For many years, security professionals knew the Zed Attack Proxy as OWASP ZAP or OWASP Zed Attack Proxy. Today, its official name is simply ZAP, while ZAP by Checkmarx is also used to reflect its current sponsorship.
The change is more than a rebranding exercise. It represents the evolution of ZAP from a small open-source proxy project into one of the most widely used web application security testing platforms.
The beginning: From Paros Proxy to ZAP
ZAP’s story began with Paros Proxy, an open-source Java-based web security proxy. Although Paros was useful, its development had slowed.
In 2009, security expert Simon Bennetts began modifying the Paros source code. His goal was to create a free, cross-platform and community-driven security tool that could be used by developers, testers and professional penetration testers.
The first public version, ZAP 1.0.0, was released on 6 September 2010.
From the beginning, ZAP focused on three important principles:
- Free and open-source security testing
- Easy adoption for beginners
- Advanced capabilities for experienced security professionals
Becoming OWASP ZAP
Soon after its first release, ZAP joined the Open Worldwide Application Security Project, better known as OWASP.
This began the OWASP ZAP era.
The association with OWASP gave ZAP international exposure through conferences, local chapters, training programmes and the wider application-security community. The tool quickly became one of OWASP’s best-known projects.
During this period, ZAP expanded far beyond its original proxy capabilities. It introduced:
- Active and passive vulnerability scanning
- Automated website crawling
- AJAX application crawling
- Fuzzing
- WebSocket testing
- Authentication and session handling
- APIs and scripting
- Add-ons and scan rules
- Contexts and testing scopes
The release of ZAP 2.0 was a major milestone. It introduced an add-on marketplace, a redesigned spider, AJAX crawling, WebSocket support and a simpler Quick Start interface.
These developments transformed ZAP from a basic interception proxy into a complete web application security testing platform.
ZAP enters the DevSecOps era
As DevOps and continuous delivery became more popular, security teams needed testing tools that could run automatically inside software pipelines.
ZAP responded by adding support for:
- Command-line execution
- Headless scanning
- Docker containers
- REST APIs
- CI/CD integration
- Automated security policies
- Reusable scanning plans
In 2021, ZAP introduced the Automation Framework. It allowed teams to define spiders, scans, authentication settings, reports and acceptance criteria in structured configuration files.
This made it easier to manage dynamic application security testing as code and run consistent scans across development, testing and production-like environments.
Why ZAP left OWASP
By 2023, ZAP had become a large and complex software project. Maintaining it required more funding, full-time engineers and long-term investment.
The ZAP team explained that although OWASP had helped the project gain visibility and community support, the project needed a more sustainable funding model.
In August 2023, ZAP announced that it was leaving OWASP.
From that point, the project stopped using the name OWASP ZAP and adopted the shorter name ZAP.
The change was mainly related to governance, ownership and funding. It was not caused by a disagreement over security practices or technical direction.
ZAP by Checkmarx
In September 2024, ZAP announced a major partnership with application-security company Checkmarx.
Checkmarx employed key ZAP project leaders and committed funding and engineering resources to support the tool’s future development.
The project subsequently began using the branding:
ZAP by Checkmarx
However, ZAP did not become a closed commercial product. It remains:
- Free and open source
- Licensed under Apache License 2.0
- Managed by the ZAP Core Team
- Open to community contributions
- Available for both manual and automated security testing
Checkmarx supports the project, but ZAP continues to operate as an independent open-source initiative.
Recent ZAP developments
ZAP continues to evolve for modern applications and security workflows.
Recent developments include:
- A modernised networking architecture
- Better support for JavaScript-heavy applications
- The Client Spider for browser-based crawling
- Improved CI/CD and GitHub Actions integration
- Reduced duplicate vulnerability alerts
- OWASP Penetration Testing Kit integration
- Early Model Context Protocol integration for AI-assisted workflows
As of July 2026, ZAP 2.17.0 is the latest stable core release. Development also continues through frequently updated add-ons and weekly builds.
Major milestones
| Year | Milestone |
|---|---|
| 2009 | Development begins from the Paros Proxy codebase |
| 2010 | ZAP 1.0.0 is released |
| 2010–2011 | ZAP becomes an OWASP project |
| 2013 | ZAP 2.0 introduces major scanning and extensibility features |
| 2021 | Automation Framework is introduced |
| 2022 | A modern networking layer replaces older inherited components |
| 2023 | ZAP leaves OWASP and drops OWASP from its name |
| 2024 | ZAP joins forces with Checkmarx |
| 2025 | ZAP 2.17.0 improves performance and alert quality |
| 2026 | Browser-native and AI-assisted integrations continue expanding |
What should we call it today?
For current documentation, articles, training materials and product references, use:
- ZAP
- Zed Attack Proxy
- ZAP by Checkmarx
The term OWASP ZAP should now be used only when referring to the project’s historical period under OWASP.
Conclusion
ZAP has travelled a remarkable path—from a fork of Paros Proxy to OWASP ZAP, and eventually to the independent project now known as ZAP by Checkmarx.
Its name and organisational structure have changed, but its mission remains the same: making powerful web application security testing accessible to developers, testers, DevSecOps teams and security professionals.
OWASP ZAP is its history. ZAP is its current and future identity.
Leave a Reply
You must be logged in to post a comment.