--- title: ZAP by Checkmarx Reviews meta_title: 'ZAP by Checkmarx Reviews 2026: Details, Pricing, & Features | G2' meta_description: Filter 14 reviews by the users' company size, role or industry to find out how ZAP by Checkmarx works for a business like yours. aggregate_rating: rating_value: 4.7 review_count: 14 scale: '5' date_modified: '2026-09-22' parent_category: name: "DevSecOps\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t" url: https://www.g2.com/categories/devsecops --- # ZAP by Checkmarx Reviews **Vendor:** Checkmarx **Category:** [Penetration Testing Tools](https://www.g2.com/categories/penetration-testing-tools) **Average Rating:** 4.7/5.0 **Total Reviews:** 14 **AI Enabled:** This product embeds AI to enhance or extend its core functionality. ## About ZAP by Checkmarx ZAP by Checkmarx, formerly known as Zed Attack Proxy , is a leading open-source web application security scanner designed to help developers, testers, and security professionals identify vulnerabilities in web applications. Actively maintained by a global community, ZAP offers both automated and manual testing capabilities, making it suitable for users with varying levels of security expertise. Key Features and Functionality: - Automated Security Scanning: ZAP provides simple, single-click automated scanning, enabling users to identify security flaws with ease. - Active and Passive Scanning: Utilizes both passive and active scanning techniques to uncover a wide range of security vulnerabilities. - Advanced User Controls: Offers tools like manual interception, fuzzing, and forced browsing for thorough penetration testing. - CI/CD Integration: Seamlessly integrates with Continuous Integration/Continuous Deployment pipelines, automating security testing within development workflows. - Cross-Platform Support: Compatible with Linux, Windows, and macOS operating systems. Primary Value and Problem Solved: ZAP by Checkmarx addresses the critical need for accessible and effective web application security testing. By offering a free, open-source solution with both automated and manual testing capabilities, ZAP empowers organizations to identify and remediate vulnerabilities early in the development lifecycle. Its integration with CI/CD pipelines ensures that security becomes an integral part of the development process, reducing the risk of security breaches and enhancing overall application security. ## ZAP by Checkmarx Pros & Cons Pros and Cons are compiled from review feedback and grouped into themes to provide an easy-to-understand summary of user reviews. **What users like:** - Users find ZAP's **ease of use** exceptional, making it perfect for both beginners and experienced security researchers. (6 reviews) - Users appreciate the **advanced automation features** of ZAP, making web application security scanning efficient and user-friendly. (5 reviews) - Users praise ZAP's **exceptional automated testing features** , highlighting its effectiveness in vulnerability assessments and integrations. (3 reviews) - Users highlight the **easy integrations** with CI/CD tools, enhancing automation and usability for seamless development workflows. (3 reviews) - Users find ZAP by Checkmarx enhances **pentesting efficiency** with its user-friendly interface and comprehensive automation features. (3 reviews) - Scanning Efficiency (3 reviews) - Users value the **customizability** of ZAP by Checkmarx, as it allows tailored testing according to individual needs. (2 reviews) - Users love the **easy integration with CI/CD pipelines** , enhancing their development workflow and productivity. (2 reviews) - Users value the **customizable dashboards and user-friendly interface** of ZAP, enhancing their pentesting experience. (2 reviews) - Affordable (1 reviews) **What users dislike:** - Users experience **false positives** that require manual intervention, complicating the review process for findings. (3 reviews) - Users find the **poor documentation** for ZAP by Checkmarx lacking, especially during error troubleshooting. (2 reviews) - Users note the **limited automation scope** in ZAP, lacking new features compared to other web pen testing tools. (1 reviews) - Users often face **navigation problems** due to insufficient documentation and support, complicating their experience with ZAP. (1 reviews) - Users express frustration over **poor customer support** and lack of documentation for ZAP by Checkmarx. (1 reviews) - Slow Performance (1 reviews) ## ZAP by Checkmarx Reviews ### 1. Open-Source Powerhouse with Room for UI Improvement **Rating:** 4.0/5.0 stars **Reviewed by:** AJAYRAJ T. | Freelance Software Engineer, Small-Business (50 or fewer emp.) **Validated Reviewer:** Validated through LinkedIn **Source: G2 invite:** Invitation from G2. This reviewer was not provided any incentive by G2 for completing this review. **Reviewed Date:** May 08, 2026 **What do you like best about ZAP by Checkmarx?