Try our new research platform with insights from 80,000+ expert users

GitLab vs OWASP Zap comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Apr 20, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

GitLab
Ranking in Static Application Security Testing (SAST)
7th
Average Rating
8.6
Reviews Sentiment
7.1
Number of Reviews
84
Ranking in other categories
Application Security Tools (9th), Build Automation (1st), Release Automation (2nd), Rapid Application Development Software (11th), Software Composition Analysis (SCA) (5th), Enterprise Agile Planning Tools (2nd), Fuzz Testing Tools (2nd), DevSecOps (3rd)
OWASP Zap
Ranking in Static Application Security Testing (SAST)
8th
Average Rating
7.6
Reviews Sentiment
7.3
Number of Reviews
41
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of May 2025, in the Static Application Security Testing (SAST) category, the mindshare of GitLab is 2.7%, up from 2.3% compared to the previous year. The mindshare of OWASP Zap is 4.7%, down from 5.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Static Application Security Testing (SAST)
 

Featured Reviews

Rohit Kesharwani - PeerSpot reviewer
Improved agility and time to market with CI/CD enhancements
The CI/CD pipelines in GitLab ( /products/gitlab-reviews ) are highly valuable. Another important feature is the single source of repository, allowing efficient repository management and source code management. GitLab provides manageability by allowing us to manage source code effectively through separate repositories. Additionally, GitLab enables the creation of individual CI/CD pipelines for each repository, making software more agile. By integrating GitLab as a DevOps platform, we have enhanced agility, improved our time to market, and different teams can work collaboratively on various projects.
Amit Beniwal - PeerSpot reviewer
Simplifies vulnerability discovery and has high quality support
There are areas for improvement with OWASP Zap, particularly in the alignment of vulnerabilities concerning CVSS scores. Sometimes, a vulnerability initially categorized as high severity may be reduced to medium or low over time after security patches are applied. This alignment with the present severity score and CVSS score could be improved.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"GitLab's best features are continuous integration and fast deployment."
"By integrating GitLab as a DevOps platform, we have enhanced agility, improved our time to market, and different teams can work collaboratively on various projects."
"GitLab is kind of an image of GitHub, so it gives us the flexibility to monitor our changes in the repos."
"They incorporate new features every September, and they have introduced their own code editor and AI features."
"The solution is stable."
"GitLab has better support, and its features are superior compared to Jenkins."
"Their CI/CD engine is very mature. It's very comprehensive and flexible, and compared to other projects, I believe that GitLab is number one right now from that perspective."
"If you want to maintain your issues in GitLab and raise your book of work and features, then GitLab is a great tool for collaboration and integration with code deployment and CICD pipelines."
"We use the solution for security testing."
"The solution has tightened our security."
"One valuable feature of OWASP Zap is that it is simple to use."
"The application scanning feature is the most valuable feature."
"It can be used effectively for internal auditing."
"ZAP is easy to use. The automated scan is a powerful feature. You can simulate attacks with various parameters. ZAP integrates well with SonarQube."
"OWASP Zap is straightforward to use. If someone doesn't have the budget for tools like Burp Suite, OWASP Zap is an excellent alternative."
"Automatic scanning is a valuable feature and very easy to use."
 

Cons

"The solution should be more cloud-native and have more cloud-native capabilities and features."
"We are having a few problems integrating with Jira at the moment, which is something that our IT department is investigating."
"Based on what I know so far, its integration with Kubernetes is not so good. We have to develop many things to make it work. We have to acquire third-party components to work with Kubernetes."
"There is a need to improve or adopt AI into the ecosystem like a co-pilot, which Microsoft has done with GitHub."
"As a partner, sometimes it's difficult to get support. They have a really complicated procedure for their support."
"GitLab should work on improving their user interface for GitOps as it is lagging behind."
"The licensing model could be improved to be more accommodating in terms of user numbers and costs."
"I would like configuration of a YML file to be done via UI rather than a code file."
"OWASP should work on reducing false positives by using AI and ML algorithms. They should expand their capabilities for broader coverage of business logic flaws and complex issues."
"Online documentation can be improved to utilize all features of ZAP and API methods to make use in automation."
"The solution is somewhat unreliable because after we get the finding, we have to manually verify each of its findings to see whether it's a false positive or a true finding, and it takes time."
"Sometimes, we get some false positives."
"When comparing OWASP Zap and Burp Suite, the main difference besides pricing is that OWASP Zap has limitations with reporting levels and UI, which affects its reporting capabilities, whereas Burp Suite is already advancing with new AI features and scanning capabilities that OWASP Zap seems to be lacking."
"The reporting feature could be more descriptive."
"It would be ideal if I could try some pre-built deployment scenarios so that I don't have to worry about whether the configuration sector team is doing it right or wrong. That would be very helpful."
"The forced browse has been incorporated into the program and it is resource-intensive."
 

