ZAP: cybersecurity software

Acquired by Checkmarx, ZAP (Zed Attack Proxy) is the scanning tool underlying numerous scanners, and if your internal team is up for the challenge, it can be adapted directly to provide most scanning needs.

What ZAP is

Acquired by Checkmarx, ZAP (Zed Attack Proxy) is the scanning tool underlying numerous scanners, and if your internal team is up for the challenge, it can be adapted directly to provide most scanning needs. The vendor site is www.zaproxy.org. This profile is an entry in the oneNorma directory, not a vendor landing page.

What ZAP covers

ZAP is in the catalog for these capabilities. Categories: DAST. Catalog tags: Hands-on, Nerdy, Open Source, and Acquired.

How to evaluate ZAP in a security program

Use ZAP as a stack candidate, not as diligence evidence. The oneNorma score for ZAP is 6/10 (percentile 83). If the real gap is in DAST, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what www.zaproxy.org publishes. Contrast it with pentesting and Security Cloud & Compliance.

Classification

Categories

DAST

Tags

Hands-onNerdyOpen SourceAcquired

Capabilities by category

DAST

CrawlerAPIPipeline

Frequently asked questions

What is ZAP?

Acquired by Checkmarx, ZAP (Zed Attack Proxy) is the scanning tool underlying numerous scanners, and if your internal team is up for the challenge, it can be adapted directly to provide most scanning needs. Site: www.zaproxy.org.

Which categories does ZAP fall into?

ZAP appears in the oneNorma directory under DAST. Use those labels to compare it with other vendors for the same problem, not as an official ranking.

Does oneNorma resell or implement ZAP?

No. The ZAP profile (www.zaproxy.org) is for inventory and comparison. oneNorma delivers offensive and compliance evidence (pentesting, cloud compliance), not a vendor license.

Other cybersecurity vendors

More profiles from the vendor directory.