I find the automated scans in ZAP by Checkmarx help me save time and offer valuable reports and suggestions. I like that the reports come in different formats, which is really convenient. Also, I appreciate that it's open-sourced, which adds to its flexibility. Plus, the initial setup was very easy. Review collected by and hosted on G2.com.

The interface is too old styled. If the interface is changed to more user-friendly or a customizable interface, it would be great. Review collected by and hosted on G2.com.

The detection mechanisms developed for ZAP are quite effective. It's easy to initiate an active scan or start crawling, and the built-in integration with Firefox is convenient. However, I find the user interface to be cluttered, so I primarily use it only for Active scans. Review collected by and hosted on G2.com.

The UI can surely be made clearer similar to burp, and it would just outstand burp in a blink of an eye. Specially the request response windows are too narrow and tools and settings are just plain dropdown lists which is not so great to be navigating through. Review collected by and hosted on G2.com.

Zap is one of the best web application security scanners. I think it has more features than Burp Suite. ZAP has more automated scan features, and the spider fuzz and AJAX spider are really amazing. I highly recommend using ZAP for automated scans. Review collected by and hosted on G2.com.

ZAP does not have a browser. Like Burp Suite, ZAP needs to implement that. Review collected by and hosted on G2.com.

The OWASP ZAP can be even used in Windows and we don't need any Linux OS. Also, it is very easy to use and it's free of cost. We can also customize ZAP according to our testing needs by switching certain scripts. Review collected by and hosted on G2.com.

OWASP has only some limited automated tasks and may not have new features like all other web pen testing apps. Review collected by and hosted on G2.com.

As a security researcher, this tool has helped me to scan the website. Once the scan is completed, you can generate the report. The automated scan feature is really good. If you're a beginner and don't have much knowledge in security scanning, you can try this tool. Very user-friendly and easy to understand all the features. Very easy to install. The more you use it, the more you'll master the tool. Review collected by and hosted on G2.com.

This tool gives some false positive findings, so we need to check if all the findings are true or not. Moreover, it's a great tool for web application assessment. Review collected by and hosted on G2.com.

Owasp zap proxy is the best recon and penetration testing tool which contains the all things from manual testing to automation testing. For me, especially automatic testing is the best testing with AJAX spider and active scanning performing all vulnerability tests, which is really good. Review collected by and hosted on G2.com.

Sometimes in automation testing it gives false positives, but to avoid that, we have to configure all scanning and moreover install some scripts to reduce it. But overall, this tool is all-in-one. Review collected by and hosted on G2.com.

1. It is open source

2. Customizable dashboards and user friendly interface

3. Active and Passive automated Scanning provided along with proxy interception support.

4. easy integration with CI/CD piplelines Review collected by and hosted on G2.com.

1. It is resource intensive and takes considerable amount of time for big applications

2. Issue with False positives leading to need of manual intervention many times Review collected by and hosted on G2.com.

OWASP zap is world best web app security scanner, and it is open source, and also it's powered by OWASP, the best thing is it's free Review collected by and hosted on G2.com.

Almost is really good but Some time its gives false positive Review collected by and hosted on G2.com.

It is easy to use and there are different types of attacks present which can be done in easier way Review collected by and hosted on G2.com.

Until now the product is good so no negative remark Review collected by and hosted on G2.com.

Support for Active, Passive and Fuzzy scans via Desktop app as well as it can be used via API bindings which can be further integrated in pipelines and can be scheduled as required Review collected by and hosted on G2.com.

For using OWASP ZAP little more crisp documentation is required though we will get best community support. Application can be used by beginner but for getting expertise we need some more documentation. Review collected by and hosted on G2.com.