Cancel
You must select at least 2 products to compare!
OWASP Logo
22,442 views|10,766 comparisons
Veracode Logo
27,089 views|18,097 comparisons
Comparison Buyer's Guide
Executive Summary
Updated on Mar 6, 2024

We compared Veracode and OWASP Zap across several parameters based on our user's reviews. After reading the collected data, you can find our conclusion below:

  • Initial Setup: Veracode is a cloud-based solution with no need for local infrastructure setup. Overall, its setup is described as straightforward, with minimal technical capabilities required. Some users found the web interface to be unintuitive but received help from Veracode to deploy the solution. On the other hand, OWASP ZAP requires manual installation and configuration. It's deployment and setup timeframes vary, with some users spending three months on deployment and an additional week on setup. Others spent a week for both deployment and setup together.
  • Valuable Features: Users mentioned that Veracode's useful features include comprehensive security testing, accurate vulnerability detection, and reliable reporting. Users appreciate its effectiveness in managing and mitigating vulnerabilities. Veracode provides broader security capabilities beyond scanning, including SAST, DAST, SCA, and continuous security monitoring. OWASP ZAP offers a wide range of features, it is praised for its comprehensive scanning capabilities (manual and automated scanning), extensibility through add-ons, and support for various protocols. 
  • Setup Cost: OWASP ZAP is open-source and free to use, with its minimal setup cost, users find the solution affordable. Veracode is a paid solution with various pricing tiers based on features and usage. Some reviewers consider Veracode's setup cost expensive, especially for universities and small businesses. However, others find it reasonable and appreciate the value it provides. 
  • ROI: Veracode offers benefits such as reducing development costs, preventing security breaches, and maintaining certifications. OWASP Zap provides cost-effective security solutions with enhanced vulnerability detection and a user-friendly interface.
  • Customer Service: Veracode's customer service has received mixed reviews; the company offers dedicated customer support with various plans, with some users praising their responsiveness and knowledge, while others have experienced slow response times and delays. In contrast, OWASP Zap relies on the community for support through forums and online resources; it has  active community support.

Based on the user reviews, Veracode is the preferred product over OWASP Zap. However, if you have a limited budget and technical expertise for setup and customization, go for OWASP ZAP. If you prioritize ease of use, a cloud-based solution, and you require a broader range of security functionalities beyond just vulnerability scanning, choose Veracode.

To learn more, read our detailed OWASP Zap vs. Veracode Report (Updated: March 2024).
763,955 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"The OWASP's tool is free of cost, which gives it a great advantage, especially for smaller companies to make use of the tool.""It can be used effectively for internal auditing.""Two features are valuable. The first one is that the scan gets completed really quickly, and the second one is that even though it searches in a limited scope, what it does in that limited scope is very good. When you use Zap for testing, you're only using it for specific aspects or you're only looking for certain things. It works very well in that limited scope.""It has evolved over the years and recently in the last year they have added, HUD (Heads Up Display).""The API is exceptional.""It updates repositories and libraries quickly.""The reporting is quite intuitive, which gives you a clear indication of what kind of vulnerability you have that you can drill down on to gather more information.""Automatic updates and pull request analysis."

More OWASP Zap Pros →

"Veracode offers various security features.""The automation of Veracode is great because we no longer have to run manual testing.""The coding standards in our development group have improved. From scanning our code we've learned the patterns and techniques to make our code more secure. An example would be SQL injection. We have mitigated all the SQL injection in our applications.""With the pipeline scanner, it's easier for developers to scan their products, as they don't have to export anything from their computers. They can do everything with the command line on their computer.""The dynamic scanning tool is what I like the best. Compared to other tools that I've used for dynamic scanning, it's much faster and easier to use.""The coverage of backdoors attacks on security that's the most valuable for my clients.""Veracode is easy to use even if you're not a security professional. I like the dynamic analysis feature, which offers a lot of cost savings when used in production.""One of the valuable features is that it gives us the option of static scanning. Most tools of this type are centered around dynamic scanning. Having a static scan is very important."

More Veracode Pros →

Cons
"Zap could improve by providing better reports for security and recommendations for the vulnerabilities.""I would like to see a version of “repeater” within OWASP ZAP, a tool capable of sending from one to 1000 of the same requests, but with preselected modified fields, changing from a predetermined word ​list, or manually created.""The forced browse has been incorporated into the program and it is resource-intensive.""Too many false positives; test reports could be improved.""I prefer Burp Suite to SWASP Zap because of the extensive coverage it offers.""The automated vulnerability assessments that the application performs needs to be simplified as well as diversified.""The port scanner is a little too slow.​""The product reporting could be improved."

