---
title: "Zed Attack Proxy"
date: "2026-05-26T10:56:10+00:00"
url: "https://checkmarx.com/product/zap/"
description: "ZAP (Zed Attack Proxy) is the world's most widely used open-source DAST tool. Learn what ZAP does and how Checkmarx supports it."
---

# Zed Attack Proxy

  By Checkmarx

# Zed Attack Proxy (ZAP)

Explore the power of ZAP — the world’s leading open-source web application security scanner, designed to make security testing easy and efficient for developers, testers, and security professionals.

 [Get it now](https://zaproxy.org/download/) [Learn More](#learn)

## Created by the leader in enterprise cloud-native application security

Vorpal provides instant code feedback, giving organizations full transparency and helping developers quickly detect, understand, and resolve code security issues, leading to more secure software.

 5.7M

Times ZAP was started

September 2024

 16.9M

Active Scans against Selected Target

September 2024

 1.4B

Alerts Found

September 2024

 4.3B

Active Scan Messages Sent

September 2024

## With Zap by Checkmarx, You’re Using the Best

Check out the world’s most popular open-source web application scanner. Start using it now.

 [Download Now](#)

 ![Gartner Logo - CTA Awards](https://checkmarx.com/wp-content/uploads/2026/06/Gartner-Logo-CTA-Awards.svg) A Gartner® Magic Quadrant Leader™

 ![Forrester](https://checkmarx.com/wp-content/uploads/2026/06/Forrester.svg) A Forrester Wave Leader™

 ![SOC2 Logo](https://checkmarx.com/wp-content/uploads/2026/06/SOC2-Logo.svg) SOC 2 Type II Certified

### Powerful Secrets Detection

2MS accurately identifies 170+ different types of secrets (login credentials, access tokens, encryption keys, API keys, SSH keys, webhook URLs, etc.) in code repositories (Git repos and local directories), collaboration tools (Slack and Discord), and CMS Platforms (Confluence and Paligo).

 ![2ms-1](https://checkmarx.com/wp-content/uploads/2026/05/2ms-1.webp)

### Automatic Secret Validation

To help prioritize remediation efforts, 2MS automatically attempts to determine which discovered secrets are still valid and operative.

 ![2ms-2](https://checkmarx.com/wp-content/uploads/2026/05/2ms-2.webp)

### Rule Customization

Detection rules can be customized or added using RegEx expressions, and existing rules can be flagged to be ignored.

 ![2ms-3](https://checkmarx.com/wp-content/uploads/2026/05/2ms-3.webp)

### CI/CD Integrations

Secret detection can be automated as part of workflows via integration with GitHub Actions and Azure Pipelines.

 ![2ms-4](https://checkmarx.com/wp-content/uploads/2026/05/2ms-4.webp)

What Our Customers Say

## Stories from enterprise security leaders

 ![](https://checkmarx.com/wp-content/uploads/2026/05/BestBuyLogoReversedRGB.svg)

> “We’ve seen an 80% noise reduction — our engineers now focus on the high-quality risks that matter.”

 [ Explore Best Buy Case Study    ](https://checkmarx.com/resources/best-buy/)

 ![](https://checkmarx.com/wp-content/uploads/2025/09/Checkmarx-Best-Buy-Testimonial-V2.webp)

 ## With Zap by Checkmarx, You’re Using the Best

Check out the world’s most popular open-source web application scanner. Start using it now.

 [Download Now](https://zaproxy.org/download/)

 ![Gartner Logo - CTA Awards](https://checkmarx.com/wp-content/uploads/2026/06/Gartner-Logo-CTA-Awards.svg) A Gartner® Magic Quadrant Leader™

 ![Forrester](https://checkmarx.com/wp-content/uploads/2026/06/Forrester.svg) A Forrester Wave Leader™

 ![SOC2 Logo](https://checkmarx.com/wp-content/uploads/2026/06/SOC2-Logo.svg) SOC 2 Type II Certified