OWASP Zap vs Synopsys API Security Testing [EOL] comparison

"Fuzzer and Java APIs help a lot with our custom needs."

"The community edition updates services regularly. They add new vulnerabilities into the scanning list."

"It's great that we can use it with Portswigger Burp."

"The pull request analysis is also very good."

"As Zap is free and open-source, with tons of features similar to those of commercial solutions, I would definitely recommend trying it out."

"The OWASP's tool is free of cost, which gives it a great advantage, especially for smaller companies to make use of the tool and at the same time give a comprehensive report with great confidence to the client for helping them in their go-live decision."

"The stability of the solution is very good."

"Two features are valuable. The first one is that the scan gets completed really quickly, and the second one is that even though it searches in a limited scope, what it does in that limited scope is very good. When you use Zap for testing, you're only using it for specific aspects or you're only looking for certain things. It works very well in that limited scope."

"The technical support from Synopsys API Security Testing is amazing."

"The most valuable features of Synopsys API Security Testing are the metrics, results, and threat vectors that it shares."

"It doesn't run on absolutely every operating system."

"As security evolves, we would like DevOps built into it. As of now, Zap does not provide this."

"It would be a great improvement if they could include a marketplace to add extra features to the tool."

"ZAP's integration with cloud-based CICD pipelines could be better. The scan should run through the entire pipeline."

"I'd also like to see an improvement in test reports because we get too many false positives."

"They stopped their support for a short period. They've recently started to come back again. In the early days, support was much better."

"OWASP Zap needs to extend to mobile application testing."

"The solution is somewhat unreliable because after we get the finding, we have to manually verify each of its findings to see whether it's a false positive or a true finding, and it takes time."

"We haven't covered all the areas yet in our business. It's still being scaled up within the organization. We've probably covered 10 percent of the business. I don't think we've seen a proper ROI yet."

"The solution required us to use our team and we spoke to Synopsys API Security Testing's support to do the implementation. We use two people from our team for the implementation. and one person for maintenance."

"This app is completely free and open source. So there is no question about any pricing."

"This is an open-source solution and can be used free of charge."

"OWASP ZAP is a free tool provided by OWASP’s engineers and experts. There is an option to donate."

"We have used the freeware version. I believe Zap only has freeware."

"As Zap is free and open-source, with tons of features similar to those of commercial solutions, I would definitely recommend trying it out."

"The solution’s pricing is high."

"The tool is open-source."

"This solution is open source and free."