AgentDAST / Guides
On this page
AgentDAST vs OWASP ZAP: hosted agent or DIY scanner?
By Tornike@realtornikeo
ZAP, formerly known as OWASP ZAP and now presented as ZAP by Checkmarx, is the default free dynamic scanner. Its site calls it the most widely used web app scanner, free and open source. AgentDAST also does dynamic testing with a free start. Pick who runs the scanner: you, or a hosted agent your coding agent calls through an API.
| Dimension | ZAP | AgentDAST |
|---|---|---|
| Price | Free and open source; you pay to run it | 100 assessments free per month; then US$19 per 100 |
| Hosting | Your machine, Docker, or your CI | Hosted, in an isolated container per run |
| Targets | Local, internal, staging, and public targets you route to it | Public HTTPS sites you prove you control |
| Automation | Packaged scans, GitHub Actions, Automation Framework, API | REST and MCP, signed webhooks, idempotent run creation |
| Browser work | Proxy your own browser traffic through it | No browser; HTTP requests only |
| Control | Rules, add-ons, and scan policy are yours to tune | Time and request budget; scope is enforced for you |
| Findings | Rule-based alerts you triage yourself | Exact flag captures confirmed; observations need review |
Choose ZAP if
- You test localhost, internal, or pre-release targets. AgentDAST only accepts public HTTPS origins on port 443.
- You want a manual intercepting proxy and browser-driven exploration, with add-ons from its marketplace.
- You have time to tune rules, manage authentication scripts, and triage alerts. ZAP documents its automation options at zaproxy.org/docs/automate.
- Open source and self-hosting are hard requirements.
Choose AgentDAST if
- You have a deployed site and no scanner infrastructure. Prove ownership, set a budget, and start a run.
- Your coding agent should operate the loop. It can create a workspace with one HTTP call, then verify, test, read evidence, fix, and retest through REST or MCP. No browser signup is needed.
- You want scope enforced outside the tester: verified host plus declared backend hosts, request and time budgets, and private addresses blocked.
- You want a sharp verdict on one private boundary. Plant a synthetic capture flag. Only an exact capture is auto-confirmed.
Setup, step by step
A useful ZAP automation job means running the packaged scans or the Automation Framework in your own environment, defining the target context and authentication, then reviewing alerts and tuning rules as the app changes. The software is free. The operator time is the cost, and it repeats whenever login flows move.
An AgentDAST run means one workspace call, publishing the ownership proof, verifying the target, and starting a run with a time and request budget. The full sequence is in our security API guide. AgentDAST hosts the run and sets rule policy for you. Some teams want that. Other teams self-host ZAP for the control.
Using both is reasonable
Run ZAP packaged scans in CI against staging, where self-hosting and internal access help. Run AgentDAST against the public deployment after release, where ownership proof and a stranger view help. They test the same class of problem at different points, so agreement between them is useful signal.
Shared limits
Source review, dependency scanning, and a full manual penetration test stay separate jobs. AgentDAST adds its own limits: no browser, 15 minutes and 250 requests per free run, one active run per workspace, and requests that can change application state. Use a test environment where you can. A clean result from either tool is not a security certification. Compare the fit with our SAST vs DAST guide.
Prices checked on 4 November 2026.
100 free assessments per month. No card required. Get a free API key.