# OWASP ZAP vs Veracode

**Leader by vioscaleAI score:** Veracode

| Attribute | OWASP ZAP | Veracode |
|---|---|---|
| **vioscaleAI score** | 50.4 (40% (low)) | 73 (52% (medium)) |
| activity.commits_last_30d | 29 | - |
| adoption.dependent_repos | 30 | - |
| adoption.github_stars | 15,930 | - |
| content.faq | `[{"answer":"An open-source security scanner that performs dynamic analysis on web applications to detect potential vulnerabilities. It supports automation, extensibility through community add-ons, and integrates with CI/CD pipelines. It is indexed under DevSecOps Tools.","source":"https://www.zaproxy.org","question":"What is OWASP ZAP?","confidence":0.6},{"answer":"OWASP ZAP is open source, so it can be self-hosted and used at no licence cost. It is released under the Apache-2.0 licence. Pricing changes often, so verify at source before relying on it.","source":"https://www.zaproxy.org","question":"Is OWASP ZAP free to use?","confidence":0.6},{"answer":"Yes. OWASP ZAP can be deployed self-hosted, so it does not have to run on the vendor's infrastructure.","source":"https://www.zaproxy.org","question":"Can OWASP ZAP be self-hosted?","confidence":0.6},{"answer":"Yes. OWASP ZAP is published under the Apache-2.0 licence, a permissive licence that generally allows commercial use and modification. Licence terms can change between releases, so verify against the repository for the version you intend to use.","source":"https://github.com/zaproxy/zaproxy","question":"Is OWASP ZAP open source?","confidence":0.95}]` | - |
| deployment.options | `{"self_hosted":true}` | `{"cloud":true}` |
| description.long | An open-source security scanner that performs dynamic analysis on web applications to detect potential vulnerabilities. It supports automation, extensibility through community add-ons, and integrates with CI/CD pipelines. | A comprehensive platform for identifying, prioritizing, and fixing application security vulnerabilities across code, dependencies, containers, and infrastructure. It combines static and dynamic testing with AI-driven remediation to reduce security risk while maintaining developer velocity. |
| features.capabilities | `{"dast":true,"hosting":"self","ci_native":true,"open_source":true}` | `{"sca":true,"dast":true,"sast":true,"hosting":"cloud","ci_native":true,"ide_plugin":true,"auto_fix_pr":true,"iac_scanning":true,"reachability":true,"container_scanning":true,"license_compliance":true}` |
| integrations.count | 2 | 25 |
| integrations.list | `[{"name":"GitHub"},{"name":"GitHub Actions"}]` | `[{"name":"GitHub","native":true,"category":"repository","direction":"inbound"},{"name":"GitLab","native":true,"category":"repository","direction":"inbound"},{"name":"AWS","native":true,"category":"cloud","direction":"inbound"},{"name":"Google Cloud","native":true,"category":"cloud","direction":"inbound"},{"name":"Microsoft Defender for Cloud","native":true,"category":"security","direction":"inbound"},{"name":"Snyk","native":true,"category":"security","direction":"inbound"},{"name":"Checkmarx","native":true,"category":"security","direction":"inbound"},{"name":"Contrast Security","native":true,"category":"security","direction":"inbound"},{"name":"Fortify OnDemand","native":true,"category":"security","direction":"inbound"},{"name":"Rapid7 InsightAppSec","native":true,"category":"security","direction":"inbound"},{"name":"Qualys","native":true,"category":"vulnerability","direction":"inbound"},{"name":"JFrog Xray","native":true,"category":"security","direction":"inbound"},{"name":"AWS Config","native":true,"category":"compliance","direction":"inbound"},{"name":"AWS Inspector","native":true,"category":"security","direction":"inbound"},{"name":"Prisma Cloud","native":true,"category":"security","direction":"inbound"},{"name":"Wiz","native":true,"category":"security","direction":"inbound"},{"name":"CrowdStrike","native":true,"category":"security","direction":"inbound"},{"name":"Orca","native":true,"category":"security","direction":"inbound"},{"name":"SecurityScorecard","native":true,"category":"security","direction":"inbound"},{"name":"Terraform Cloud","native":true,"category":"iac","direction":"inbound"}]` |
| language.primary | Java | - |
| license.spdx | Apache-2.0 | - |
| platform.support | - | `{"cli":true,"web":true}` |
| pricing | `{"type":"open_source","freeTier":true,"sourceUrl":"https://www.zaproxy.org","retrievedAt":"2026-08-14T15:30:17.577Z"}` | - |