** I find the automated scans in ZAP by Checkmarx help me save time and offer valuable reports and suggestions. I like that the reports come in different formats, which is really convenient. Also, I appreciate that it's open-sourced, which adds to its flexibility. Plus, the initial setup was very easy. **What do you dislike about ZAP by Checkmarx?** The interface is too old styled. If the interface is changed to more user-friendly or a customizable interface, it would be great. **What problems is ZAP by Checkmarx solving and how is that benefiting you?** I use ZAP by Checkmarx for automated scans, saving time with its reports and suggestions. ### 2. A tool I use just for Web/API Security Automation **Rating:** 1.5/5.0 stars **Reviewed by:** Verified User in Information Technology and Services | Mid-Market (51-1000 emp.) This reviewer's identity has been verified by our review moderation team. They have asked not to show their name, job title, or picture. **Validated Reviewer:** Validated through Google One Tap using a business email account **Source: Organic Review from User Profile:** Invitation from G2. This reviewer was not provided any incentive by G2 for completing this review. **G2 Icon:** Our network of Icons are G2 members who are recognized for their outstanding contributions and commitment to helping others through their expertise. **Reviewed Date:** September 27, 2025 **What do you like best about ZAP by Checkmarx?** The detection mechanisms developed for ZAP are quite effective. It's easy to initiate an active scan or start crawling, and the built-in integration with Firefox is convenient. However, I find the user interface to be cluttered, so I primarily use it only for Active scans. **What do you dislike about ZAP by Checkmarx?** The UI can surely be made clearer similar to burp, and it would just outstand burp in a blink of an eye. Specially the request response windows are too narrow and tools and settings are just plain dropdown lists which is not so great to be navigating through. **What problems is ZAP by Checkmarx solving and how is that benefiting you?** Active scans mostly I'd say is the probably only best feature and sole reason I have ZAP installed. **If** improved it can raise the bar for every other tool out there. ### 3. the best web application security scanner **Rating:** 5.0/5.0 stars **Reviewed by:** Abhinav N. | Cyber Security Analyst, Computer & Network Security, Small-Business (50 or fewer emp.) **Current User:** The reviewer uploaded a screenshot or submitted the review in-app verifying them as current user. **Validated Reviewer:** Validated through LinkedIn **Source: Organic:** Organic review. This review was written entirely without invitation or incentive from G2, a seller, or an affiliate. **Reviewed Date:** December 29, 2024 **What do you like best about ZAP by Checkmarx?** Zap is one of the best web application security scanners. I think it has more features than Burp Suite. ZAP has more automated scan features, and the spider fuzz and AJAX spider are really amazing. I highly recommend using ZAP for automated scans. **What do you dislike about ZAP by Checkmarx?** ZAP does not have a browser. Like Burp Suite, ZAP needs to implement that. **What problems is ZAP by Checkmarx solving and how is that benefiting you?** ZAP helps me to scan and find vulnerabilities in web applications. ### 4. Best Free web app penetration testing App **Rating:** 4.5/5.0 stars **Reviewed by:** VishNu C. | Digital Marketing Executive, Small-Business (50 or fewer emp.) **Current User:** The reviewer uploaded a screenshot or submitted the review in-app verifying them as current user. **Validated Reviewer:** Validated through LinkedIn **Incentivized:** This reviewer was offered a nominal gift card as thank you for completing this review. **Source: G2 invite:** Invitation from G2. This reviewer was offered a nominal gift card as thank you for completing this review. **Reviewed Date:** November 08, 2023 **What do you like best about ZAP by Checkmarx?** The OWASP ZAP can be even used in Windows and we don't need any Linux OS. Also, it is very easy to use and it's free of cost. We can also customize ZAP according to our testing needs by switching certain scripts. **What do you dislike about ZAP by Checkmarx?** OWASP has only some limited automated tasks and may not have new features like all other web pen testing apps. **What problems is ZAP by Checkmarx solving and how is that benefiting you?