Vooki Pro is a commercial desktop DAST scanner with local AI-assisted triage and compliance-mapped reporting. ZAP — formerly "OWASP ZAP" — announced it was leaving the OWASP Foundation on 1 August 2023 to join the Linux Foundation's Software Security Project, with the move completing that September. On 24 September 2024, three members of ZAP's Core Team (Simon Bennetts, Rick Mitchell, Ricardo Pereira) became Checkmarx employees — this was not an acquisition of the ZAP project, which remains independently governed; the "ZAP by Checkmarx" name reflects the Core Team's employer, not ownership. ZAP is a genuinely capable, free, open-source scanner with a large add-on ecosystem. This page compares it against Vooki Pro fairly, distinguishing what ZAP includes by default from what requires an add-on.
Vooki Pro's six authentication methods and its login-via-recording option are built into the scan wizard. ZAP configures form login with Contexts and Users, and its Authentication Helper add-on adds scriptless browser-based login steps (including TOTP) and OAuth2 client-credentials and password grants; scripts remain ZAP's fallback for flows those methods can't handle.
Vooki Pro ships reports for seven compliance and security-reference mappings out of the box; no official compliance-framework report template was found in ZAP's documentation.
Every Vooki Pro license includes direct support from the Vooki Pro team through the support portal and support@vookify.com. ZAP is supported by its community: questions go to the ZAP User Group, where ZAP developers and experienced users answer them.
| Capability | Vooki Pro | ZAP (by Checkmarx) |
|---|---|---|
| Deployment | Desktop (macOS, Windows, Linux) | Desktop (Java-based), CLI, or Docker — free, no official hosted/cloud version |
| License cost | Annual license per domain, no seat limits — see pricing | Free, open source (Apache v2) |
| Guided automated scan | Included — 6-step wizard | Included — bundled "Automated Scan" (Quick Start) |
| REST API scanning (OpenAPI/Swagger) | Included | Separate Marketplace add-on (OpenAPI Support), not bundled in the base install |
| Authenticated scanning — form-based | Included — wizard step | Included — Context + Users + logged-in indicator, configurable via UI or API without scripting |
| Authenticated scanning — token/OAuth2/multi-step | Included — wizard step (Bearer, API Key, Cookie, OAuth2 Client Credentials), plus login via a recorded browser session for SSO and MFA | Authentication Helper add-on: browser-based login across one or more pages with declared steps (clicks, custom fields, TOTP), and OAuth2 client-credentials and password grants (early release, October 2026), configured without scripts. Scripts remain the fallback for other flows |
| CI/CD automation | Included — vooki-pro-cli | Included — Automation Framework (automation.yaml, exit-code gating), official Docker images |
| Automated retest | Included — re-runs the originating detector automatically | Included — official Retest add-on (fixed "Medium" strength regardless of the original scan's settings) |
| Compliance-mapped reports | Included — seven compliance and security-reference mappings | No framework-mapped compliance report. Report templates cover HTML, JSON, SARIF, XML, Markdown and PDF, and alerts carry OWASP Top 10 2021 and WSTG v4.2 tags |
| Report formats | HTML, PDF, DOCX, JSON, SARIF (CLI) | HTML, JSON (incl. SARIF), XML, Markdown, PDF — via the Report Generation add-on |
| AI-assisted triage | Included — local, offline (ThreatLens) | Optional LLM Support add-on (2026), available through the ZAP Marketplace and still labelled alpha in the current listing; not part of the default install: AI-assisted alert review, LLM-assisted OpenAPI import, LLM chat, and MCP tool use (with the MCP add-on). Requires installing the add-on and configuring a provider — a local Ollama model (no API key needed) or a remote one such as Azure OpenAI, Claude, Gemini or an OpenAI-compatible endpoint |
| Support model | Direct support from the Vooki Pro team (support portal + email), included with every license | Community support through the ZAP User Group; GitHub issues for bugs and feature requests |
ZAP capabilities are described from ZAP's public documentation as of 23 October 2026.
ZAP's automation, API scanning, reporting and retest capabilities are all real, officially documented, and well-maintained — they're distributed as Marketplace add-ons rather than bundled into the minimal install. A team willing to assemble and maintain that add-on stack can cover much of the same ground as Vooki Pro's built-in equivalents. The practical difference is who owns the assembly and maintenance work, not whether the capability exists.
