ZAP (now ZAP by Checkmarx, still an independent open-source project maintained by the ZAP Dev Team under the Apache-2.0 licence) describes itself as the world’s most widely used web app scanner, and the description holds. It runs passive and active scans, spiders a site including an AJAX spider, ships packaged Docker scans (a baseline scan, a full scan and an API scan driven by an OpenAPI or GraphQL definition), has an automation framework for CI, a marketplace of community add-ons and a documented decision tree for authenticating to your application. It costs nothing and runs anywhere.
The honest comparison is about what happens after the scan. ZAP produces alerts with a risk and a confidence level that a security engineer then triages. Our scanner produces two classes of result: a confirmed finding, which carries the request, the response and a proof of concept in an evidence bundle, and an observation, which is labelled as unproven and never fails a gate. It also refuses to run an active test against a target you have not proven you own, and it sits next to the recorder, the API studio, load testing and accessibility audits that read the same recorded flow.
Choose OWASP ZAP if…
- You want a free, self-hosted scanner with full control and scripting, and you have a security engineer to triage its alerts.
- You want to scan an API from its OpenAPI or GraphQL definition in CI with no vendor involved.
- You rely on the ZAP add-on marketplace or on ZAP’s automation framework in an existing pipeline.
Choose Dokimore if…
- You need findings a reviewer or auditor can replay: the request, the response, a proof of concept and an integrity badge, not an alert to triage.
- You want every active test scoped by proven ownership and every exploitation decision in an audit log.
- You want security results next to UI, API, load and accessibility results from the same recorded flow, in one report and one subscription.
Capability by capability
| Capability | OWASP ZAP | Dokimore |
|---|---|---|
| Licence and cost | Apache-2.0, open source, free | Subscription; the Free plan includes 10 scans a month |
| Scanning | Passive and active scanning; spider and AJAX spider | DAST with more than sixty engines: OWASP Top 10 (2025) and the API Security Top 10 |
| Packaged scans | Baseline, full and API scans as Docker scripts | Scopes from recorded flows, API collections or hosts |
| Target control | You point it at any target you are allowed to test; no ownership check | Ownership proof required before any active test; exploitation needs a signed authorisation record |
| Result output | Alerts with a risk and a confidence level, for you to triage | Confirmed findings with an evidence bundle; observations labelled as unproven |
| Automation | Automation framework, Docker images, a ZAP API | CI gates by severity, a trigger API and a scheduler |
| Authentication | A documented decision tree and scripts | The credential vault and recorded sessions reuse your auth state |
| Beyond security | Not its job | Recorder, API, load, accessibility and visual testing on the same flow |
| Where it runs | Your machine, your CI, your Docker host | Our tenant in Mumbai, or on-premise on Enterprise |
Common questions
Is Dokimore a wrapper around ZAP?
No. The scanner uses its own engines and does not bundle ZAP. The two can run side by side; many teams keep ZAP in CI for a free baseline scan and use the platform for findings that need evidence, authorisation records and a place next to their other test results.
Can I import ZAP reports?
Not today. There is no ZAP report import, and we say so rather than imply one. Findings produced here export with their evidence bundles.
When is ZAP enough on its own?
One application, a security engineer who triages alerts, and no need to package evidence for an auditor or to share a flow with UI, load and accessibility testing. In that case ZAP is the right tool and it is free.