More OWASP Zap Cons →

"I would like to see these features: entering comments for internal tracking; entering a priority; reports that show the above.""There is much to be desired of UI and user experience. The UI is very slow. With every click, it just takes a lot of time for the pages to load. We have seen this consistently since getting this solution. The UI and UX are very disjointed.""The only areas that I'm concerned with are some of the newer code libraries, things that we're starting to see people dabble with. They move quickly enough to get them into the Analysis Engine, so I wouldn't even say it is a complaint. It is probably the only thing I worry about: Occasionally hitting something that is built in some other obscure development model, where we either can't scan it or can't scan it very well.""Veracode should include the feature to run multiple scales at a time.""The ideal situation in terms of putting the results in front of the developers would be with Veracode integration into the developer environment (IDE). They do have a plugin, which we've used in the past, but we were not as positive about it.""The current version of the application does not support testing for API.""It's problematic if you want to integrate it with your pipelines because the documentation is not so well written and it's full of typos. It is not presented in a structured way. It does not say, "If you want to achieve this particular thing, you have to do steps 1, 2, and 3." Instead, it contains bits of information in different parts, and you have to read everything and then understand the big picture.""We connected with Veracode's support a couple of times, and we got a different answer each time."

More Veracode Cons →

Pricing and Cost Advice
  • "It is highly recommended as it is an open source tool."
  • "It's free and open, currently under the Apache 2 license. If ZAP does what you need it to do, selling a free solution is a very easy."
  • "OWASP ZAP is a free tool provided by OWASP’s engineers and experts. There is an option to donate."
  • "As Zap is free and open-source, with tons of features similar to those of commercial solutions, I would definitely recommend trying it out."
  • "It's free. It's good for us because we don't know what the extent of our use will be yet. It's good to start with something free and easy to use."
  • "OWASP Zap is free to use."
  • "This app is completely free and open source. So there is no question about any pricing."
  • "This is an open-source solution and can be used free of charge."
  • More OWASP Zap Pricing and Cost Advice →

  • "Its complexity makes it quite expensive, but it’s all worth it, with all the engineering in the background."
  • "The pricing is pretty high."
  • "The worst part about the product is that it does not scale at all. Also, microservices apps will cost you a fortune."
  • "I think licensing needs to be changed or updated so that it works with adjustments. Pricing is expensive compared to the amount of scanning we perform."
  • "It's worth the value"
  • "Pricing seems fair for what is offered, and licensing has been no problem. All developers are able to get the access they need."
  • "It can be expensive to do this, so I would just make sure that you're getting the proper number of licenses. Do your analysis. Make sure you know exactly what it is you need, going in."
  • "The licensing and prices were upfront and clear. They stand behind everything that is said during the commercial phase and during the onboarding phase. Even the most irrelevant "that can be done" was delivered, no matter how important the request was."
  • More Veracode Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Application Security Testing (AST) solutions are best for your needs.
    763,955 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:OWASP Zap and PortSwigger Burp Suite Pro have many similar features. OWASP Zap has web application scanning available with basic security vulnerabilities while Burp Suite Pro has it available with… more »
    Top Answer:The application scanning feature is the most valuable feature.
    Top Answer:SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use… more »
    Top Answer:The SAST and DAST modules are great.
    Top Answer:The product’s price is a bit higher compared to other solutions. However, the tool provides good vulnerability and database features. It is worth the money.
    Ranking
    Views
    22,442
    Comparisons
    10,766
    Reviews
    12
    Average Words per Review
    360
    Rating
    7.3
    Views
    27,089
    Comparisons
    18,097
    Reviews
    97
    Average Words per Review
    972
    Rating
    8.1
    Comparisons
    Also Known As
    Crashtest Security , Veracode Detect
    Learn More
    Overview

    OWASP Zap is a free and open-source web application security scanner. 

    The solution helps developers identify vulnerabilities in their web applications by actively scanning for common security issues. 

    With its user-friendly interface and powerful features, Zap is a popular choice among developers for ensuring the security of their web applications.

