IT AI Index

Index › Products › OWASP ZAP · October 2026 Edition

4 categories · Ranked

OWASP ZAP

188Judge labels

48First choices

50Negative labels

14 / 14Models named it

4Categories

October 2026 Edition. Every number here is derived from the raw labels under vendor table v2026-10.8, every buyer segment counted.

Best standing

43% in DAST for small business buyers

Rank 1 of 58 in the mid-market standingcriticized challenger

0 of 14 models made it the first choice on the direct prompt; 30% of its 54 labels there were negative.

What the models named instead of OWASP ZAP →

By buyer segmentA small-business product: leader at small business, not named at enterprise.

Small business1 of 53

endorsed leader

Mid-market1 of 58

criticized challenger

Enterprise54 of 54

criticized challenger

In dast · each standing computed within its segment · bars are 0 to 100 · the accent bar is the product's own best reading

Standing by category

Every category where a model named OWASP ZAP for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.

Category	Function	Share	Rank	Negative rate	Labels	Quadrant	Since September 2026
Dynamic application security testing	Developer platform	29%	1 of 58	30%	54	criticized challenger
API security platforms	Security operations	10%	3 of 93	17%	12	accepted challenger
Penetration testing as a service	Security operations	0%	32 of 82	0%	2	under 10 labels · led by Cobalt at 45%	=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.
Vulnerability management platforms	Security operations	0%	37 of 77	0%	1	under 10 labels · led by Rapid7 InsightVM at 30%	▼−2Since September 2026: 2% → 0%, −2 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

Movement

This is the first edition on this tier, so no move can be computed for OWASP ZAP yet. From the next edition this section shows, per buyer segment and per category, whether its share moved by more than the measured noise floor.

By model

How each model treated OWASP ZAP across every prompt where it was named for a mid-market B2B company. Fourteen models, six prompts per category.

ShowHide

Model	First choice	Alternative	Mention	Negative	Labels
Claude Haiku 4.5	1	1	0	2	4
GPT-5.4 mini	1	2	0	1	4
Gemini 3.5 Flash	2	2	1	0	5
Perplexity Sonar	1	1	0	2	4
Grok 4.20	2	2	0	3	7
Mistral Small	1	1	1	1	4
DeepSeek V4 Flash	2	1	0	2	5
Llama 4 Maverick	1	0	0	1	2
Qwen 3.7 Flash	1	4	0	2	7
Kimi K2	2	2	0	3	7
GLM 4.7 FlashX	3	2	0	1	6
MiniMax M2.5	2	2	1	0	5
GPT-6 Luna	2	3	0	0	5
Muse Glimmer 30B	2	2	0	0	4

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.

FramingLabels by classFirst choices

Direct21 labels6

Paraphrase22 labels5

Comparative37 labels13not counted in share

Budget-constrained59 labels36

Scale-constrained13 labels1

Negative36 labels10not counted in share

First choiceAlternativeMentionNegative188 labels in all, every segment counted; 48 of the 71 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“For most small to medium-sized companies just starting with DAST, OWASP ZAP is typically the best choice due to its zero cost, robust features, and strong community support.” Claude Haiku 4.5 · DAST · budget prompt · first choice

“the best DAST tool is usually OWASP ZAP because it is free, open-source, extensible, and widely recommended as the default starting point” Perplexity Sonar · DAST · budget prompt · first choice

“OWASP ZAP (Zed Attack Proxy) is widely considered the best Dynamic Application Security Testing (DAST) tool available.” Qwen 3.7 Flash · DAST · budget prompt · first choice

“For a free starting point, ZAP is worth evaluating: it has an Automation Framework with authentication options” GPT-6 Luna · DAST · negative prompt · first choice

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

“The Verdict: Avoid for CI/CD pipelines. Use only if you have dedicated in-house pentesters.” GLM 4.7 FlashX · DAST · negative prompt · hard negative

“High false positive rates require significant manual tuning and expertise... Avoid if: You're new to security testing or need low-maintenance automation.” Grok 4.20 · DAST · negative prompt · soft negative

“While OWASP ZAP is excellent and free, mid-sized B2B companies typically: Lack dedicated security teams to tune and manage false positives” Kimi K2 · DAST · paraphrase prompt · soft negative

“better viewed as a budget/open-source starting point than the best fit for a mid-sized B2B company seeking a polished commercial workflow” Perplexity Sonar · DAST · paraphrase prompt · soft negative

Named alongside

The products named in the same answers as OWASP ZAP, over the 188 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and OWASP ZAP was named but was not.

ShowHide

ProductSame answerTook the first choice insteadHead to head

Burp Suite99 of 1885Compare →

StackHawk82 of 18817Compare →

Acunetix74 of 1886Compare →

Invicti71 of 18822Compare →

Intruder45 of 18812Compare →

Rapid7 InsightAppSec33 of 1881Not among the top eight

Detectify28 of 1880Not among the top eight

Astra Security24 of 1883Not among the top eight

Nuclei24 of 1880Not among the top eight

Beagle Security23 of 1882Not among the top eight

A head-to-head page exists where both products are among a category's top eight. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named OWASP ZAP. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, five of the fourteen in this edition, so these counts come from 177 of the 188 answers that named OWASP ZAP and are not a share of its labels.

