OWASP Zap Reviews

Name: OWASP Zap
Brand: OWASP
Rating: 3.8 (39 reviews)

Vendor: OWASP

3.8 out of 5

39 reviews
87% willing to recommend

844 followers

Start review

What is OWASP Zap?

OWASP Zap is a free and open-source web application security scanner.

Get the OWASP Zap Buyer's Guide and find out what your peers are saying about OWASP Zap, SonarQube Server (formerly SonarQube), GitLab and more!

OWASP Zap is the #8 ranked solution in AST tools. PeerSpot users give OWASP Zap an average rating of 7.6 out of 10. OWASP Zap is most commonly compared to SonarQube Server (formerly SonarQube): OWASP Zap vs SonarQube Server (formerly SonarQube). OWASP Zap is popular among the large enterprise segment, accounting for 61% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 18% of all views.

Helped 842,690 peers since 2012

Featured OWASP Zap reviews

Amit Beniwal

Project Manager at Al Hassan LLC

There are areas for improvement with OWASP Zap, particularly in the alignment of vulnerabilities concerning CVSS scores. Sometimes, a vulnerability initially categorized as high severity may be reduced to medium or low over time after security patches are applied. This alignment with the present severity score and CVSS score could be improved.

Read full review

Prasant Pokarnaa

Delivery Head - DevOps at Datamato Technologies

OWASP is only meant for two or three different types of scans. It is a tool which will scan the code for security for vulnerabilities We were able to convince the customers to really remove those rules when GitLab was able to show the results. Customers should be aware that GitLab is not just a…

Read full review

JoelGeorge

Associate at Tata Consultancy

The work that it does in the limited scope is good, but the scope is very limited in terms of the scanning features. The number of things it tests or finds is limited. They need to make it a more of a mainstream tool that people can use, and they can even think about having it on a proprietary basis. They need to increase the coverage of the scan and the results that it finds. That has always been Zap's limitation. Zap is a very good tool for a beginner, but once you start moving up the ladder where you want further details and you want your scan to show more in-depth results, Zap falls short because its coverage falls short. It does not have the capacity to do more. It should have more reporting options because the reporting options are currently only in HTML, XLS, and so on, but there is nothing in PDF or Word, which makes it a bit less user-friendly. It needs more comprehensive reporting. It already has a reporting system, but it is just not user-friendly.

Read full review

OWASP Zap mindshare

As of March 2025, the mindshare of OWASP Zap in the Static Application Security Testing (SAST) category stands at 5.0%, down from 5.9% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Static Application Security Testing (SAST)

PeerAnalyst reports based on OWASP Zap reviews

Type	Title	Date
Category	Static Application Security Testing (SAST)	Mar 31, 2025	Download
Product	Reviews, tips, and advice from real users	Mar 31, 2025	Download
Comparison	OWASP Zap vs SonarQube Server (formerly SonarQube)	Mar 31, 2025	Download
Comparison	OWASP Zap vs Veracode	Mar 31, 2025	Download
Comparison	OWASP Zap vs Checkmarx One	Mar 31, 2025	Download

Title	Rating	Mindshare	Recommending
SonarQube Server (formerly SonarQube)	4.0	27.1%	81%	114 interviews Add to research
GitLab	4.3	2.7%	97%	82 interviews Add to research

Valuable Features

OWASP Zap's most valuable features include robust support for automated and manual scanning, an intuitive interface, comprehensive reporting, and extensive language support. It offers privacy while enabling testing of non-business critical applications. Users appreciate the easy setup, scalability, and integration capabilities. The free open-source nature makes it accessible to beginners and smaller teams. Community support, API integration, and the Heads Up Display (HUD) feature for browser-based control also enhance its appeal.

"OWASP is quite matured in identifying the vulnerabilities."
"OWASP Zap is a good tool, one of my favorites for a long time, and I would recommend it."
"One valuable feature of OWASP Zap is that it is simple to use."

Room for Improvement

OWASP Zap's documentation requires updating to fully utilize its features and integration capabilities. Users encounter issues with website scanning, limited reporting formats, and false positives. Reporting tools need to provide clearer, editable, visually appealing results. Users seek improved automation, broader vulnerability coverage, and security intelligence. Integration with cloud pipelines should be enhanced. There is a demand for simplified deployment, better user guidance, and more regular updates. Additionally, enhanced customization options and reduced resource intensity during operations are crucial.

