Burp Suite BurpGPT
ModerateAI extension for Burp Suite that sends analyzed web traffic to a language model to automate detection of security vulnerabilities, including those traditional scanners may miss.
Facts
- Domain
burpgpt.app- Category
- Automation
- Risk level
- Moderate
- Home country
- Reino Unido
Home country is the headquarters of the company behind the tool. It is not a claim about where data is processed or stored — data residency depends on the plan you hold and must be confirmed with the vendor.
Why Burp Suite BurpGPT is classified as moderate risk
Moderate-risk tool. Check compliance with the company's AI policy and classify it appropriately.
What to do about it
Approval conditional on classification. The risk is not in the tool itself, but in the data that goes into it. Classify it as allowed, restricted or prohibited in your policy, communicate that to employees and keep the record — that is what LGPD and ISO 42001 ask for as evidence.
Here is the distinction almost every company gets wrong in its first audit: no framework — LGPD, ISO 42001, the EU AI Act — requires you to block AI tools. All of them require you to know what is in use and to have made a conscious, recorded decision about each item. A high-risk tool approved under a written policy is compliance; a low-risk tool in use with nobody aware of it is an audit finding.
Is Burp Suite BurpGPT being used in your company?
Tangerin AI detects usage of Burp Suite BurpGPT and other AI tools across company workstations — recording which tool, when, and on which machine. Never the content of conversations, prompts or uploaded files.