Free for Open Source Application Security Tools on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.

Acceptance testing tools are used to validate the functionality of web applications. Some follow a scripted approach and typically make use of a Unit Testing framework to construct test suites and test cases.

Vulnerability Scanning Tools on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.

March 4, 2026 - ZAP (Zed Attack Proxy, also known as OWASP ZAP) is a popular free security tool designed to help identify security vulnerabilities in web applications. Actively maintained by an international team of volunteers, ZAP is widely used by developers, functional testers, and experienced penetration ...

These scans test websites and web apps for OWASP Top 10 risks and more. ZAP is the industry-standard open-source dynamic application security testing tool trusted by security teams worldwide, covering SQL injection, XSS, and dozens of other vulnerability classes.

2 weeks ago - Primary use cases: remediating vulnerable dependencies before deployment, enforcing compliance with OWASP Top 10 A06:2021 (Vulnerable and Outdated Components), and generating SBOMs for compliance reporting. It does not analyze proprietary code logic, runtime behavior, or cloud infrastructure configuration. Retire.js is an open-source SCA tool focused specifically on JavaScript components.

9 hours ago - AI-powered Docker security scanner that explains vulnerabilities in plain English. An OWASP Lab Project.

In 2026, the security tooling ecosystem spans dynamic analysis tools (DAST), static scanners (SAST), interactive testing (IAST), automated penetration testing engines, and full-fledged offensive security platforms.

May 14, 2026 - TLDR; Most teams prioritize infrastructure and cloud security, but 82% of known vulnerabilities actually originate in the application layer, making AppSec tools essential to use early in the pipeline. Legacy scanners flood teams with alerts, and most of it is noise that buries real risk.

June 1, 2026 - ... Snyk has become one of the best-known companies in the application security space, which can be both an advantage and a disadvantage. Tools necessary for OWASP scanning, such as SCA, SAST, and DAST are all available from Snyk and well-regarded ...

Source code analysis tools, also known as Static Application Security Testing (SAST) Tools, can help analyze source code or compiled versions of code to help find security flaws.

The OWASP MASTG includes many tools to assist you in executing test cases, allowing you to perform static analysis, dynamic analysis, network interception, etc. These tools are intended to help you perform your own assessments, rather than provide a conclusive result on the security status ...

OWASP Nettacker is an open-source, Python-based automated penetration testing and information-gathering framework designed to help cyber security professionals and ethical hackers perform reconnaissance, vulnerability assessments, and network ...

Dependency-Check is a Software Composition Analysis (SCA) tool that attempts to detect publicly disclosed vulnerabilities contained within a project’s dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. The OWASP ...

| | | | AppSentinels platform helps developers build secure API's as well as helps security teams in protecting their Applications from OWASP and OWASP API attacks. Delivered from cloud as well as on-prem. Highly scalable architecture . Contact at [email protected] ... | | | | Note: Contrast performs vulnerability detection and runtime protection of APIs using an instrumentation-based approach ... | | | | Note: Command line tool that runs HTTP requests defined in a simple plain text format.

April 28, 2026 - Utilizing vulnerability assessment tools including Checkmarx, Burp, Invicti, SOAP UI, and penetration testing techniques for exploring, corelating & crafting successful exploits as part of the correlational effort pertaining to source code and ...

November 12, 2013 - Helping organizations to better understand and improve their management of cybersecurity risk

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely