# OWASP ZAP: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 82 judge labels across 6 categories by 14 of 14 models. Page: https://www.gane.ai/index/it/vendors/owasp-zap

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Dynamic application security testing](https://www.gane.ai/index/it/developer/dynamic-application-security-testing/index.md) | 26% | 2 | 25% | 57 |
| [API security platforms](https://www.gane.ai/index/it/security/api-security-platforms/index.md) | 8% | 5 | 0% | 16 |
| [Vulnerability management platforms](https://www.gane.ai/index/it/security/vulnerability-management-platforms/index.md) | 0% | 24 | 0% | 4 |
| [Penetration testing as a service](https://www.gane.ai/index/it/security/penetration-testing-as-a-service/index.md) | 0% | 42 | 0% | 3 |
| [Application security posture management](https://www.gane.ai/index/it/developer/application-security-posture-management/index.md) | 0% | 57 | 0% | 1 |
| [Client-side protection](https://www.gane.ai/index/it/security/client-side-protection/index.md) | 0% | 101 | 100% | 1 |

## What the models said for it

- "OWASP ZAP is the most widely used open-source DAST tool and the strongest free option for API security testing." (Claude Haiku 4.5, API security)
- "Best Overall Free/Open-Source Choice ... Completely free and open-source, with no usage limits or hidden fees." (Grok 4.20, API security)
- "Best default for a limited budget: ZAP by Checkmarx (formerly OWASP ZAP). It's free and open source" (GPT-6 Luna, DAST)
- "Use OWASP ZAP (actively maintained, modern browser crawling support, strong CI/CD integration)" (Gemini 3.5 Flash, DAST)

## And against it

- "it is advisable to avoid or proceed with extreme caution when using OWASP ZAP or Invicti in automated pipelines" (Mistral Small, DAST)
- "Avoid for Automated Pipelines: OWASP ZAP (if you lack a dedicated team to manage it)." (Qwen 3.7 Flash, DAST)
- "Unmanaged open-source tools (like raw OWASP ZAP) unless you have dedicated headcount" (Gemini 3.5 Flash, DAST)
- "Excellent free option, but avoid treating its default output as production-ready. It can require substantial tuning and manual configuration, with potentially high false-positive volume" (Perplexity Sonar, DAST)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 2 | 1 | 0 | 0 | 3 |
| GPT-5.4 mini | 3 | 0 | 0 | 1 | 4 |
| Gemini 3.5 Flash | 2 | 2 | 4 | 1 | 9 |
| Perplexity Sonar | 1 | 2 | 0 | 2 | 5 |
| Grok 4.20 | 2 | 3 | 0 | 3 | 8 |
| Mistral Small | 1 | 4 | 1 | 1 | 7 |
| DeepSeek V4 Flash | 1 | 4 | 1 | 1 | 7 |
| Llama 4 Maverick | 1 | 2 | 1 | 1 | 5 |
| Qwen 3.7 Flash | 1 | 3 | 1 | 2 | 7 |
| Kimi K2 | 1 | 3 | 4 | 1 | 9 |
| GLM 4.7 FlashX | 3 | 2 | 2 | 1 | 8 |
| MiniMax M2.5 | 1 | 2 | 0 | 0 | 3 |
| GPT-6 Luna | 1 | 1 | 1 | 1 | 4 |
| Muse Glimmer 30B | 0 | 2 | 1 | 0 | 3 |

## Sources returned with these answers

The sites and pages cited by the answers that named OWASP ZAP, from 194 of the 212 answers that named it (only the models that return a source list).

### Domains cited

- safeguard.sh: 86
- softwaretestinghelp.com: 56
- g2.com: 53
- gane.ai/index: 51
- aimultiple.com: 44
- securityboulevard.com: 44
- checkmarx.com: 43
- immuniweb.com: 41
- github.com: 40
- escape.tech: 35

### Pages cited

- https://softwaretestinghelp.com/dynamic-application-security-testing-dast-software: 56
- https://safeguard.sh/resources/blog/best-dast-tools-for-web-application-security-testing: 54
- https://immuniweb.com/resources/best-dast-tools: 38
- https://aimultiple.com/dast-tools: 35
- https://checkmarx.com/learn/dast/dast-tools-key-features-and-12-solutions-to-know-in-2026: 30
- https://safeguard.sh/resources/blog/dast-tools-list: 29
- https://securityboulevard.com/2026/04/dast-tools-complete-buyers-guide-10-solutions-to-know-in-2026: 28
- https://geekflare.com/cybersecurity/best-dast-scanners: 27

## In its own words

What OWASP ZAP's own pages state, read 2026-10-05. Stated by the vendor, not checked by the index.

- Positioning: OWASP is the nonprofit behind the Top 10, ASVS, ZAP, and hundreds more free application security projects. (https://owasp.org/)

## What it publishes

Every page owasp.org exposes, read 2026-09-29: 893 addresses. By kind, pages and the last 90 days:

- blog: 86 pages, 0 in the last 90 days, latest 2025-08-05
- webinar or virtual event: 7 pages, 0 in the last 90 days, latest 2026-05-13
- conference or event: 35 pages, 0 in the last 90 days, latest 2025-11-14
- template or tool: 3 pages, 0 in the last 90 days, latest 2024-05-08
- glossary or explainer: 1 pages, 0 in the last 90 days, latest undated
- podcast or video: 4 pages, 0 in the last 90 days, latest undated
- news or press: 18 pages, 0 in the last 90 days, latest 2024-11-20
- Recent: 2026-05-13 webinar or virtual event: Gen ai project application security risk virtual summit https://genai.owasp.org/event/gen-ai-project-application-security-risk-virtual-summit
- Recent: 2025-11-14 conference or event: Genai security project agentic ai summit europe https://genai.owasp.org/event/genai-security-project-agentic-ai-summit-europe
- Recent: 2025-08-30 conference or event: Genai security project uae summit hackathon https://genai.owasp.org/event/genai-security-project-uae-summit-hackathon
- Recent: 2025-08-28 conference or event: Owasp 2025 global appsec usa washington dc https://genai.owasp.org/event/owasp-2025-global-appsec-usa-washington-dc
- Recent: 2025-08-27 webinar or virtual event: Gen ai application security risk virtual conference https://genai.owasp.org/event/gen-ai-application-security-risk-virtual-conference
- Recent: 2025-08-06 webinar or virtual event: Owasp genai agentic security top 10 global kick off livestream https://genai.owasp.org/event/owasp-genai-agentic-security-top-10-global-kick-off-livestream

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.