OWASP Zap vs Synopsys API Security Testing [EOL] comparison

"It can be used effectively for internal auditing."

"Fuzzer and Java APIs help a lot with our custom needs."

"This solution is providing us with value and as long as it continues to do so, we'll continue to use it."

"Technical support is excellent."

"ZAP is easy to use. The automated scan is a powerful feature. You can simulate attacks with various parameters. ZAP integrates well with SonarQube."

"The most valuable feature is scanning the URL to drill down all the different sites."

"The product has improved our application security engagement, helps with our in-house review so we sometimes don't need an external third-party tester, and once we get it from OWASP Zap, we have an idea of the inherent vulnerabilities in the application, which is a plus to save cost and improve our application accuracy practice."

"The application scanning feature is the most valuable feature."

"The technical support from Synopsys API Security Testing is amazing."

"The most valuable features of Synopsys API Security Testing are the metrics, results, and threat vectors that it shares."

"The forced browse has been incorporated into the program and it is resource-intensive."

"The computers perform somewhat slowly when loading a large number of queries into memory."

"As security evolves, we would like DevOps built into it. As of now, Zap does not provide this."

"Deployment is somewhat complicated."

"The work that it does in the limited scope is good, but the scope is very limited in terms of the scanning features. The number of things it tests or finds is limited. They need to make it a more of a mainstream tool that people can use, and they can even think about having it on a proprietary basis. They need to increase the coverage of the scan and the results that it finds. That has always been Zap's limitation. Zap is a very good tool for a beginner, but once you start moving up the ladder where you want further details and you want your scan to show more in-depth results, Zap falls short because its coverage falls short. It does not have the capacity to do more."

"While the solution can scale to a certain extent, it cannot scale a lot."

"For scalability, I would rate OWASP Zap between four to five out of ten."

"The solution is somewhat unreliable because after we get the finding, we have to manually verify each of its findings to see whether it's a false positive or a true finding, and it takes time."

"We haven't covered all the areas yet in our business. It's still being scaled up within the organization. We've probably covered 10 percent of the business. I don't think we've seen a proper ROI yet."

"The solution required us to use our team and we spoke to Synopsys API Security Testing's support to do the implementation. We use two people from our team for the implementation. and one person for maintenance."

"This solution is open source and free."

"As Zap is free and open-source, with tons of features similar to those of commercial solutions, I would definitely recommend trying it out."

"OWASP ZAP is a free tool provided by OWASP’s engineers and experts. There is an option to donate."

"It is open source, and we can scan freely."

"It is highly recommended as it is an open source tool."

"The tool is open source."

"We have used the freeware version. I believe Zap only has freeware."

"It's free. It's good for us because we don't know what the extent of our use will be yet. It's good to start with something free and easy to use."