Free DAST exists and is useful: OWASP ZAP is free and open source and has a quick baseline scan for pipelines. The limits are what it does not do for you, namely authenticated coverage, tuning, triage, reporting and anyone to maintain it. Use it to start, not to certify.
What is free?
The main free option is Zed Attack Proxy (ZAP). Its project site describes it as free and open source, a community project with a marketplace of add-ons and automation options. Because it is open source, there is no seat license, and you can run it in your own environment.
Other free scanners exist, and commercial vendors offer free tiers with caps. Free tiers change often, so check the current terms yourself before you plan around one.
What does the ZAP baseline scan do?
ZAP's documentation for the baseline scan says it runs the spider against a target, waits for passive scanning to finish, then reports. The default spider run is one minute. The page says it does not perform any actual attacks, runs for a few minutes at most, and is intended for CI/CD pipelines, even against production sites.
Exit codes are simple: 0 for success, 1 for at least one FAIL, 2 for at least one WARN and no FAILs, 3 for any other failure. By default every alert is a WARN, so a scan with findings returns 2. A config file lets you set each rule to INFO, IGNORE or FAIL, and exclude URLs.
That makes the baseline scan a good smoke test: missing security headers, cookies without flags, and similar response-level issues.
Where does free DAST stop?
Be plain about these.
- Passive is not active. A baseline scan observes responses. It does not probe for injection or logic flaws. ZAP has other scan modes, and they take more setup and more care, especially near production data.
- Login. Most real application risk sits behind authentication. A crawler that cannot log in sees the marketing page. Handling sessions, tokens and multi-step logins takes configuration work that is yours to build and keep.
- Single page apps and APIs. Crawlers that follow links miss routes that JavaScript builds on the fly. API coverage needs a spec or recorded traffic.
- Tuning and noise. With every alert starting as a WARN, you have to decide which rules matter. Someone has to own the config file.
- Triage. A free tool gives you findings. It does not tell you which are reachable or exploitable in your context.
- Reporting and evidence. Auditors want history, owners and fix dates. A raw report does not provide that without tooling around it.
- Support. The community is active, but there is no service level.
None of this makes free DAST bad. It means the cost shifts from a license to engineering time.
When is free enough?
Free is enough when you have a small number of apps, an engineer who will own the setup, no audit requiring continuous evidence, and you treat the output as a smoke test. It is a poor fit when you have many apps, authenticated flows everywhere, or customers asking for scan evidence.
How do you decide when to pay?
Count hours. If one engineer spends a day a month keeping scans working, add up the year. Compare that against a commercial tool's current price, which you should get from the vendor, and against what you need that free tooling cannot give you: authenticated coverage, reporting and support.
What to do
- Run the ZAP baseline scan against staging in CI and record its exit code.
- Generate the default config and set rules to INFO, IGNORE or FAIL on purpose.
- Exclude URLs that are out of scope, such as third-party hosts.
- Decide who owns the config and the triage queue.
- List your authenticated flows. If they are the main risk, plan for session handling before you rely on results.
- Keep dated reports for evidence.
- Review the choice once a year against the hours spent.
Quick check
Does the ZAP baseline scan attack my app?
Per the ZAP documentation, the baseline scan does not perform attacks. It spiders the target and analyzes responses passively, which is why it can run in pipelines.
Can free DAST replace a penetration test?
No. Automated scanning finds a class of issues quickly. Business logic flaws and chained attacks still need human testing.
Sources
Last reviewed: 18 October 2026.
