User Reviews of Checkmarx One & OWASP Zap

The interactive application security testing, or IAST, where code scans are being ran on an application that lives in a runtime environment on a server or virtual machine, needs improvement. There was limited support from different languages. It didn't support everything under the sun, so you would lose revenue since you didn't have support...

There is the point that there may be false positives if we're doing vulnerability scanning. The automated scanning feature is good. But if the website has a web application firewall, it's very difficult to use automated scanning. Because the automated scan sends many requests at the same time, and the WAF will block it as suspicious...