OWASP ZAP vs Veracode DAST

OWASP ZAP is a web application scanner and proxy for security testing. Its tools include active and passive scanning, a spider, alerts, and scan policies. ZAP’s Automation Framework uses YAML plans to coordinate jobs such as scanning, spidering, API imports, and report generation. It can import OpenAPI, GraphQL, SOAP, and Postman definitions through jobs or add-ons. GitHub Actions are available for baseline, full, and API scans via Docker-packaged scans, and the project publishes Docker images, including a minimal image for CI. Add-ons come from an online Marketplace and are generally installed or removed without restarting ZAP. The software is free and open source, with a free plan at free. It supports Linux, macOS, Windows, API use, and self-hosted deployment. Windows and Linux installers require Java 17 or later; the macOS installer includes Java 17. ZAP says it can support only its latest full release, and current releases are unsigned, though checksums are provided.

Veracode DAST scans live web applications and REST APIs for security vulnerabilities. It can test authenticated or unauthenticated assets, including applications behind firewalls, and inspect API endpoints and workflows to validate business logic. Scans can run automatically or on a schedule, with configurable depth, speed, and accuracy; the cloud-native engine is designed for hundreds of assets across environments. Veracode reports a false positive rate below 5%. CI/CD connections are available through webhooks or the Veracode CLI, and reports can be downloaded as PDF, JUnit, or CSV files. A Quick scan takes approximately three to five minutes and runs non-invasive checks for basic misconfigurations. API scans require an OpenAPI 2.0 or 3.0 specification in JSON or YAML; HAR files are not supported. A free 14-day trial is available through the Veracode Platform, while pricing is on request. The service is offered as SaaS with hybrid deployment options. Veracode reports SOC 2 Type II attestation and a FedRAMP Moderate Authority to Operate for its cloud-based application security platform.