Pricing and Cost Advice

"The price of GitLab could be better, it is expensive."
"It seems reasonable. Our IT team manages the licenses."
"The price is okay."
"It is very expensive. We can't bear it now, and we have to find another solution. We have a yearly subscription in which we can increase the number of licenses, but we have to pay at the end of the year."
"On a scale of one to ten, where one is cheap, and ten is expensive, I rate the pricing a five out of ten."
"I'm not sure if they have some kind of discount. I've been negotiating with them on prices before, and I believe they weren't too happy to give discounts, but list prices are $19 per user, per month for Premium and $99 per user, per month for Ultimate. So, the difference between Premium and Ultimate is a bit bigger, and in most companies, you need to build some type of business case."
"The solution is free."
"GitLab is cheap."
"It is open source, and we can scan freely."
"The tool is open-source."
"OWASP ZAP is a free tool provided by OWASP’s engineers and experts. There is an option to donate."
"It's free and open, currently under the Apache 2 license. If ZAP does what you need it to do, selling a free solution is a very easy."
"It is highly recommended as it is an open source tool."
"The solution’s pricing is high."
"As Zap is free and open-source, with tons of features similar to those of commercial solutions, I would definitely recommend trying it out."
"This is an open-source solution and can be used free of charge."
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
852,098 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Educational Organization
22%
Financial Services Firm
12%
Computer Software Company
12%
Manufacturing Company
9%
Computer Software Company
18%
Financial Services Firm
12%
Manufacturing Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about GitLab?
I find the features and version control history to be most valuable for our development workflow. These aspects provide us with a clear view of changes and help us manage requests efficiently.
What is your experience regarding pricing and costs for GitLab?
The pricing of GitLab is reasonable, aligning with what I consider to be average compared to competitors.
What needs improvement with GitLab?
Certain features in Jira are not available in GitLab, such as the functionality to have weights at the milestone and epic levels. Hopefully, these features will be resolved with work items in GitLa...
Is OWASP Zap better than PortSwigger Burp Suite Pro?
OWASP Zap and PortSwigger Burp Suite Pro have many similar features. OWASP Zap has web application scanning available with basic security vulnerabilities while Burp Suite Pro has it available with ...
What do you like most about OWASP Zap?
The best feature is the Zap HUD (Heads Up Display) because the customers can use the website normally. If we scan websites with automatic scanning, and the website has a web application firewall, i...
What is your experience regarding pricing and costs for OWASP Zap?
OWASP might be cost-effective, however, people prefer to use the free edition available as open source.
 

Comparisons

 

Also Known As

Fuzzit
No data available
 

Overview

 

Sample Customers

1. NASA  2. IBM  3. Sony  4. Alibaba  5. CERN  6. Siemens  7. Volkswagen  8. ING  9. Ticketmaster  10. SpaceX  11. Adobe  12. Intuit  13. Autodesk  14. Rakuten  15. Unity Technologies  16. Pandora  17. Electronic Arts  18. Nordstrom  19. Verizon  20. Comcast  21. Philips  22. Deutsche Telekom  23. Orange  24. Fujitsu  25. Ericsson  26. Nokia  27. General Electric  28. Cisco  29. Accenture  30. Deloitte  31. PwC  32. KPMG
1. Google 2. Microsoft 3. IBM 4. Amazon 5. Facebook 6. Twitter 7. LinkedIn 8. Netflix 9. Adobe 10. PayPal 11. Salesforce 12. Cisco 13. Oracle 14. Intel 15. HP 16. Dell 17. VMware 18. Symantec 19. McAfee 20. Citrix 21. Red Hat 22. Juniper Networks 23. SAP 24. Accenture 25. Deloitte 26. Ernst & Young 27. PwC 28. KPMG 29. Capgemini 30. Infosys 31. Wipro 32. TCS
Find out what your peers are saying about GitLab vs. OWASP Zap and other solutions. Updated: April 2025.
852,098 professionals have used our research since 2012.