ZAP found the bugs. Then came the bills.

In 2009, Simon Bennetts went to check on the penetration testers. He led a Java development team building an online service for an accounting software company. Security had been considered. Specialists had been hired. A reassuring report seemed a reasonable expectation. An hour into the exercise, a tester was already in the administration console, logged in as Bennetts.

The weakness was in the company’s single sign-on system. The lesson travelled further: a developer could take security seriously and still misunderstand the system around his code. Bennetts began learning through OWASP guides and hands-on experiments. He wanted something he could use both to investigate an application and to test it repeatedly.

01 / ORIGINAn hour was enough

Bennetts started modifying Paros Proxy, a Java tool that came close to what he needed. Colleagues learning about web security wanted a recommendation. His requirements were sensible: free, open source, cross-platform, with the basics covered and a community around it. His modified copy was the nearest fit.

So he forked it. Better documentation was an early contribution, a revealing choice for a tool meant to help people learn. Some changes were written on train journeys between Manchester and Newcastle. He released ZAP in 2010. Even the name was improvised: the cartoon-like word came first; “Zed Attack Proxy” followed.

02 / THE TOOLA seat between browser and server

ZAP sits between a browser and an application, making their conversation inspectable. A tester can examine requests, alter them and study the replies. Passive scanning analyses traffic; active scanning sends test requests to look for vulnerabilities. Crawlers discover the parts of an application that those checks can reach.

This is dynamic application security testing, or DAST: examining running software. It complements tools that inspect source code. ZAP offers a desktop interface for exploration and automation options for repeated checks. Add-ons expand its capabilities, including API testing, reporting and scripting. A developer and a penetration tester can use the same engine at different depths.

Its Automation Framework turns a sequence of jobs into a reusable plan: establish the environment, explore, scan and report. Docker images make it possible to run that work near the application, including inside private infrastructure. That matters when a service is not exposed to the public internet, or when a team wants checks to run alongside deployment rather than in a separate calendar appointment.

There are practical alternatives, including Burp Suite and commercial DAST platforms. ZAP’s appeal is its combination of an Apache-licensed engine, extensibility and automation without a software licence bill. Teams can adapt it themselves. They also inherit the work of configuring it and deciding what to do with the results.

03 / THE ECONOMICSThe invoice nobody owned

A free scanner has running costs on both sides of the download. Users supply computing resources and engineering time. Maintainers need time to fix bugs, review contributions and keep pace with browsers. Popularity does not automatically buy any of that.

By 2024, ZAP’s funding was precarious. Expected funding associated with a planned Linux Foundation move had been withdrawn. Donations had not covered the work. Crash Override’s fellowship gave two maintainers time to continue. The team launched professional services through ZAProxy Ltd and considered changing the licence to encourage commercial users to contribute.

September brought a different arrangement. Checkmarx would employ Bennetts and fellow project leaders Ricardo Pereira and Rick Mitchell to work on ZAP and its commercial DAST product. ZAP kept its Apache licence and core-team control. The company gained experienced maintainers; the project gained paid working time and better access to enterprise problems.

“To make the online world that little bit safer.”ZAP mission statement

That business model helps explain its place in the market. ZAP is a tool people use directly and an engine companies build around. Jit’s published account describes using it in its platform and on its own stack. Commercial wrappers can sell orchestration and service while the underlying scanner remains available to everyone.

04 / COVERAGEFirst, get through the front door

Much of the difficult work happens before an attack request. Can the scanner log in? Stay logged in? Find a button rendered by JavaScript? ZAP spent much of 2025 improving authentication. In July 2026, the team recommended its Client Spider over the older AJAX Spider for modern applications, using browser events to maintain a map of what it discovers.

The October 2026 Browser Extension update makes recorded workflows easier to examine. Its Script Viewer lets users see, edit and replay supported Zest statements in the browser. A recorded login can be checked before it becomes part of a scan. Conditional statements and loops remain outside this viewer’s supported script types.

Scale makes the distinction important. A scanner started millions of times can still miss a protected workflow. Execution counts describe activity. Coverage depends on what each execution actually sees.

05 / PUT IT TO WORKCopy the habit

Mozilla’s 2021 account offers a useful example: daily baseline scans across 241 sites, alongside pipeline checks and deeper investigations. Motorola Solutions described reusable pipeline jobs and shared authentication scripts. Both examples suggest the same adoption principle: make the next scan easier to run than the first.

Start with an application you are authorised to test. Establish a baseline, inspect the findings and confirm that authenticated pages are reached. ZAP’s packaged baseline scan crawls and performs passive checks; active testing is a separate decision. Save a repeatable plan, agree which findings deserve attention and rerun it as the application changes.

Keep a person in that loop. ZAP’s own testing guide calls for manual investigation beyond automated checks. An unreachable page, an expired session or a business rule that needs human judgment can defeat a tidy report. Bennetts began with misplaced confidence in software he understood. His tool is useful precisely because it gives people another way to question theirs.