OWASP ZAP, now identified as ZAP or ZAP by Checkmarx, is a free, open-source web application scanner and proxy for security testing.
Alternatives to ProxyMesh
Beagle Security is an agentic AI penetration testing platform for web applications, APIs, and GraphQL.
Detectify Surface Monitoring continuously monitors internet-facing subdomains for exposed files, vulnerabilities, and misconfigurations.
- 4

ImmuniWeb
ImmuniWeb is a cybersecurity platform for testing and protecting web and mobile applications, APIs, microservices, and cloud and network infrastructure.
AndroidiOSWebAPI6.8From €49.58 a month - 5

Nuclei
Nuclei is a free, open-source vulnerability scanner for applications, infrastructure, cloud platforms, and networks.
Free planLinuxmacOSSelf-hostedWindows6.8Free plan - 6
Qualys External Attack Surface Management
Qualys External Attack Surface Management (EASM) gives organizations an outside-in view of internet-facing infrastructure and continuously monitors connected assets.
Free planWebAPILinux6.8Free plan - 7
ZeroThreat
ZeroThreat is an AI-powered penetration-testing platform for web applications and APIs, available through web and API access.
Free planWebAPI6.7From $100 a month - 8
VAddy
VAddy is a cloud service for automated black-box security testing of web applications.
WebAPILinuxmacOS6.6From ¥19,800 a month - 9
Pentest-Tools.com API Scanner
Pentest-Tools.com API Scanner is a cloud tool for assessing APIs and detecting vulnerabilities such as SQL injection, SSRF, local file inclusion,…
WebAPILinuxmacOS6.5From $95 a month - 10

Astra Security
Astra Security describes its product as a continuous penetration testing platform for web applications, APIs, and cloud infrastructure.
WebAPI6.4From $58.25 a month - 11

Burp Suite DAST
Burp Suite DAST is an automated dynamic web vulnerability scanner built on the scanning engine used in Burp Suite Professional.
WebAPILinuxSelf-hosted6.4 - 12

Invicti
Invicti is an application security platform for finding, prioritizing, and fixing application risk.
WebAPISelf-hosted6.3$500, paid once - 13
MaxPatrol SIEM
MaxPatrol SIEM helps security teams see activity across IT infrastructure and detect incidents.
WebLinuxSelf-hostedWindows6.2 - 14
Wapiti
Wapiti is a free Python tool for scanning deployed websites and web applications for vulnerabilities.
Free planAPILinuxmacOSSelf-hosted6.2Free plan - 15

Blacklock
Blacklock is a cloud Penetration Testing as a Service platform available through a web interface, API, and browser extension.
WebAPIExtension6.1From $85 a month - 16

BlueClosure BC Detect
BlueClosure BC Detect is a paid JavaScript security platform presented for IT security professionals.
5.9From £60 a month - 17

Haxore Web Security Scanner
WebExtension5.9From $49 a month - 18
Holm Security Cloud Security
Holm Security Cloud Security is a cloud security posture management product that identifies vulnerabilities across cloud-native platforms and helps teams remediate them.
WebAPI5.9 - 19
BreachLock DAST
BreachLock DAST checks running applications from the outside by sending inputs and analyzing their responses.
WebAPIExtension5.8From $416.67 a month - 20
AppCheck
AppCheck automates security-flaw discovery across websites, applications, networks, and cloud infrastructure.
WebAPISelf-hosted5.6 - 21
HCL AppScan Source
HCL AppScan Source is a static application security testing tool that analyzes source code for vulnerabilities early in the development lifecycle.
LinuxSelf-hostedWindows5.6 - 22
Vega
Vega is a free, Java-based graphical platform for testing web application security.
LinuxmacOSWindows5.6 - 23

Escape
Escape is an offensive security platform that brings together attack surface management, business-logic-aware dynamic application security testing…
WebAPI5.5 - 24

Tenable One Web App Scanning
Tenable One Web App Scanning is a web application scanning product from Tenable, a company founded in 2002 and headquartered in Columbia, Maryland, United States.
Web5.5From $298.17 a month - 25

Rapid7 InsightAppSec
WebWindows5.4From $175 a month - 26
5.4 - 27
OpenText Fortify DAST
OpenText Fortify DAST is a paid application security testing product for Linux and web platforms.
WebLinux4.9 - 28

FortiDAST
Web4.7

