OWASP ZAP is a free, open source web application testing tool that you run and manage yourself. Commercial DAST products such as Burp Suite DAST add enterprise features like role based access, SSO, scheduling and support. Which fits depends on how much scan management your team needs.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation. Facts below are as of 19 October 2026.
Key takeaways
- ZAP works as a proxy between your browser and the app, and also runs as a daemon or in Docker.
- ZAP's packaged Docker scans are baseline, full and API scans.
- Burp Suite DAST is described as an enterprise scanner using the same engine as Burp Suite Professional.
- Only run active scans against apps you have permission to test.
What is OWASP ZAP?
ZAP, the Zed Attack Proxy, is a penetration testing tool for web applications, now credited to Checkmarx. It sits between the tester's browser and the app so you can intercept, inspect and modify messages. It runs as a standalone app or a daemon, with versions for major operating systems and Docker. The site describes it as free and open source.
Passive scanning examines proxied traffic and does not change responses. Active scanning uses known attacks and can put targets at risk, so the site says to use it only on applications you have permission to test.
How does ZAP run in CI?
ZAP publishes Docker images, and every image except the bare one includes packaged scans.
- Baseline scan: spiders the target for one minute by default, then reports passive scan results.
- Full scan: spiders, then runs a full active scan before reporting.
- API scan: runs an active scan against APIs described by OpenAPI or GraphQL.
The bare image is a minimal image intended for CI environments.
What does a commercial DAST like Burp Suite DAST add?
Its product page lists a Chromium based crawler, session aware scanning, and scans that run on a schedule, on pull request, on merge or on demand. It supports Postman Collections, OpenAPI, SOAP WSDL and GraphQL. Enterprise controls include role based access, audit trails and SAML SSO. Deployment options include managed cloud or self-hosted, including Kubernetes and air-gapped installs. Support with SLAs is listed for the enterprise tier. The page also quotes customer claims, which are vendor statements we have not verified, and we do not repeat them. We do not quote pricing.
Comparison table
| Criteria | OWASP ZAP | Burp Suite DAST |
|---|---|---|
| Model | Free, open source | Commercial enterprise product |
| Deployment | Desktop, daemon, Docker | Managed cloud or self-hosted, Helm chart |
| CI | Docker packaged scans | Jenkins, GitHub Actions, GitLab CI and more |
| API scanning | OpenAPI and GraphQL | Postman, OpenAPI, WSDL, GraphQL |
| Enterprise controls | Not described on pages we read | RBAC, audit trails, SAML SSO |
| Support | Community | SLA backed, enterprise tier |
How to choose
- Decide how many apps and teams will run scans.
- Check whether you need RBAC, SSO and audit trails.
- List your API formats and confirm support.
- Decide who will maintain scan setup and authentication.
- Run both against a test app you own and compare findings by hand.
Click through it at your own pace, or open it full screen.
Frequently asked questions
Is ZAP really free?
The ZAP site describes it as free and open source, and says add-ons on its marketplace are free.
Does ZAP need Java?
Windows, Linux and cross platform versions need Java 17 or later. The macOS installer includes Java and the Docker versions do not require it.
Is a ZAP active scan safe on production?
The site warns active scans are real attacks that can damage a site, so test on systems you have permission to attack, and consider Safe Mode.
Sources
- ZAP getting started: https://www.zaproxy.org/getting-started/
- ZAP Docker: https://www.zaproxy.org/docs/docker/about/
- Burp Suite DAST: https://portswigger.net/burp/dast
Last reviewed: 19 October 2026.