Domains cited

getastra.com100

beaglesecurity.com85

stackhawk.com67

aikido.dev64

escape.tech63

appsecsanta.com58

getautonoma.com50

securityboulevard.com49

aimultiple.com47

checkmarx.com44

627 of the 627 domain citations in answers naming OWASP ZAP came from somebody else's page.

Pages cited

getastra.com/blog/dast/tools81

stackhawk.com/blog/dynamic-application-security-testing-tools-comparison52

aikido.dev/blog/top-dynamic-application-security-testing-dast-tools50

getautonoma.com/blog/dast-tools50

aimultiple.com/dast-tools39

checkmarx.com/learn/dast/dast-tools-key-features-and-12-solutions-to-know-in-202636

augmentcode.com/tools/best-dast-tools-for-enterprise-security35

escape.tech/blog/dast-tools-buyers-guide29

Pages are listed as the models cited them.

Search and answers

Where OWASP ZAP stands in Google search beside where it stands in the models' answers.

ShowHide

In search

Google, US estimates

Position for “dast tool”

–

not in the top ten

Position for “dast tools”

Searches for its name, Google: 3,600 a month (“owasp zap”)
AI search demand for its name, est.: 122 a month
Organic visits to its site: about 365,222 a month
Searches its site ranks for: 104,405 · 3,003 in the top three
Sites linking to it: 65,251
Paid Google search: No ads found in the estimate; that does not mean it runs none

Ads on Google

None found in Google's ad transparency records for the US

In answers

This edition

Share of first choices

29%

rank 1 of 58 in DAST

First choices

across its categories

Named in: 188 answers
Its own site cited: in 177 of the answers that named it

Search figures are US estimates from DataForSEO, read September 28, 2026; AI search demand is its modeled, directional estimate, not a count of queries to any assistant. The answers are this edition's. Two measurements side by side: neither is read as the cause of the other.

What it publishes

ShowHide

Addresses on owasp.org

893

subdomains included

Content

154

counted in the table below

Documentation

Product · Integration

30 · 216

Kind	Pages	Last 90 days	Latest
Blog	86	0	2025-08-05
Conference or event	35	0	2025-11-14
News or press	18	0	2024-11-20
Webinar or virtual event	7	0	2026-05-13
Podcast or video	4	undated
Template or tool	3	0	2024-05-08
Glossary or explainer	1	undated

Most recent

2026-05-13Gen ai project application security risk virtual summit webinar or virtual event
2025-11-14Genai security project agentic ai summit europe conference or event
2025-08-30Genai security project uae summit hackathon conference or event
2025-08-28Owasp 2025 global appsec usa washington dc conference or event
2025-08-27Gen ai application security risk virtual conference webinar or virtual event
2025-08-06Owasp genai agentic security top 10 global kick off livestream webinar or virtual event

Events in person

Upcoming

November 5, 2026 to November 6, 2026OWASP Global AppSec USA 2026Hyatt Regency San Francisco, San Francisco, USA · hosts

Last twelve months

March 25, 2026OWASP GenAI Security Summit 2026 @ RSAC 2026 – Safeguarding GenAI Agents & Anonymous Risk in 2026Moscone Conference Center – Moscone South – Room 303, San Francisco, USA · hosted
March 25, 2026OWASP GenAI Security Open Workshop & Agentic Hackathon at RSAC’26DigitalJungleSF, 972 Mission St, San Francisco, USA · hosted
March 25, 2026OWASP GenAI Security RSAC’26 Jungle Party of The CenturyDigitalJungleSF, 972 Mission St, San Francisco, USA · attended
March 23, 2026OWASP GenAI Security – RSAC’26 Kickoff PartyJames Bong Building, Market St Floor 2, San Francisco, USA · hosted

As the event pages on owasp.org state them, read September 28, 2026.

How it is countedHide how it is counted

Every page owasp.org exposes, subdomains included. Kind is read from the address and title. The last 90 days, the latest date and the twelve months count pages by when they were published, from the site's feeds, a date in the address, or the page's own publication date, read from up to a hundred of its most recently changed pages; a page that says only when it last changed is counted in its kind but not in when, so the recent counts are a floor, and a kind none of whose pages gives a publication date reads undated. An event counts as online when its address or title says so (webinar, on demand, virtual or online summit); a conference, summit, trade show, expo or roadshow that does not say so is counted as a conference or event, which on a vendor's site is mostly in person. Read September 29, 2026.

Names read as OWASP ZAP

What the judge wrote, as written, with how often. The vendor table decides that these count as OWASP ZAP; a claim can dispute any of them.

OWASP ZAP (Zed Attack Proxy) 12OWASP ZAP (ZAP by Checkmarx) 2OWASP ZAP (Free) 1OWASP ZAP (Zaproxy) 1OWASP ZAP / Checkmarx ZAP 1ZAP 1

Follow OWASP ZAP

An email the morning each edition publishes: where this product moved, where it held, and by how much against the noise floor. One address, confirmed by a click; a stop link in every email.

