OWASP Zap vs PortSwigger Burp Suite Professional vs Veracode comparison

PortSwigger Burp Suite Prof...

Read 201 Veracode reviews

15,486 Views
1,866 Comparison Views

90% willing to recommend

OWASP Zap

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between OWASP Zap, PortSwigger Burp Suite Professional, and Veracode based on real PeerSpot user reviews.

Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Static Application Security Testing (SAST).

To learn more, read our detailed Static Application Security Testing (SAST) Report (Updated: June 2025).

Static Application Security Testing (SAST)

June 2025

Download the complete report

Helped 855,164 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Mindshare comparison

As of June 2025, in the Static Application Security Testing (SAST) category, the mindshare of OWASP Zap is 4.7%, down from 4.9% compared to the previous year. The mindshare of PortSwigger Burp Suite Professional is 2.0%, down from 2.1% compared to the previous year. The mindshare of Veracode is 8.3%, down from 10.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST)

Featured Reviews

Amit Beniwal

Project Manager at Al Hassan LLC

Simplifies vulnerability discovery and has high quality support

There are areas for improvement with OWASP Zap, particularly in the alignment of vulnerabilities concerning CVSS scores. Sometimes, a vulnerability initially categorized as high severity may be reduced to medium or low over time after security patches are applied. This alignment with the present severity score and CVSS score could be improved.

Read full review

Anuradha.Kapoor Kapoor

Head - Quality Control at Net Solutions

Offers efficient scanning of entire websites but presence of false positive bugs, leading to time-consuming efforts in distinguishing real bugs from false alarms

We have found that so many times, false positive bugs are there, and then we spend a lot of time basically separating them from real bugs. So that's the reason we are looking for some other tool. So we were in discussion with Acunetix. Therefore, the false positive rate is, like, something that we would like to improve. What we are looking for is if this false positive rate goes down because we were OWASP Zap tool users, which was free anyway. But there were a lot of false positives there, and we used to spend a lot of time, like, for security reasons, reproducing those bugs for the development team to fix it. So then we thought, okay, why not we go with the tool? Even if it is not very expensive. But still, every year, we have to renew the license. And we got this tool. Again, we found that in this tool also, even if it is less, there are still a lot of false positive bugs out there. So we again have to spend so much time. So we hired a security tester, who was basically using Acunetix in his previous company for almost three years, and then you said that in that scanning is very slow. The scanning is also slow. Like, sometimes the site scan takes eight hours, six to eight hours. Yeah. And whereas in Acunetix, it took three to four hours. And plus, there are no false positives. I'm not saying none but there's very little. But here, the rate sometimes is very high. These are the two features I think we would like to improve further.

Read full review

David-Robertson

Director Enterprise Architecture at Exeter Finance Corp.

Static scanning and software composition analysis are very helpful, but the usability needs improvement

Static scanning and software composition analysis are very helpful. My colleagues and I don't need to be experts on all of those ancillary things, so we can focus more on the business deliverables. They have a pretty good tool that allows me to run scans of my local integrated development environment. I can find a lot of those flaws a lot sooner than I would if I had to wait for these cloud-based scans. They've come out with some sort of automated fix feature. I haven't used it, but they gave us a demo of it, and that one looks promising. I don't know if it's ready for prime time yet.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The application scanning feature is the most valuable feature."

"The OWASP's tool is free of cost, which gives it a great advantage, especially for smaller companies to make use of the tool."

"The community edition updates services regularly. They add new vulnerabilities into the scanning list."

"It has evolved over the years and recently in the last year they have added, HUD (Heads Up Display)."

"The reporting is quite intuitive, which gives you a clear indication of what kind of vulnerability you have that you can drill down on to gather more information."

"It can be used effectively for internal auditing."

"Automatic scanning is a valuable feature and very easy to use."

"The vulnerabilities that it finds, because the primary goal is to secure applications and websites."

More OWASP Zap pros

"You can download different plugins if you don't have them in the standard edition."

"The solution has a pretty simple setup."

"There is no other tool like it. I like the intuitiveness and the plugins that are available."

"The most valuable feature of PortSwigger Burp Suite Professional is the Burp Intruder tool."

"It offers flexibility, macros, and features to reduce the effort required for authenticated sessions."

"It is useful for scanning and tracing activities."

"The tool provides complimentary services. It allows you to add a lot of extensions, and you can get extensions quite often. It is quite a flexible application."

"The active scanner, which does an automated search of any web vulnerabilities."

More PortSwigger Burp Suite Professional pros

"We have to look at it from the perspectives of how important it is to fix something and when it should be prioritized for fixing. The JSON output from the agent-based scans gives us the CVS core, and that makes things much easier."

"I like Veracode's API. You can put it into a simple bash script and run your own security testing from your MacBook in less than 15 minutes."

"The integration of static testing with our Azure DevOps CI pipeline was easy."

"Allows us to track the remediation and handling of identified vulnerabilities."

