What each one is
ZAP (Zed Attack Proxy) is the most widely used free, open-source dynamic security testing tool in the world. It was born inside OWASP, and although many people still call it "OWASP ZAP", since 2023 it is no longer a project of that organization: since September 2024 it is called ZAP by Checkmarx, because Checkmarx hired its core team and funds development. It remains free, open source and regularly maintained (version 2.17 shipped in December 2025). It is a desktop application, also available as a Docker image, that sits between your browser and the site under test, crawls its pages and launches controlled attacks to find vulnerabilities.
Scanaris is a web service: you paste the URL of your published site and about thirty seconds later it returns 47 checks across eight pillars, read-only, ranked by impact and with a fix prompt for every finding. Nothing to install, nothing to configure, and it attacks nothing.
Passive versus active: the difference that matters
Scanaris only makes normal requests, the kind a browser would make, and examines what your site answers: headers, cookies, certificate, reachable files, the JavaScript you serve, the robots.txt. It never sends manipulated data or tries to trigger a failure. That is why it can run against a production site at any hour without risk.
ZAP has two modes. The passive scan watches traffic without altering it, similar to what Scanaris does, and detects missing headers, cookies without attributes or leaked information. The active scan is something else: it sends thousands of requests with payloads designed to trigger SQL injection, cross-site scripting, file inclusion and dozens of other flaws. That mode can fill in forms, create records, send emails from your site or bring down a small server. It should only be used on sites you own, preferably in a staging environment, and with explicit permission.
How each one is used
With ZAP you install the application (it needs Java) or start its container, define a context with the target URL, configure authentication if you want to test the private areas, run the spider and then the active scan, which takes minutes to hours depending on the size of the site. When it finishes you have a list of alerts by risk level that must be reviewed one by one, because some will be false positives. To wire it into deployment there are GitHub Actions and a YAML automation framework; ZAP's "baseline scan" is passive and fast, and it is what most people run in continuous integration.
With Scanaris you paste the URL. The report ranks findings by impact, explains each one in plain language and gives a prompt ready for Cursor, Claude or your AI editor. On the Pro plan it rescans daily, warns about downtime and certificates about to expire, and the API and MCP server let you trigger scans from your own flow. It comes in eight languages; ZAP is in English with partial community translations.
What one finds and the other does not
- Only ZAP: SQL injection, reflected or stored cross-site scripting, file inclusion, open redirects, flaws in the authentication logic of private areas, problems in REST, GraphQL or SOAP APIs from their definition. Everything that requires attacking to be confirmed.
- Only Scanaris: SEO and AI visibility (robots, sitemap, metadata, structured data, llms.txt, AI crawlers), email (SPF, DKIM, DMARC), domain health, Safe Browsing reputation, basic accessibility, legal compliance signals. And above all the fix: ZAP describes the problem generically; Scanaris hands you the prompt.
- Both: missing or weak security headers, cookies without attributes, exposed files and directories, leaked server versions, TLS. Here ZAP is more exhaustive and Scanaris more readable.
Pricing (October 2026)
ZAP costs no money. It costs time: installing, configuring authentication, waiting for the scan, discarding false positives and interpreting every alert. For someone who knows, it is a bargain; for someone who does not, it is a whole afternoon and a report they do not know where to start with.
Scanaris has a free scan with two or three findings unlocked, and plans at 24, 49 and 99 euros a month (17, 34 and 69 if you pay yearly) for 1, 5 and 25 projects, with the full report, the prompts, monitoring and the API.
When to use both
They are complementary and that is how many teams use them: Scanaris every day on the published site, because it is safe, fast and tells you what to fix first; ZAP's "baseline scan" in continuous integration if you have a pipeline; and a full ZAP active scan, in a staging environment or in the hands of a professional, before a major launch or when you handle sensitive data. If you built your app with Lovable, Bolt or v0 and want to know today whether anything serious is wrong, start with Scanaris and the pre-launch security checklist; ZAP can come later.
Frequently asked questions
Can ZAP break my site?
The passive scan cannot. The active one can: it submits forms, creates test data and loads the server. Run it on a copy or outside business hours, and never on a site that is not yours.
Does Scanaris attack my site?
No. It only reads what your site already shows any visitor, with rate-limited requests. That is why it does not find injections: it does not test for them.
Is ZAP still free after moving to Checkmarx?
Yes. It remains open source under the Apache 2.0 license, and Checkmarx sells its own commercial dynamic testing product separately. What changed is the name and who pays the developers.