"OWASP should work on reducing false positives by using AI and ML algorithms. They should expand their capabilities for broader coverage of business logic flaws and complex issues."
"For scalability, I would rate OWASP Zap between four to five out of ten."
"There are areas for improvement with OWASP Zap, particularly in the alignment of vulnerabilities concerning CVSS scores."

ROI

Users reported significant improvements in security measures, enhanced vulnerability detection, and increased overall protection.

The tool was praised for its user-friendly interface, extensive features, and effectiveness in identifying potential threats.

Users also highlighted the cost-effectiveness of OWASP Zap, as it provided robust security solutions without requiring substantial financial investments.

Pricing

OWASP Zap is a highly recommended open-source security testing tool available under the Apache 2 license, making it free to use with no setup costs. Many enterprises prioritize it for its comprehensive features akin to commercial solutions. The lack of licensing fees and its ease of use appeal to organizations uncertain about their scaling needs. While indirect costs can arise from deployment resources, the overall feedback confirms OWASP Zap as an attractive, cost-effective option for enterprises.

"It is open source, and we can scan freely."
"The tool is open source."
"The tool is open-source."

Popular Use Cases

OWASP Zap is widely utilized for web application security testing and vulnerability assessment. Users employ it for spidering websites, scanning applications for vulnerabilities, penetration testing, and generating reports. It supports security verification of applications in various development cycles and DevOps pipelines. Its functionality includes reviewing HTTP methods, detecting sensitive information, confirming safe HTTPS certifications, and evaluating SQL injections. OWASP Zap serves as a core tool for ensuring secure software deployment and application safety.

Service and Support

OWASP Zap customer service and support receive mixed feedback. Many highlight excellent community resources and forums for resolving issues. Some praise the maintainers' dedication, noting their assistance with specific problems. Despite these positives, others mention lacking formal technical support, requiring reliance on community and documentation. Response quality varies, with some users rating support high and others finding it limited. Community engagement emerges as a key resource for users navigating challenges.

Deployment

OWASP Zap's initial setup is generally straightforward and quick, often completed in under an hour. It is well-supported by documentation and tutorials, making configuration manageable for technical users. While some find it slightly complex and requiring expertise, particularly for API setup, updates on Kali are automated. Windows users need manual updates. Installation across different operating systems is simple, with options for cloud or on-premise deployments, often requiring minimal team involvement.

Scalability

OWASP Zap is recognized for its scalability with flexible extensions and add-ons, supporting parallel target operations. While some encounter speed concerns or resource limitations, it efficiently addresses vulnerabilities. User experiences vary, with some finding it scalable for their needs, while others suggest room for improvement. It is employed by multiple users across companies, indicating moderate scalability, but larger-scale environments may require additional infrastructure support. The tool offers strong compatibility with various platforms and testing approaches.

Stability

Users find OWASP Zap stable with no major stability challenges. Reports suggest occasional lag with high loads or specific configurations, especially on virtual machines or during large request handling. Most users do not experience crashes or freezes. Some adjustments may be needed for browser integration. While some users encounter false positives and memory usage increases, stability is generally rated highly, often between eight to nine out of ten.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our OWASP Zap Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

18%

Financial Services Firm

12%

Manufacturing Company

Government

University

Retailer

Educational Organization

Healthcare Company

Comms Service Provider

Insurance Company

Construction Company

Media Company

Real Estate/Law Firm

Non Profit

Energy/Utilities Company

Outsourcing Company

Legal Firm

Wholesaler/Distributor

Transportation Company

Logistics Company

Hospitality Company

Consumer Goods Company

Performing Arts

Recreational Facilities/Services Company

Pharma/Biotech Company

Compare OWASP Zap with alternative products

Learn more about OWASP Zap

The solution helps developers identify vulnerabilities in their web applications by actively scanning for common security issues.

With its user-friendly interface and powerful features, Zap is a popular choice among developers for ensuring the security of their web applications.

OWASP Zap customers

1. Google 2. Microsoft 3. IBM 4. Amazon 5. Facebook 6. Twitter 7. LinkedIn 8. Netflix 9. Adobe 10. PayPal 11. Salesforce 12. Cisco 13. Oracle 14. Intel 15. HP 16. Dell 17. VMware 18. Symantec 19. McAfee 20. Citrix 21. Red Hat 22. Juniper Networks 23. SAP 24. Accenture 25. Deloitte 26. Ernst & Young 27. PwC 28. KPMG 29. Capgemini 30. Infosys 31. Wipro 32. TCS