"The visibility into application status helps reduce risk exposure for our software. Today, any findings provided by the DAST are reviewed by the developers and we have internal processes in place to correct those findings before there can be a release. So it absolutely does prevent us from releasing weak code."

"Good static analysis and dynamic analysis."

"We have such a wide variety of users for Veracode, including security champions, development leads, developers themselves, that the ease of use is really quite important, because we don't assume anything about what those people might already know, or need to know. It just makes it very useful for anyone who has to engage with it."

"Veracode is a cloud-based platform, where they manage all the back-end, and they do a lot of analysis during the scans, and they do a lot of post-scan reconciliation."

More Veracode pros

Cons

"The documentation is lacking and out-of-date, it really needs more love."

"It needs more robust reporting tools."

"OWASP Zap could benefit from a noise cancellation feature like that of Burp Suite Professional, where AI helps reduce certain non-critical findings."

"As security evolves, we would like DevOps built into it. As of now, Zap does not provide this."

"The solution is somewhat unreliable because after we get the finding, we have to manually verify each of its findings to see whether it's a false positive or a true finding, and it takes time."

"It would be nice to have a solid SQL injection engine built into Zap."

"There's very little documentation that comes with OWASP Zap."

"Online documentation can be improved to utilize all features of ZAP and API methods to make use in automation."

More OWASP Zap cons

"I need the solution to be more user-friendly. The solution needs to be user-friendly."

"It would be beneficial to have privileged access management as a part of Burp Suite Professional."

"BurpSuite has some issues regarding authentication with OAT tokens that need to be improved."

"In the Professional version, we cannot link it with the CI/CD process."

"The initial setup is a bit complex."

"There is not much automation in the tool."

"The tool is very expensive."

"The solution’s pricing could be improved."

More PortSwigger Burp Suite Professional cons

"Veracode would benefit greatly from more training resources. The videos are great, but I would like more hands-on training writing a script, validating a script with a unit test in a different language, etc. That's something that would be very valuable."

"I would like to see more AI features. It's a current subject because with ChatGPT and other solutions being developed all the time, IT attacks will increase... To defend against those it's very important that the good guys use AI in ways that are good instead of bad."

"One of the things that we have from a reporting point of view, is that we would love to see a graphical report. If you look through a report for something that has come back from Veracode, it takes a whole lot of time to just go through all the pages of the code to figure out exactly what it says. We know certain areas don’t have the greatest security features but those are usually minor and we don’t want to see those types of notifications."

"The feature that allows me to read which mitigation answer was submitted, and to approve it, requires me to use do so in different screens. That makes it a little bit more complicated because I have to read and then I have to go back and make sure it falls under the same number ID number. That part is a little bit complicated from my perspective, because that's what I use the most."

"It would be better if we had a channel for direct communication with the engineering team to speed up the process of providing feedback."

"I would like to see these features: entering comments for internal tracking; entering a priority; reports that show the above."

"It can take time to find options if you don’t use the interface a lot. At some point, a bit of interface restyling may help."

"It would be better if we had a channel for direct communication with the engineering team to speed up the process of providing feedback."

More Veracode cons

Pricing and Cost Advice

"This app is completely free and open source. So there is no question about any pricing."

"We have used the freeware version. I believe Zap only has freeware."

"This is an open-source solution and can be used free of charge."

"It is highly recommended as it is an open source tool."

"It is open source, and we can scan freely."

"It's free and open, currently under the Apache 2 license. If ZAP does what you need it to do, selling a free solution is a very easy."

"The solution’s pricing is high."

"The tool is open source."

More OWASP Zap pricing and cost advice

"PortSwigger Burp Suite Professional is an expensive solution."

"The solution is reasonably priced."

"PortSwigger Burp Suite Professional is expensive compared to other tools."

"At $400 or $500 per license paid annually, it is a very cheap tool."

"Pricing is not very high. It was around $200."

"We pay a yearly licensing fee for the solution, which is neither cheap nor expensive."

"It's a lower priced tool that we can rely on with good standard mechanisms."

"The solution used to be expensive. However, they have reduced the price to approximately $400.00 which is reasonable."

More PortSwigger Burp Suite Professional pricing and cost advice

"We're very comfortable with their model. We think they're a good value. We worked very closely with Veracode on understanding their license model, understanding what comprises the fee and what does not. With their assistance in design, we decomposed our application in a way where we are scanning a very significant amount of code without wasting their capacity and generating redundant reported issues. You scan in profiles, per se. And we work with them, in their offices, to design the most effective approach. So the advice I would have for customers is, you can get up and live fast, but work closely with Veracode to refine the method you use for scanning and the way you compile the applications. There's a concept called entry-point scanning, and that's probably not used well by the rest of their customers. We see our licensing as a good value because we leverage it heavily."

"The pricing depends on the functionality each client desires."

