OWASP ZAP
The free, open-source DAST scanner that attacks your running application.
What it is
ZAP (Zed Attack Proxy) is an intercepting proxy and dynamic scanner that probes a running application for injection, misconfiguration, authentication and session flaws. It can run as an automated baseline scan in CI or as an interactive tool for manual security testing, and it is the standard free option in the category.
Best for
Where it is strong
- Free, with no licence limits on scanning or users.
- The baseline scan runs in CI in a couple of minutes and catches real misconfiguration.
- Active community and extensive add-on marketplace.
Where it falls short
- Higher false-positive rate than commercial DAST tools.
- Scanning authenticated, JavaScript-heavy applications requires meaningful configuration effort.
- The interface is dated and the learning curve is real.
Pricing
Free and open source
Open sourceFree tier: Everything, self-hosted
What drives the bill: Free and open source. You pay in engineering time and CI minutes.
Check current pricing on Checkmarx / OWASP’s siteFigures are indicative and were last reviewed August 2026. Vendors change pricing often; confirm before you commit.
Works with
What people who use OWASP ZAP say
No reviews of OWASP ZAP yet. If you have used it in anger, yours would be the first.
Alternatives to OWASP ZAP
If OWASP ZAP is not the right fit, these solve the same problem differently.
Burp Suite
Security Testing
The professional web security tester's tool of choice, plus an enterprise scanner.
Invicti
Security Testing
DAST with proof-based scanning that confirms a vulnerability is real before reporting it.
Checkmarx One
Security Testing
Enterprise application security platform: SAST, SCA, DAST, IaC and API security.