OWASP ZAP
by OWASPVerified
OWASP ZAP from OWASP focuses on API security testing. Key capabilities: REST API control. Compare it with the leading Application Security Testing alternatives.
- Product Type
- Open-Source Dynamic Application Security Testing (DAST) Scanner
- Deployment
- Cloud
- Industries
- 4+ industries
- Regions
- Global
- Free Trial
- Yes
- Pricing
- Contact Vendor
About OWASP ZAP
OWASP ZAP, from OWASP, is an Open-Source dynamic application security testing (DAST) scanner for DAST, web application security and application security testing. Core capabilities include Intercepting web proxy, automated active/passive vulnerability scanner, REST API control, CI/CD pipeline automation and community add-on marketplace. Typical customers include penetration testers, DevSecOps, AppSec teams and developers organizations.
Categories & Subcategories
Categories
Subcategories
Where OWASP ZAP is ranked
Featured in 3 Cyber Rank rankings.
Key Features
5 capabilities that OWASP ZAP offers.
Automated active/passive vulnerability scanner
REST API control
CI/CD pipeline automation
Community add-on marketplace
Use Cases
Automated web vulnerability scanning
Manual penetration testing proxy
CI/CD DAST pipeline integration
API security testing
Industries Served
OWASP ZAP is used across 4+ industries.
Penetration Testers
DevSecOps
AppSec Teams
Developers
Regions
Global
Integrations
Works with the tools teams already use
GitHub Actions
GitLab CI
Jenkins
Jira
Postman
Selenium
Deployment Options
Flexible deployment to meet your needs
Cloud
Platform & Access
What OWASP ZAP supports, at a glance.
- API accessYes
- Single sign-on (SSO)No
- Role-based access (RBAC)No
- Multi-tenantNo
- Mobile appNo
Security & Compliance
Standards, regulations, and frameworks this product aligns with.
Open-source Apache 2.0OWASP Flagship Project
- Supported platforms
- DesktopCI/CDCloudContainers
- Operating systems
- LinuxmacOSWindowsDocker
- Browser support
- ChromeEdgeFirefoxSafari
- Languages supported
- Multilingual (25+ languages)
- Data residency
- Local; Self-hosted
- Deployment details
- Desktop Client; CLI; Container; CI/CD; Desktop GUI; CLI; Docker container; Automation framework
OWASP ZAP Reviews
No reviews yet
Be the first to share your experience with OWASP ZAP.
More Products from OWASP
View all →OWASP Dependency-Check
OWASP Dependency-Check: automated CVE identification, multi-language dependency support and NVD sync. Built for open-source component scanning. Compare SCA alternatives.
OWASP Amass
OWASP Amass offers OSINT source scraping and active & passive DNS enumeration. Use it for external asset discovery. See Attack Surface Management alternatives.
Product Resources
Explore More Products
Other cybersecurity products listed on Cyber Rank.
Acunetix
byInvicti
Acunetix by Invicti: reports and DeepScan DOM crawler. Ideal for Web Application Security. Deployment: cloud. See how it compares with top DAST alternatives.
Application SecurityView details
AppScan Enterprise
AppScan Enterprise covers jira integration and modern SPA and API scanning for portfolio-wide web application scanning. Compare top Application Security Testing tools.
Application SecurityView details
Fortify WebInspect
byOpenText
Looking for Application Security Testing software? Fortify WebInspect by OpenText provides IAST agent for API security validation. Compare features and alternatives.
Application SecurityView details
Invicti Enterprise
byInvicti
Evaluating Invicti Enterprise? See how this DAST tool handles DAST scanning and Proof-Based Scanning, where it fits best and which alternatives to compare.
Application SecurityView details