Already following? Everything you follow, with a stop for each.

The company

OWASP ZAP is its own company.

ShowHide

In its own words

Stated by the vendor, not checked

Positioning: OWASP is the nonprofit behind the Top 10, ASVS, ZAP, and hundreds more free application security projects.
owasp.org
Not stated on the pages read: Who it is for, price, starting price, free plan or trial, integrations, certifications, hosting, customers

What OWASP ZAP's own pages state, read October 5, 2026: owasp.org, owasp.org/security. A claimed page can correct any of them.

Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when OWASP ZAP's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as OWASP ZAP, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

What a new claim receivesHide what a new claim receives

A new claim receives the current edition's vendor brief for OWASP ZAP by email, built from the raw record of the edition. It shows:

where OWASP ZAP is named, by buyer and by framing, and which cells hold its first choices;
the claims the models make when they name it, ranked, with the strongest and the weakest quoted;
its vocabulary against the segment leader's, and the pages the models cited;
who was chosen in the answers that did not name OWASP ZAP, and every reason the record gives;
a battlecard for each top rival: the head-to-head split, why they win, and the reservation quoted against them;
one page of published figures cleared to show a buyer.

Badges

Wins only: a badge exists where OWASP ZAP is ranked in a category's top three this edition. Three sizes, one file each, light and dark; the code is under each.

ShowHide

Dynamic application security testing

AI models recommend OWASP ZAP first in Dynamic application security testing this edition. Each badge says so in the buyer's words, names the edition, and links to the standing. The next edition issues a new badge; this one stays true as a record of October 2026.

Wide · 320 × 104 Website, beside other badges

Show the code

<a href="https://it-ai-index.com/developer/dynamic-application-security-testing/"><img src="https://it-ai-index.com/badges/2026-10/owasp-zap--dynamic-application-security-testing-wide.svg" alt="AI models' first choice in Dynamic application security testing, October 2026 Edition, IT AI Recommendation Index" width="320" height="104"></a>

Copy the code as it is. The link is part of the badge: it points at the Dynamic application security testing standing, where the claim can be checked.

Square · 240 × 240 LinkedIn, slides

Show the code

<a href="https://it-ai-index.com/developer/dynamic-application-security-testing/"><img src="https://it-ai-index.com/badges/2026-10/owasp-zap--dynamic-application-security-testing-square.svg" alt="AI models' first choice in Dynamic application security testing, October 2026 Edition, IT AI Recommendation Index" width="240" height="240"></a>

Copy the code as it is. The link is part of the badge: it points at the Dynamic application security testing standing, where the claim can be checked.

Compact · 200 × 56 Email signature, footer

Show the code

<a href="https://it-ai-index.com/developer/dynamic-application-security-testing/"><img src="https://it-ai-index.com/badges/2026-10/owasp-zap--dynamic-application-security-testing-compact.svg" alt="AI models' first choice in Dynamic application security testing, October 2026 Edition, IT AI Recommendation Index" width="200" height="56"></a>

Copy the code as it is. The link is part of the badge: it points at the Dynamic application security testing standing, where the claim can be checked.

API security platforms

OWASP ZAP is among the products AI models recommend first in API security platforms this edition. Each badge says so in the buyer's words, names the edition, and links to the standing. The next edition issues a new badge; this one stays true as a record of October 2026.

Wide · 320 × 104 Website, beside other badges

Show the code

<a href="https://it-ai-index.com/security/api-security-platforms/"><img src="https://it-ai-index.com/badges/2026-10/owasp-zap--api-security-platforms-wide.svg" alt="Among AI models' top three in API security platforms, October 2026 Edition, IT AI Recommendation Index" width="320" height="104"></a>

Copy the code as it is. The link is part of the badge: it points at the API security platforms standing, where the claim can be checked.

Square · 240 × 240 LinkedIn, slides

Show the code

<a href="https://it-ai-index.com/security/api-security-platforms/"><img src="https://it-ai-index.com/badges/2026-10/owasp-zap--api-security-platforms-square.svg" alt="Among AI models' top three in API security platforms, October 2026 Edition, IT AI Recommendation Index" width="240" height="240"></a>

Copy the code as it is. The link is part of the badge: it points at the API security platforms standing, where the claim can be checked.

Compact · 200 × 56 Email signature, footer

Show the code

<a href="https://it-ai-index.com/security/api-security-platforms/"><img src="https://it-ai-index.com/badges/2026-10/owasp-zap--api-security-platforms-compact.svg" alt="Among AI models' top three in API security platforms, October 2026 Edition, IT AI Recommendation Index" width="200" height="56"></a>

Copy the code as it is. The link is part of the badge: it points at the API security platforms standing, where the claim can be checked.

Badges read on light and dark pages. Alt text carries the claim, the category, the edition and the index, so it stays a citation where the image does not load.