ZAP by Checkmarx

What it is

ZAP, short for Zed Attack Proxy, is a free web application security scanner. Like Burp Suite it runs as an intercepting proxy so you can inspect and modify traffic between a browser and a web application, and it adds an automated scanner, a spider for crawling an application's structure, and a large library of community add-ons.

Who maintains it now

ZAP began as an OWASP flagship project. In 2024 its core team joined Checkmarx, and as of 2026-09 the official site brands it "ZAP by Checkmarx" while stating that "ZAP is an independent Open Source project". The code is licensed under Apache 2.0, with releases and source still public on GitHub.

What you can do with it

ZAP can passively review traffic as you browse an application, run an active scan that probes for common vulnerability classes, and run automatically in a CI pipeline through its Docker images, which is how many teams use it to check their own staging environments. It has a gentler learning curve than some commercial tools and a large add-on marketplace for extending it.

Free versus paid

The core ZAP scanner is entirely free with no paid tier gating its main features, unlike some competing tools that reserve automated scanning for a paid edition. Checkmarx's own commercial products are separate from ZAP itself.

How to use it

Start with the desktop application against a deliberately vulnerable practice site, learn the difference between passive and active scanning, and read the alerts ZAP raises critically, since automated scanners produce false positives that need manual verification. The official site's getting started guide and video tutorials are the quickest route in.

Authorised use only

Only test systems you own or are explicitly authorised to test: your own lab, a CTF, or an in-scope bug bounty programme. Active scans send large volumes of unusual requests and can change data, so point them at your own local copy of an application (OWASP Juice Shop is ideal) or a staging environment your team owns.

Common questions

Is ZAP still actively developed after leaving OWASP? Yes, releases continue under the same core team; check the GitHub releases page for the latest version.

How does it compare with Burp Suite? Both cover similar ground; ZAP's automated scanning is free by default where Burp reserves that for its paid Professional tier, though many testers use both.

Can it run unattended in CI? Yes, through its Docker images and automation framework, aimed at exactly that use case.