OWASP Zap Room for Improvement

Vijayanathan Naganathan
Director - Head of Delivery Services at Ticking Minds Technology Solutions Pvt Ltd
OWASP Zap has the award for best token authentication. A lot of applications are getting into this space where there are token barriers. Moreover ZAP Proxy security scans are excellent providing a comprehensive coverage. One area where the tool can be improved is specifically, if there's some more intelligence that can be added on to the reporting feature, it would be great. There's some element of intelligence that can be built into it as to how reports can be generated. Currently, there are only a few ways, i.e. a couple of templates with which you can generate these reports. If there are additional templates that could be put in place, the reports would come out very well, and we'd be able to edit it along reading the report. That could be good for us to make it through. Because that is an area that we've seen typically, where it's common in the other tools. We run the test. We run the scans. We do the vulnerability assessment, analyze their impacts and then we generate the report. There's the element of documentation that we need to create along with that. If there is a provision to enter inputs like below as part of report generation: * Project information * Client name * Organization name * Platform against which this test has been done If these small inputs can be handled, at the end of the report, I would have a customized report which I could easily give across to the customer. Today it's this is something not easily available in not at that level in the tool. In the reporting presentation format, Acunetix tool has a much better "look and feel" appearance. The clients love it when we do it in that. View full review »
Vidar Folden
Consultant at Moller
I would like for them to make it easier to understand exactly what has been checked and what has not been checked. We have to trust that it has checked all known vulnerabilities on all parts of the webapp, but it's a bit hard to see that after scanning. I would also like for them to develop graphical reports on the scan. Based on the log, some graphical drawing could show what part of the site has been tested. I would like to see that it has tested everything that we wanted to test. View full review »
Jaromir Tesar
Embedded Software Engineer at Y Soft
The product is somewhat complicated and could be improved by simplifying it because you don't want to have to allocate one person to maintain the solution full time. We'd like to be able to deploy it and have it work. Ideally we'd like to be able to get a pull request analysis and the analysis of repositories. I think they could definitely work on a more simplified deployment. That would improve the product. The issues are not necessarily related to the solution but possibly connected to how it was initially set up. View full review »
Find out what your peers are saying about OWASP , PortSwigger, Acunetix and others in Application Security Testing (AST). Updated: September 2020.
438,944 professionals have used our research since 2012.
CEO and Founder at Indicrypt Systems
The automatic scans need improvement. The automated vulnerability assessments that the application performs needs to be simplified as well as diversified. View full review »
Business Analyst at Experion Technologies
I'd like to be able to explore more and improvements could be made in that area because for now I'm only able to explore the manual testing feature. I'd also like to see an improvement in test reports because we get too many false positives. View full review »
Information Security Professional at a energy/utilities company with 1,001-5,000 employees
The documentation needs to be improved because I had to learn everything from watching YouTube videos. View full review »
Senior Manager at a marketing services firm with 10,001+ employees
I'm still in the process of exploring. I'd like to see a kind of feature where we can just track what our last vulnerability was and how it has improved or not. More reports that can have some kind of base-lining, I think that would be a good feature too. I'm not sure whether it can be achieved and implement but I think that would really help. View full review »
Senior Engineer at a aerospace/defense firm with 10,001+ employees
There is definitely room for improvement. I prefer Burp Suite to OWASP Zap because of the extensive coverage it offers. I also think it should have an open-source tool. I would also love to see an improvement in visibility. View full review »
Dittin A
Staff Scientist/Senior Tech. Officer at a tech vendor with 501-1,000 employees
It needs more robust reporting tools that can be in an editable form. View full review »
Find out what your peers are saying about OWASP , PortSwigger, Acunetix and others in Application Security Testing (AST). Updated: September 2020.
438,944 professionals have used our research since 2012.