    Veracode is a leading application security platform that helps organizations to develop and deliver secure software. Veracode's solution provides comprehensive capabilities for static analysis, dynamic analysis, software composition analysis, and manual penetration testing.

    Veracode's static analysis solution scans source code for various security vulnerabilities, including common web application attack vectors, injection flaws, cross-site scripting, and insecure direct object references. Veracode's dynamic analysis solution simulates real-world attacks to identify vulnerabilities that may not be detectable by static analysis alone. Veracode's software composition analysis solution scans open-source and third-party components for known vulnerabilities. Veracode's manual penetration testing service is performed by experienced security professionals who use a variety of techniques to identify vulnerabilities in software applications.

    Many organizations, including Fortune 500 companies, government agencies, and startups, use Veracode's solution. Veracode's customers rely on Veracode to help them to improve the security of their software applications and to reduce the risk of data breaches and other security incidents.

    Here are some of the benefits of using Veracode:

    • Veracode provides capabilities for static analysis, dynamic analysis, software composition analysis, and manual penetration testing to help organizations identify and fix security vulnerabilities in their software applications early in the development process.
    • Veracode helps organizations reduce the risk of data breaches and other security incidents by identifying and fixing security vulnerabilities in their software application. 
    • Veracode helps organizations to comply with industry regulations. Many industries have regulations that require organizations to implement security measures to protect their customers' data. Veracode's solution can help organizations to comply with these regulations by providing them with the tools and resources they need to identify and fix security vulnerabilities in their software applications.
    Offer
    Learn more about OWASP Zap
    Keep your software secure

    Application security starts with secure code. Find out more about the benefits of using Veracode to keep your software secure throughout the development lifecycle.

    Sample Customers
    1. Google 2. Microsoft 3. IBM 4. Amazon 5. Facebook 6. Twitter 7. LinkedIn 8. Netflix 9. Adobe 10. PayPal 11. Salesforce 12. Cisco 13. Oracle 14. Intel 15. HP 16. Dell 17. VMware 18. Symantec 19. McAfee 20. Citrix 21. Red Hat 22. Juniper Networks 23. SAP 24. Accenture 25. Deloitte 26. Ernst & Young 27. PwC 28. KPMG 29. Capgemini 30. Infosys 31. Wipro 32. TCS
    Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
    Top Industries
    REVIEWERS
    Computer Software Company26%
    Financial Services Firm16%
    Retailer11%
    Energy/Utilities Company11%
    VISITORS READING REVIEWS
    Computer Software Company18%
    Financial Services Firm10%
    Comms Service Provider7%
    Government7%
    REVIEWERS
    Computer Software Company25%
    Financial Services Firm23%
    Insurance Company9%
    Comms Service Provider6%
    VISITORS READING REVIEWS
    Financial Services Firm18%
    Computer Software Company15%
    Manufacturing Company8%
    Government6%
    Company Size
    REVIEWERS
    Small Business22%
    Midsize Enterprise28%
    Large Enterprise50%
    VISITORS READING REVIEWS
    Small Business21%
    Midsize Enterprise15%
    Large Enterprise63%
    REVIEWERS
    Small Business30%
    Midsize Enterprise20%
    Large Enterprise50%
    VISITORS READING REVIEWS
    Small Business17%
    Midsize Enterprise13%
    Large Enterprise70%
    Buyer's Guide
    OWASP Zap vs. Veracode
    March 2024
    Find out what your peers are saying about OWASP Zap vs. Veracode and other solutions. Updated: March 2024.
    763,955 professionals have used our research since 2012.

    OWASP Zap is ranked 8th in Application Security Testing (AST) with 13 reviews while Veracode is ranked 2nd in Application Security Testing (AST) with 101 reviews. OWASP Zap is rated 7.6, while Veracode is rated 8.2. The top reviewer of OWASP Zap writes "Stable dynamic testing solution with unreliable manual processes". On the other hand, the top reviewer of Veracode writes "Great SAST, good DAST, and helps save a significant amount of time". OWASP Zap is most compared with SonarQube, PortSwigger Burp Suite Professional, Acunetix, Qualys Web Application Scanning and Checkmarx, whereas Veracode is most compared with SonarQube, Checkmarx, Snyk, Fortify on Demand and Fortify Static Code Analyzer. See our OWASP Zap vs. Veracode report.

    See our list of best Application Security Testing (AST) vendors.

    We monitor all Application Security Testing (AST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.