We performed a comparison between OWASP Zap and Rapid7 InsightAppSec based on real PeerSpot user reviews.
Find out in this report how the two Static Application Security Testing (SAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The vulnerabilities that it finds, because the primary goal is to secure applications and websites."
"The scalability of this product is very good."
"The OWASP's tool is free of cost, which gives it a great advantage, especially for smaller companies to make use of the tool."
"The best feature is the Zap HUD (Heads Up Display) because the customers can use the website normally. If we scan websites with automatic scanning, and the website has a web application firewall, it's very difficult."
"Fuzzer and Java APIs help a lot with our custom needs."
"The ZAP scan and code crawler are valuable features."
"The API is exceptional."
"It updates repositories and libraries quickly."
"The initial setup for us was easy enough. We didn't face too many issues. Deployment took maybe 30 minutes. It's quite quick and doesn't cause too much trouble at the outset."
"It's very easy to use and user-friendly. It does the job."
"It uses a signature-based method to check for problems with your code and will provide an alert if anything is found."
"The product’s most valuable feature is UI. It is easy to manage and find vulnerabilities in the application."
"It is a very robust solution."
"You have various attack modules, and you also have the Attack Replay feature for the attack sequence. You can reproduce an attack and see it. That is a very good feature I noticed in this solution. It helps developers as well."
"The templates feature is very easy. You just choose the kind of attack you want on your web application, and you run it against that template and receive a report. It's great."
"We have seen measurable decrease in the mean time to respond to threats by 20 percent."
"It would be beneficial to enhance the algorithm to provide better summaries of automatic scanning results."
"The solution is somewhat unreliable because after we get the finding, we have to manually verify each of its findings to see whether it's a false positive or a true finding, and it takes time."
"The reporting feature could be more descriptive."
"They stopped their support for a short period. They've recently started to come back again. In the early days, support was much better."
"I prefer Burp Suite to SWASP Zap because of the extensive coverage it offers."
"It doesn't run on absolutely every operating system."
"Zap could improve by providing better reports for security and recommendations for the vulnerabilities."
"The technical support team must be proactive."
"I would like more details of what the product can do."
"The reporting is definitely an aspect of the solution that's in need of some work. We found that we'd try to use widgets, but often getting them to work for us wasn't very clear. They need to be more user friendly or offer better instructions."
"They should add more features. I would like to see them do a little more on static analysis and also interactivity analysis. Currently, it does very basic static analysis. It could do a little more static analysis, which is something that would help. A lot more interactivity analysis should also be there. It should basically look at security during interactivity."
"When you add new projects for the same product, it either duplicates or replaces the scan configuration. If I run a scan for the same product with a different scan configuration, it should keep the previous scan configuration and not replace it with the new scan configuration. It should just add the new scan configuration. That would be helpful. They do keep the results as it is, but the scan configuration keeps changing. For example, I have set a scan configuration to a full scan, and next week, I want to run a new scan for the same product with some changes or new functionalities. I want to run a partial scan. Currently, if I change the scan configuration to partial, it changes the old one also to partial. That should be improved."
"We get a lot of false positives during the tests."
"In the future, if they can have integration with a lot of ticketing systems then it would be amazing."
"The product’s pricing could be flexible."
"We'd like to see integrations with WAF solutions."
OWASP Zap is ranked 8th in Static Application Security Testing (SAST) with 37 reviews while Rapid7 InsightAppSec is ranked 3rd in Dynamic Application Security Testing (DAST) with 12 reviews. OWASP Zap is rated 7.6, while Rapid7 InsightAppSec is rated 8.6. The top reviewer of OWASP Zap writes "Great for automating and testing and has tightened our security ". On the other hand, the top reviewer of Rapid7 InsightAppSec writes "A highly scalable and robust product that enables users to automate scans". OWASP Zap is most compared with SonarQube, Acunetix, Qualys Web Application Scanning, Veracode and Rapid7 AppSpider, whereas Rapid7 InsightAppSec is most compared with Rapid7 AppSpider, PortSwigger Burp Suite Professional, Fortify WebInspect, Acunetix and Invicti. See our OWASP Zap vs. Rapid7 InsightAppSec report.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.