the checkout page shows $99, €89 or £69 for one exam. The candidate also needs an active Burp Suite Professional licence, because the exam cannot be done with Community Edition.

Four hours, two vulnerable applications and three stages in each: access a user account, reach the admin interface and read /home/carlos/secret from the server. An automated proctor checks a government photo ID, and a webcam and microphone are needed. Results come by email, and the certificate is valid for five years.

Host your courses on Kinescope.

DRM, a white-label player and analytics for online schools and EdTech platforms.

Start for free
Video hosting for EdTech
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.