# OWASP ZAP alternatives: what AI models name instead, November 2026

Gane Index, November 2026 Edition. 383 of the 504 answers in the 2 categories where OWASP ZAP holds a standing named it neither first nor as an alternative; these are the first choices those answers made. Page: https://www.gane.ai/index/it/vendors/owasp-zap/alternatives

## Named instead, most often (every category and segment added)

- Salt Security: 52
- Invicti: 50
- Cloudflare API Shield: 23
- StackHawk: 16
- Akamai API Security: 15
- Wallarm API Security: 14

## Dynamic application security testing

**Small business**: 22 of 84 answers did not name OWASP ZAP (OWASP ZAP is #1 of 13 at 51%).

- Intruder: first choice in 4 of those 22
- StackHawk: first choice in 3 of those 22
- Probely: first choice in 2 of those 22
- OWASP ZAP – Zed Attack Proxy: first choice in 1 of those 22

**Mid-market**: 47 of 84 answers did not name OWASP ZAP (OWASP ZAP is #2 of 13 at 26%).

- Invicti: first choice in 9 of those 47
- Acunetix: first choice in 5 of those 47
- StackHawk: first choice in 5 of those 47
- Bright Security: first choice in 1 of those 47
- Burp Suite Enterprise Edition: first choice in 1 of those 47
- Escape: first choice in 1 of those 47
- Intruder: first choice in 1 of those 47
- Invicti, formerly Netsparker: first choice in 1 of those 47

**Enterprise**: 83 of 84 answers did not name OWASP ZAP (OWASP ZAP is #14 of 14 at 0%).

- Invicti: first choice in 41 of those 83
- Burp Suite DAST: first choice in 6 of those 83
- Burp Suite: first choice in 3 of those 83
- Burp Suite Enterprise Edition: first choice in 2 of those 83
- Checkmarx DAST: first choice in 2 of those 83
- HCL AppScan: first choice in 2 of those 83
- ImmuniWeb Neuron: first choice in 2 of those 83
- Astra Security: first choice in 1 of those 83

## API security platforms

**Small business**: 75 of 84 answers did not name OWASP ZAP (OWASP ZAP is #6 of 13 at 4%).

- Cloudflare API Shield: first choice in 19 of those 75
- 42Crunch: first choice in 10 of those 75
- StackHawk: first choice in 8 of those 75
- Zuplo: first choice in 6 of those 75
- Wallarm API Security: first choice in 5 of those 75
- Indusface AppTrana: first choice in 3 of those 75
- Postman: first choice in 3 of those 75
- Aikido Runtime Protection: first choice in 1 of those 75

**Mid-market**: 72 of 84 answers did not name OWASP ZAP (OWASP ZAP is #5 of 15 at 8%).

- Salt Security: first choice in 17 of those 72
- Zuplo: first choice in 6 of those 72
- Wallarm API Security: first choice in 5 of those 72
- Cloudflare API Shield: first choice in 4 of those 72
- Akamai API Security: first choice in 3 of those 72
- Traceable API Security Platform: first choice in 3 of those 72
- Kong Gateway: first choice in 2 of those 72
- Noname Security: first choice in 2 of those 72

**Enterprise**: 84 of 84 answers did not name OWASP ZAP.

- Salt Security: first choice in 35 of those 84
- Akamai API Security: first choice in 12 of those 84
- Traceable API Security Platform: first choice in 5 of those 84
- Wallarm API Security: first choice in 4 of those 84
- 42Crunch: first choice in 2 of those 84
- Apigee: first choice in 2 of those 84
- Gravitee: first choice in 2 of those 84
- Tyk: first choice in 2 of those 84

Published under CC BY 4.0. The output is the models' output; nothing here is a recommendation by the index.