** The active and passive scanning in the OWASP ZAP helps in sending payloads easily and monitoring traffic. By adding several extensions and plugins in ZAP, we can improve our penetration testing standards as so many advanced scripted extensions are available easily, and we can try them in real-time pentesting. We can export our reports easily and share them with clients in various formats. ### 5. Best tool for scanning Website **Rating:** 5.0/5.0 stars **Reviewed by:** Mohammed N. | Penetration Tester, Small-Business (50 or fewer emp.) **Current User:** The reviewer uploaded a screenshot or submitted the review in-app verifying them as current user. **Validated Reviewer:** Validated through LinkedIn **Incentivized:** This reviewer was offered a nominal gift card as thank you for completing this review. **Source: G2 invite:** Invitation from G2. This reviewer was offered a nominal gift card as thank you for completing this review. **Reviewed Date:** November 08, 2023 **What do you like best about ZAP by Checkmarx?** As a security researcher, this tool has helped me to scan the website. Once the scan is completed, you can generate the report. The automated scan feature is really good. If you're a beginner and don't have much knowledge in security scanning, you can try this tool. Very user-friendly and easy to understand all the features. Very easy to install. The more you use it, the more you'll master the tool. **What do you dislike about ZAP by Checkmarx?** This tool gives some false positive findings, so we need to check if all the findings are true or not. Moreover, it's a great tool for web application assessment. **What problems is ZAP by Checkmarx solving and how is that benefiting you?** Report generation - simplifies your report making. Automated scan - Manual testing will be easy. ### 6. OWasp Zap Proxy for web penetrations testing **Rating:** 5.0/5.0 stars **Reviewed by:** Jay P. | Cyber Security Intern, Small-Business (50 or fewer emp.) **Current User:** The reviewer uploaded a screenshot or submitted the review in-app verifying them as current user. **Validated Reviewer:** Validated through LinkedIn **Source: Organic:** Organic review. This review was written entirely without invitation or incentive from G2, a seller, or an affiliate. **Reviewed Date:** August 18, 2023 **What do you like best about ZAP by Checkmarx?** Owasp zap proxy is the best recon and penetration testing tool which contains the all things from manual testing to automation testing. For me, especially automatic testing is the best testing with AJAX spider and active scanning performing all vulnerability tests, which is really good. **What do you dislike about ZAP by Checkmarx?** Sometimes in automation testing it gives false positives, but to avoid that, we have to configure all scanning and moreover install some scripts to reduce it. But overall, this tool is all-in-one. **What problems is ZAP by Checkmarx solving and how is that benefiting you?** It finds vulnerabilities in websites with powerful accuracy and also its AJAX crawler, which is the best powerful crawler. It also performs two types of scans for me: one is active scan and the second is passive scan, which is very good. ### 7. ZAP is open source user friendly efficient pentesting tool. **Rating:** 3.5/5.0 stars **Reviewed by:** Gopi K. | SDE-3, Hospital & Health Care, Small-Business (50 or fewer emp.) **Validated Reviewer:** Validated through a business email account **Incentivized:** This reviewer was offered a nominal gift card as thank you for completing this review. **Source: G2 invite:** Invitation from G2. This reviewer was offered a nominal gift card as thank you for completing this review. **Reviewed Date:** January 02, 2024 **What do you like best about ZAP by Checkmarx?** 1. It is open source 2. Customizable dashboards and user friendly interface 3. Active and Passive automated Scanning provided along with proxy interception support. 4. easy integration with CI/CD piplelines **What do you dislike about ZAP by Checkmarx?** 1. It is resource intensive and takes considerable amount of time for big applications 2. Issue with False positives leading to need of manual intervention many times **What problems is ZAP by Checkmarx solving and how is that benefiting you?