| pricing.free_tier | yes | - |
| pricing.model | open_source | commercial |
| pricing.price_level | free | - |
| release.cadence_days | 6 | - |
| release.history | `[{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-10-08","date":"2026-10-08T14:24:47Z","type":"prerelease","version":"w2026-10-08"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-09-30","date":"2026-09-30T15:41:19Z","type":"prerelease","version":"w2026-09-30"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-09-23","date":"2026-09-23T11:17:12Z","type":"prerelease","version":"w2026-09-23"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-09-15","date":"2026-09-15T09:44:13Z","type":"prerelease","version":"w2026-09-15"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-09-08","date":"2026-09-08T15:01:10Z","type":"prerelease","version":"w2026-09-08"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-09-03","date":"2026-09-03T12:35:50Z","type":"prerelease","version":"w2026-09-03"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-08-26","date":"2026-08-26T08:35:57Z","type":"prerelease","version":"w2026-08-26"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-08-19","date":"2026-08-19T10:51:56Z","type":"prerelease","version":"w2026-08-19"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-08-11","date":"2026-08-11T14:53:54Z","type":"prerelease","version":"w2026-08-11"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-08-06","date":"2026-08-06T14:19:52Z","type":"prerelease","version":"w2026-08-06"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-07-28","date":"2026-07-28T11:12:43Z","type":"prerelease","version":"w2026-07-28"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-07-21","date":"2026-07-21T16:10:37Z","type":"prerelease","version":"w2026-07-21"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-07-14","date":"2026-07-14T13:46:09Z","type":"prerelease","version":"w2026-07-14"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-07-13","date":"2026-07-13T15:29:09Z","type":"prerelease","version":"w2026-07-13"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-07-06","date":"2026-07-06T14:25:44Z","type":"prerelease","version":"w2026-07-06"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-30","date":"2026-06-30T14:30:23Z","type":"prerelease","version":"w2026-06-30"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-29","date":"2026-06-29T14:01:46Z","type":"prerelease","version":"w2026-06-29"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-24","date":"2026-06-24T16:56:19Z","type":"prerelease","version":"w2026-06-24"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-23","date":"2026-06-23T16:18:04Z","type":"prerelease","version":"w2026-06-23"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-16","date":"2026-06-16T16:08:49Z","type":"prerelease","version":"w2026-06-16"}]` | - |
| reliability.status_page | - | yes |
| security.disclosure_policy | yes | - |
| security.fedramp | - | yes |
| security.gdpr | - | yes |
| security.hipaa | - | yes |
| security.iso27001 | - | yes |
| security.pci | - | yes |
| security.scorecard | 6.8 | - |
| security.soc2 | - | yes |
| security.trust_center | - | https://www.veracode.com/security/ |
| security.vulnerabilities | `{"count":1,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=maven&package_name=org.zaproxy%3Azap&per_page=100","last_12m":0,"max_severity":"MODERATE"}` | - |

## Capabilities (DevSecOps Tools)

| Capability | OWASP ZAP | Veracode |
|---|:--:|:--:|
| **Scan types** |  |  |
| SAST (static analysis) | - | ✓ |
| DAST (dynamic analysis) | ✓ | ✓ |
| SCA / dependency scanning | - | ✓ |
| Secret scanning | - | - |
| Container / image scanning | - | ✓ |
| IaC misconfiguration scanning | - | ✓ |
| **Governance** |  |  |
| OSS licence compliance | - | ✓ |
| SBOM generation (SPDX/CycloneDX) | - | - |
| **Remediation** |  |  |
| Automated fix / upgrade PRs | - | ✓ |
| **Prioritisation** |  |  |
| Reachability / exploitability prioritisation | - | ✓ |
| **Deployment** |  |  |
| Hosting | Self-hosted only | Cloud only |
| **Integration** |  |  |
| First-class CI / pipeline integration | ✓ | ✓ |
| In-editor / IDE scanning | - | ✓ |
| **Licensing** |  |  |
| OSS engine available | ✓ | - |

*Source: vioscaleAI. Generated 2026-10-24T16:04:26.733Z. "-" = undocumented, not absent.*