ZAP's FAQ confirms form-based authentication — Context, Users, a regex-based logged-in/out indicator — is configurable through the UI or API without writing a script. Its Authentication Helper add-on goes further: browser-based authentication detects login fields across one or more pages and accepts declared steps such as clicks, custom fields and TOTP codes, and an OAuth2 method (an early release in October 2026) handles the client-credentials and password grants; the interactive authorization-code grant is not yet supported. Scripts, typically HTTP Sender scripts, remain ZAP's fallback for anything else. Vooki Pro's six built-in auth methods, including OAuth2 Client Credentials, are configured as one wizard step, and its login-via-recording option reuses a browser session you logged into yourself — the recommended route for SSO and MFA.
ZAP's Report Generation add-on produces HTML, JSON, SARIF, XML, Markdown and PDF reports, and its alerts carry OWASP Top 10 2021 and WSTG v4.2 tags — useful for filtering and for code-scanning integrations. None of its report templates reorganises findings control by control against a compliance framework. Vooki Pro generates reports for seven compliance and security-reference mappings (OWASP Top 10 2021, PCI DSS v4, NIST SP 800-53 Rev. 5, ISO/IEC 27001:2013 (legacy), HIPAA, GDPR, SOC 2 — 2017 TSC, selected controls) directly from scan results. A framework-mapped report is evidence of testing, not a compliance certification — your assessor decides what it means for your programme.
ZAP's AI support arrived in 2026 as the optional LLM Support add-on, available through the Marketplace but still labelled alpha in the current listing. Once you install it from the Marketplace and add a provider and model under Options → LLM, it enables a right-click "Review using LLM/AI" alert review (the LLM reassesses an alert's confidence and the alert is tagged AI-Reviewed), an LLM/AI OpenAPI Importer that turns a definition into requests in ZAP's history, an LLM chat panel, and — with the MCP add-on — LLM use of ZAP's own tools. Where that AI runs depends on the provider you choose: a local Ollama model keeps prompts on your own hardware, while Azure OpenAI, Claude, Gemini or another remote provider receives them over the network. ZAP sends untrusted providers only minimal data (remote providers default to untrusted; local ones such as Ollama default to trusted). ThreatLens, by contrast, is built into Vooki Pro's scan workflow and runs on-device with no add-on or provider to configure.
Desktop app. Scan data is stored locally by default and is not automatically uploaded to Vookify; selected finding details and HTTP evidence leave your machine only through integrations you configure (ticketing, Slack or a webhook) or in reports you export. AI runs on-device after a one-time ~5GB model download, and scanning needs no internet beyond the target. The license re-validates roughly daily while online (about a week of offline tolerance between checks); license checks and the model download are separate network requests, and neither sends scan data. Annual per-domain license with no seat limits (see pricing). Trial requests are reviewed by Vooki Pro's team before the license and installation instructions are issued.
Desktop, CLI, or Docker — runs locally or in your own CI infrastructure; no official hosted ZAP scanning service. Free and open source under Apache v2. Checkmarx separately sells its own commercial DAST product built on ZAP technology — a distinct commercial offering, not a paid-support tier for open-source ZAP itself.
You want compliance-ready reporting, a guided setup, and local AI triage without assembling and maintaining your own add-on stack, and a license-tied support channel matters to your team.
Budget is the primary constraint, your team is comfortable configuring Contexts/sessions and maintaining add-ons, and you want the flexibility of an open-source tool you can extend and script freely — ZAP's scripting model is also a strength for teams with unusual auth flows that off-the-shelf wizards don't anticipate.
More answers are in the documentation · or contact us
ZAP — joining the Software Security Project
ZAP Ownership
Checkmarx press release
Businesswire, 24 Sept 2024
ZAP FAQ — automatic form auth
ZAP — Handling Authentication Yourself
ZAP 2.14.0 release notes
ZAP — Authentication Helper add-on
ZAP — Browser Based Authentication
ZAP — OAuth2 Authentication
ZAP blog — OAuth2 support, 8 Oct 2026
ZAP — Report Generation add-on
ZAP — alert tags (OWASP Top 10 2021, WSTG)
ZAP FAQ — where to ask ZAP questions
ZAP — LLM Support add-on
ZAP — LLM Support options (providers, Ollama, trust)
ZAP — Alert Filter LLM Support (alert review)
ZAP — OpenAPI LLM Support (LLM-assisted import)
ZAP blog — LLM Support, 7 Aug 2026
ZAP — add-on listing (LLM Support status: alpha)
Vooki Pro documentation: Auth Profiles · Reports & Compliance · CLI & CI/CD · Integrations
Last reviewed 23 October 2026.
Submit a request for 7 days of full access — no credit card required.