** 1. Vulnerability Testing and Penetration testing to address these security vulnerabilities before deployments 2. Cost efficient(open-source) solution to help with security enhancements in my applications 3. Pentesting integration with CI/CD pipelines. ### 8. A free web scanner with amazing futures **Rating:** 4.5/5.0 stars **Reviewed by:** Muhammad M. | Penetration Tester, Small-Business (50 or fewer emp.) **Current User:** The reviewer uploaded a screenshot or submitted the review in-app verifying them as current user. **Validated Reviewer:** Validated through LinkedIn **Incentivized:** This reviewer was offered a nominal gift card as thank you for completing this review. **Source: G2 invite:** Invitation from G2. This reviewer was offered a nominal gift card as thank you for completing this review. **Reviewed Date:** November 07, 2023 At G2, we prefer fresh reviews and we like to follow up with reviewers. They may not have updated their review text, but have updated their review. **What do you like best about ZAP by Checkmarx?** OWASP zap is world best web app security scanner, and it is open source, and also it's powered by OWASP, the best thing is it's free **What do you dislike about ZAP by Checkmarx?** Almost is really good but Some time its gives false positive **What problems is ZAP by Checkmarx solving and how is that benefiting you?** As Penetration tester its took some time for vulnerability assessment on web OWASP ZAP is a real solution for that , it will do the vulnerability assessment part for us we only need to the validation and exploitation ### 9. Good product for security testing **Rating:** 4.5/5.0 stars **Reviewed by:** Ashwin H. | Cloud Associate - QA, Information Technology and Services, Enterprise (> 1000 emp.) **Current User:** The reviewer uploaded a screenshot or submitted the review in-app verifying them as current user. **Validated Reviewer:** Validated through Google One Tap using a business email account **Incentivized:** This reviewer was offered a nominal gift card as thank you for completing this review. **Source: G2 invite:** Invitation from G2. This reviewer was offered a nominal gift card as thank you for completing this review. **Reviewed Date:** December 28, 2023 **What do you like best about ZAP by Checkmarx?** It is easy to use and there are different types of attacks present which can be done in easier way **What do you dislike about ZAP by Checkmarx?** Until now the product is good so no negative remark **What problems is ZAP by Checkmarx solving and how is that benefiting you?** Security testing and penetration testing ### 10. Recommend for security scans **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Computer Software | Enterprise (> 1000 emp.) This reviewer's identity has been verified by our review moderation team. They have asked not to show their name, job title, or picture. **Validated Reviewer:** Validated through LinkedIn **Incentivized:** This reviewer was offered a nominal gift card as thank you for completing this review. **Source: G2 invite:** Invitation from G2. This reviewer was offered a nominal gift card as thank you for completing this review. **Reviewed Date:** November 07, 2023 **What do you like best about ZAP by Checkmarx?** Support for Active, Passive and Fuzzy scans via Desktop app as well as it can be used via API bindings which can be further integrated in pipelines and can be scheduled as required **What do you dislike about ZAP by Checkmarx?** For using OWASP ZAP little more crisp documentation is required though we will get best community support. Application can be used by beginner but for getting expertise we need some more documentation. **What problems is ZAP by Checkmarx solving and how is that benefiting you?** As we had integrated OWASP ZAP in pipeline so it was not a specific task for someone to look into but the security issues were captured in no time, when the code is pushed and deployed on environment it was triggering these active, passive and fuzzy scans and the issues were reported way early. ### 11. ZAP integration in CICD process for SecOps **Rating:** 4.5/5.0 stars **Reviewed by:** Vijudev V. | Mid-Market (51-1000 emp.) **Validated Reviewer:** Validated through a business email account **Source: Organic Review from User Profile:** Invitation from G2. This reviewer was not provided any incentive by G2 for completing this review. **Reviewed Date:** December 29, 2023 **What do you like best about ZAP by Checkmarx?** Easy to integrate with the CICD tools like Jenkins, Number of features like different scan methods **What do you dislike about ZAP by Checkmarx?** about the documentation available in the websites **What problems is ZAP by Checkmarx solving and how is that benefiting you?** Used in Jenkins pipeline for the penetration testing of websites using OWASP ZAP ### 12. One of the Best Vulnerability Assessment Tool **Rating:** 5.0/5.0 stars **Reviewed by:** Chevuru N. | Penetration Tester, Computer & Network Security, Small-Business (50 or fewer emp.) **Current User:** The reviewer uploaded a screenshot or submitted the review in-app verifying them as current user. **Validated Reviewer:** Validated through LinkedIn **Source: Organic Review from User Profile:** Invitation from G2. This reviewer was not provided any incentive by G2 for completing this review. **Reviewed Date:** June 26, 2023 **What do you like best about ZAP by Checkmarx?