We performed a comparison between OWASP Zap and Qualys Web Application Scanning based on real PeerSpot user reviews.
Find out in this report how the two Application Security Testing (AST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."Two features are valuable. The first one is that the scan gets completed really quickly, and the second one is that even though it searches in a limited scope, what it does in that limited scope is very good. When you use Zap for testing, you're only using it for specific aspects or you're only looking for certain things. It works very well in that limited scope."
"The solution has tightened our security."
"The stability of the solution is very good."
"It updates repositories and libraries quickly."
"The most valuable feature is scanning the URL to drill down all the different sites."
"The solution is scalable."
"The HUD is a good feature that provides on-site testing and saves a lot of time."
"It has evolved over the years and recently in the last year they have added, HUD (Heads Up Display)."
"Qualys' process of updating signatures is something we really appreciate, and it's way ahead of its industry peers."
"I have found the detection of vulnerabilities tool thorough with good results and the graphical display output to be wonderful and full of colors. It allows many types of outputs, such as bar and chart previews."
"It works with many different products."
"Qualys WAS' most valuable features are the navigation flow of the UI and the option for a different layer of security (identification and operation through email and mobile)."
"The solution is unable to customize reports."
"The ability to search the internet for other use cases and to use the solution to make applications more secure should be addressed."
"The product reporting could be improved."
"Reporting format has no output, is cluttered and very long."
"The work that it does in the limited scope is good, but the scope is very limited in terms of the scanning features. The number of things it tests or finds is limited. They need to make it a more of a mainstream tool that people can use, and they can even think about having it on a proprietary basis. They need to increase the coverage of the scan and the results that it finds. That has always been Zap's limitation. Zap is a very good tool for a beginner, but once you start moving up the ladder where you want further details and you want your scan to show more in-depth results, Zap falls short because its coverage falls short. It does not have the capacity to do more."
"It would be a great improvement if they could include a marketplace to add extra features to the tool."
"Zap could improve by providing better reports for security and recommendations for the vulnerabilities."
"Lacks resources where users can internally access a learning module from the tool."
"Sometimes the response time is low because the handshake fails, and then you have to re-login and start again."
"There could be better management and faster scanning."
"We procured around 110 licenses for Web Application Scanning, but we have issues running concurrent scans. I don't currently have the option to trigger scans for all 100-plus websites. The default limit is around 10 conference scans. It's not very scalable, to be honest, because of the limitation that they put on concurrent scans."
"When comparing this solution to Veracode, Veracode has good interactive features and gives a clear understanding of what the vulnerabilities are, which error line of the vulnerability is on and what can be done. It gives interactive features, whereas this solution does not give a clear understanding of where or how to fix the problem."
More Qualys Web Application Scanning Pricing and Cost Advice →
OWASP Zap is ranked 8th in Application Security Testing (AST) with 10 reviews while Qualys Web Application Scanning is ranked 16th in Application Security Testing (AST) with 4 reviews. OWASP Zap is rated 7.2, while Qualys Web Application Scanning is rated 7.8. The top reviewer of OWASP Zap writes "Open-source, easy to install, feature-rich, with good heads-up display and community resources". On the other hand, the top reviewer of Qualys Web Application Scanning writes "We like its process of updating signatures, and it's way ahead of its industry peers. ". OWASP Zap is most compared with PortSwigger Burp Suite Professional, Veracode, Acunetix, Fortify WebInspect and Checkmarx, whereas Qualys Web Application Scanning is most compared with Tenable.io Web Application Scanning, Veracode, SonarQube, PortSwigger Burp Suite Professional and Fortify WebInspect. See our OWASP Zap vs. Qualys Web Application Scanning report.
See our list of best Application Security Testing (AST) vendors.
We monitor all Application Security Testing (AST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
