Compare products

Put two or three cybersecurity products side by side and see how they differ on deployment, pricing, features, integrations and compliance.

OWASP ZAPStackHawk DAST2 of 3 products

Side-by-side comparison of OWASP ZAP, StackHawk DAST
Product	OWASP ZAP by OWASP View product	StackHawk DAST by StackHawk View product
Overview
What it is	OWASP ZAP from OWASP focuses on API security testing. Key capabilities: REST API control. Compare it with the leading Application Security Testing alternatives.	Get the facts on StackHawk DAST: developer-first DAST and automated pull request testing. Built for DevSecOps. Compare it with other DAST options before you decide.
Product type	Open-Source Dynamic Application Security Testing (DAST) Scanner	CI/CD Native Dynamic Application Security Testing Platform
Best for	Penetration Testers, DevSecOps, AppSec Teams, Developers	DevSecOps, Software Engineering, Financial Services, Technology
Pricing
Pricing model	Contact Vendor	Contact Vendor
Free trial	Free trial: yes	Free trial: yes
Deployment
Deployment options	Cloud	SaaSCloud
Deployment details	Desktop Client; CLI; Container; CI/CD; Desktop GUI; CLI; Docker container; Automation framework	Cloud SaaS; Local CLI Runner; Cloud SaaS Controller + Containerized HawkScan CLI
Data residency	Local; Self-hosted	United States; Global Cloud
Key features
What it offers	Intercepting web proxy Automated active/passive vulnerability scanner REST API control CI/CD pipeline automation Community add-on marketplace Automated web vulnerability scanning Manual penetration testing proxy CI/CD DAST pipeline integration	Developer-first DAST Automated pull request testing Authenticated session fuzzing Reproducible curl commands CI/CD security quality gates Developer-driven dynamic security testing Pull-request vulnerability triage DevSecOps
Platform & access
API access	API access: yes	API access: yes
Single sign-on (SSO)	SSO: no	SSO: yes
Role-based access (RBAC)	RBAC: no	RBAC: yes
Multi-tenant	Multi-tenant: no	Multi-tenant: yes
Mobile app	Mobile app: no	Mobile app: no
Supported platforms	DesktopCI/CDCloudContainers	Web ApplicationsMicroservicesCI/CD Runners
Compliance	Open-source Apache 2.0OWASP Flagship Project	SOC 2 Type IIGDPR
Integrations & coverage
Integrations	GitHub ActionsGitLab CIJenkinsJiraPostmanSelenium	GitHub ActionsGitLab CICircleCIJenkinsAzure DevOpsJira
Industries	Penetration TestersDevSecOpsAppSec TeamsDevelopers	DevSecOpsSoftware EngineeringFinancial ServicesTechnology
Regions	Global	Global
Vendor
Company	OWASP	StackHawk
Headquarters	Global nonprofit organization	Denver, Colorado, USA
Company size	11-50	51-200
Founded	2001	2019

OWASP ZAP

by OWASP

View product

StackHawk DAST

by StackHawk

View product

Overview

What it is

OWASP ZAP

OWASP ZAP from OWASP focuses on API security testing. Key capabilities: REST API control. Compare it with the leading Application Security Testing alternatives.

StackHawk DAST

Get the facts on StackHawk DAST: developer-first DAST and automated pull request testing. Built for DevSecOps. Compare it with other DAST options before you decide.

Product type

OWASP ZAP

Open-Source Dynamic Application Security Testing (DAST) Scanner

StackHawk DAST

CI/CD Native Dynamic Application Security Testing Platform

Best for

OWASP ZAP

Penetration Testers, DevSecOps, AppSec Teams, Developers

StackHawk DAST

DevSecOps, Software Engineering, Financial Services, Technology

Pricing

Pricing model

OWASP ZAP

Contact Vendor

StackHawk DAST

Contact Vendor

Free trial

OWASP ZAP

StackHawk DAST

Deployment

Deployment options

OWASP ZAP

Cloud

StackHawk DAST

SaaSCloud

Deployment details

OWASP ZAP

Desktop Client; CLI; Container; CI/CD; Desktop GUI; CLI; Docker container; Automation framework

StackHawk DAST

Cloud SaaS; Local CLI Runner; Cloud SaaS Controller + Containerized HawkScan CLI

Data residency

OWASP ZAP

Local; Self-hosted

StackHawk DAST

United States; Global Cloud

Key features

What it offers

OWASP ZAP

Intercepting web proxy
Automated active/passive vulnerability scanner
REST API control
CI/CD pipeline automation
Community add-on marketplace
Automated web vulnerability scanning
Manual penetration testing proxy
CI/CD DAST pipeline integration

StackHawk DAST

Developer-first DAST
Automated pull request testing
Authenticated session fuzzing
Reproducible curl commands
CI/CD security quality gates
Developer-driven dynamic security testing
Pull-request vulnerability triage
DevSecOps

Platform & access

API access

OWASP ZAP

StackHawk DAST

Single sign-on (SSO)

OWASP ZAP

StackHawk DAST

Role-based access (RBAC)

OWASP ZAP

StackHawk DAST

Multi-tenant

OWASP ZAP

StackHawk DAST

Mobile app

OWASP ZAP

StackHawk DAST

Supported platforms

OWASP ZAP

DesktopCI/CDCloudContainers

StackHawk DAST

Web ApplicationsMicroservicesCI/CD Runners

Compliance

OWASP ZAP

Open-source Apache 2.0OWASP Flagship Project

StackHawk DAST

SOC 2 Type IIGDPR

Integrations & coverage

Integrations

OWASP ZAP

GitHub ActionsGitLab CIJenkinsJiraPostmanSelenium

StackHawk DAST

GitHub ActionsGitLab CICircleCIJenkinsAzure DevOpsJira

Industries

OWASP ZAP

Penetration TestersDevSecOpsAppSec TeamsDevelopers

StackHawk DAST

DevSecOpsSoftware EngineeringFinancial ServicesTechnology

Regions

OWASP ZAP

Global

StackHawk DAST

Global

Vendor

Company

OWASP ZAP

OWASP

StackHawk DAST

StackHawk

Headquarters

OWASP ZAP

Global nonprofit organization

StackHawk DAST

Denver, Colorado, USA

Company size

OWASP ZAP

11-50

StackHawk DAST

51-200

Founded

OWASP ZAP

2001

StackHawk DAST

2019