** A Great Vulnerability Assessment Tool Easy to Use, Anyone can understand the user interface. It makes pentester work easier. **What do you dislike about ZAP by Checkmarx?** Everything is good in Zed Attack Proxy. Only one request to OWASP ZAP team needs to add web requests and response images in PDF report. **What problems is ZAP by Checkmarx solving and how is that benefiting you?** Easy to perform Vulnerability Assessment and Penetration Testing. It saves Security auditors time and money. It allows to perform Passive and Active scanning to find vulnerabilities and more. ### 13. Great solution to monitor website security **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Information Technology and Services | Small-Business (50 or fewer emp.) This reviewer's identity has been verified by our review moderation team. They have asked not to show their name, job title, or picture. **Validated Reviewer:** Validated through LinkedIn **Source: Organic:** Organic review. This review was written entirely without invitation or incentive from G2, a seller, or an affiliate. **Reviewed Date:** November 13, 2023 **What do you like best about ZAP by Checkmarx?** It is easy to use and integrate it any solution with automation. **What do you dislike about ZAP by Checkmarx?** Not much documentation or support present **What problems is ZAP by Checkmarx solving and how is that benefiting you?** It helps to detect any vulnerability in the website. Along with recommendations to resolve those issues. ### 14. Great tool to monitor and detect security issues in a website. **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Information Technology and Services | Small-Business (50 or fewer emp.) This reviewer's identity has been verified by our review moderation team. They have asked not to show their name, job title, or picture. **Validated Reviewer:** Validated through a business email account **Incentivized:** This reviewer was offered a nominal gift card as thank you for completing this review. **Source: G2 invite:** Invitation from G2. This reviewer was offered a nominal gift card as thank you for completing this review. **Reviewed Date:** November 07, 2023 **What do you like best about ZAP by Checkmarx?** The tool can be automated and integrated easily. **What do you dislike about ZAP by Checkmarx?** Not much documentation in case of any error. **What problems is ZAP by Checkmarx solving and how is that benefiting you?** It helps to detect any top 10 OWASP vulnerabilities present in a website and also provide remediation for the same. - [View ZAP by Checkmarx pricing details and edition comparison](https://www.g2.com/products/zap-by-checkmarx/reviews?section=pricing&secure%5Bexpires_at%5D=2026-10-01+11%3A54%3A32+-0500&secure%5Bsession_id%5D=635b248f-576d-4f7e-a5a4-4d3fdd114168&secure%5Btoken%5D=a8c8056270a4044040181eef7fc457a24dfddcdf69a2d0a7da3c00a2b36fc2b3&format=llm_user) ## ZAP by Checkmarx Features **Administration** - API - Extensibility - Reporting and Analytics **Administration** - API / Integrations - Extensibility **Analysis** - Issue Tracking - Reconnaissance - Vulnerability Scan - Compliance Management - Automatic Scans - SPA Scans **Analysis** - Reporting and Analytics - Issue Tracking - Static Code Analysis - Vulnerability Scan - Code Analysis **Testing** - Command-Line Tools - Manual Testing - Test Automation - Performance and Reliability **Testing** - Manual Testing - Test Automation - Compliance Testing - Black-Box Scanning - Detection Rate - False Positives **Additional Functionality** - Network Mapping - Activity Dashboard - SQL Injections - Audit Management - Threat Intelligence - Assignment Management - Integration Management - User Management - Asset Discovery - Remediation Management - Vulnerability Scanning - Generative AI - Multi-User Collaboration - AI Copilot - Web-Application Security - Vulnerability Assessment - Security Auditing - Runtime Container Security - Network Scanning - Password Cracking - Simulated Threat Attacks - Certificates - Alerts/Notifications - Real-Time Data - Cross-Site Scripting - Exploit Frameworks ## Top ZAP by Checkmarx Alternatives - [GitLab](https://www.g2.com/products/gitlab/reviews) - 4.5/5.0 (884 reviews) - [Tenable Nessus](https://www.g2.com/products/tenable-nessus/reviews) - 4.5/5.0 (296 reviews) - [Harness Platform](https://www.g2.com/products/harness-platform/reviews) - 4.6/5.0 (329 reviews)