We performed a comparison between OWASP Zap and Acunetix based on our users’ reviews in four categories. After reading all of the collected data, you can find our conclusion below.
Comparison Result: Based on the parameters we compared, OWASP Zap comes out ahead of Acunetix. Although both products have valuable features and have straightforward deployments, our reviewers found that Acunetix has high pricing, which is considered expensive by some users, especially for small organizations.
"The solution is highly stable."
"Their technical support has been very active. If I have an issue, I can reach out to them and get an answer pretty quick."
"One of the features that I feel is groundbreaking, that I would like to see expanded on, is the IAS feature: The Interactive Application Security Testing module that gets loaded onto an application on a server, for more in-depth, granular findings. I think that is really neat. I haven't seen a lot of competitors doing that."
"There is a lot of documentation on their website which makes setting it up and using it quite simple."
"For us, the most valuable aspect of the solution is the log-sequence feature."
"Our developers can run the attacks directly from their environments, desktops."
"I haven't seen reporting of that level in any other tool."
"Acunetix is the best service in the world. It is easy to manage. It gives a lot of information to the users to see and identify problems in their site or applications. It works very well."
"The best feature is the Zap HUD (Heads Up Display) because the customers can use the website normally. If we scan websites with automatic scanning, and the website has a web application firewall, it's very difficult."
"The solution is good at reporting the vulnerabilities of the application."
"It has evolved over the years and recently in the last year they have added, HUD (Heads Up Display)."
"The scalability of this product is very good."
"The interface is easy to use."
"The API is exceptional."
"You can run it against multiple targets."
"The solution has tightened our security."
"Acunetix needs to be dynamic with JavaScript code, unlike Netsparker which can scan complex agents."
"It should be easier to recreate something manually, with the manual tool, because Acunetix is an automatic tool. If it finds something, it should be easier to manually replicate it. Sometimes you don't get the raw data from the input and output, so that could be improved."
"Currently only supports web scanning."
"There's a clear need for a reduction in pricing to make the service more accessible."
"When monitoring the traffic we always have issues with the bandwidth consumption and the throttling of traffic."
"I had some issues with the JSON parameters where it found some strange vulnerabilities, but it didn't alert the person using it or me about these vulnerabilities, e.g., an error for SQL injection."
"In terms of what needs improvement, the way the licensing model is currently is not very convenient for us because initially, when we bought it, the licensing model was very flexible, but now it restricts us."
"The pricing is a bit on the higher side."
"It doesn't run on absolutely every operating system."
"Zap could improve by providing better reports for security and recommendations for the vulnerabilities."
"ZAP's integration with cloud-based CICD pipelines could be better. The scan should run through the entire pipeline."
"The technical support team must be proactive."
"Reporting format has no output, is cluttered and very long."
"If there was an easier to understand exactly what has been checked and what has not been checked, it would make this solution better. We have to trust that it has checked all known vulnerabilities but it's a bit hard to see after the scanning."
"OWASP Zap needs to extend to mobile application testing."
"Deployment is somewhat complicated."
Acunetix is ranked 13th in Static Application Security Testing (SAST) with 26 reviews while OWASP Zap is ranked 7th in Static Application Security Testing (SAST) with 37 reviews. Acunetix is rated 7.6, while OWASP Zap is rated 7.6. The top reviewer of Acunetix writes "Fantastic reporting features hindered by slow scanning ". On the other hand, the top reviewer of OWASP Zap writes "Great for automating and testing and has tightened our security ". Acunetix is most compared with Tenable.io Web Application Scanning, PortSwigger Burp Suite Professional, HCL AppScan, Fortify WebInspect and Veracode, whereas OWASP Zap is most compared with SonarQube, Qualys Web Application Scanning, PortSwigger Burp Suite Professional, Veracode and Checkmarx One. See our Acunetix vs. OWASP Zap report.
See our list of best Static Application Security Testing (SAST) vendors.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