"We use this product per project rather than per developer... Your development model will really determine what the best fit is for you in terms of licensing, because of the project-based licensing. If you do a few projects, that's more attractive. If you have a large number of developers, that would also make the product a little more attractive."

"The price of Veracode Static Analysis is on the higher side."

"Veracode's price is high. I would like them to better optimize their pricing."

"The Veracode price model is based on application profiles, which is how you package your components for scanning."

"Users in some forums mentioned that pricing for this solution can be quite high."

"When I looked at the pricing, it was definitely a value. In terms of the service and what it's checking, the cost was very reasonable, particularly because we could have multiple code bases as part of a project."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

855,164 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

18%

Financial Services Firm

12%

Manufacturing Company

University

Computer Software Company

16%

Financial Services Firm

13%

Government

11%

Manufacturing Company

Computer Software Company

17%

Financial Services Firm

16%

Manufacturing Company

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

Is OWASP Zap better than PortSwigger Burp Suite Pro?

OWASP Zap and PortSwigger Burp Suite Pro have many similar features. OWASP Zap has web application scanning available...

What do you like most about OWASP Zap?

The best feature is the Zap HUD (Heads Up Display) because the customers can use the website normally. If we scan web...

What is your experience regarding pricing and costs for OWASP Zap?

OWASP might be cost-effective, however, people prefer to use the free edition available as open source.

What do you like most about PortSwigger Burp Suite Professional?

The solution helped us discover vulnerabilities in our applications.

What is your experience regarding pricing and costs for PortSwigger Burp Suite Professional?

I find the price of PortSwigger Burp Suite Professional to be very cost-efficient.

What needs improvement with PortSwigger Burp Suite Professional?

The dashboard of PortSwigger Burp Suite Professional could be made more user-friendly.

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

What do you like most about Veracode?

The SAST and DAST modules are great.

What is your experience regarding pricing and costs for Veracode?

The product’s price is a bit higher compared to other solutions. However, the tool provides good vulnerability and da...

SonarQube Server (formerly SonarQube) vs OWASP Zap

Comparisons

Compared 20% of the time

Acunetix vs OWASP Zap

Compared 16% of the time

Checkmarx One vs OWASP Zap

Compared 10% of the time

Qualys Web Application Scanning vs OWASP Zap

Compared 9% of the time

Fortify WebInspect vs OWASP Zap

Compared 5% of the time

More OWASP Zap Competitors

Acunetix vs PortSwigger Burp Suite Professional

Compared 18% of the time

Fortify WebInspect vs PortSwigger Burp Suite Professional

Compared 14% of the time

SonarQube Server (formerly SonarQube) vs PortSwigger Burp Suite Professional

Compared 8% of the time

HCL AppScan vs PortSwigger Burp Suite Professional

Compared 6% of the time

Qualys Web Application Scanning vs PortSwigger Burp Suite Professional

Compared 3% of the time

More PortSwigger Burp Suite Professional Competitors

SonarQube Server (formerly SonarQube) vs Veracode

Compared 19% of the time

Checkmarx One vs Veracode

Compared 10% of the time

GitHub Advanced Security vs Veracode

Compared 7% of the time

Fortify on Demand vs Veracode

Compared 4% of the time

JFrog Xray vs Veracode

Compared 3% of the time

More Veracode Competitors

Product Reports

Download OWASP Zap product report

OWASP Zap

May 2025

PortSwigger Burp Suite Professional

May 2025

PortSwigger Burp Suite Professional report

Download PortSwigger Burp Suite Professional product report

Download Veracode product report

May 2025

Also Known As

No data available

Burp

Crashtest Security , Veracode Detect

Overview

OWASP Zap is a free and open-source web application security scanner.

The solution helps developers identify vulnerabilities in their web applications by actively scanning for common security issues.

With its user-friendly interface and powerful features, Zap is a popular choice among developers for ensuring the security of their web applications.

OWASP

Burp Suite Professional, by PortSwigger, is the world’s leading toolkit for web security testing. Over 52,000 users worldwide, across all industries and organization sizes, trust Burp Suite Professional to find more vulnerabilities, faster. With expertly-engineered manual and automated tooling, you're able to test smarter - not harder.

PortSwigger is the web security company that is enabling the world to secure the web. Over 50,000 security engineers rely on our software and expertise to secure their world.

PortSwigger

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

1. Google 2. Microsoft 3. IBM 4. Amazon 5. Facebook 6. Twitter 7. LinkedIn 8. Netflix 9. Adobe 10. PayPal 11. Salesforce 12. Cisco 13. Oracle 14. Intel 15. HP 16. Dell 17. VMware 18. Symantec 19. McAfee 20. Citrix 21. Red Hat 22. Juniper Networks 23. SAP 24. Accenture 25. Deloitte 26. Ernst & Young 27. PwC 28. KPMG 29. Capgemini 30. Infosys 31. Wipro 32. TCS

Google, Amazon, NASA, FedEx, P&G, Salesforce

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.