Sekona is a Swiss product security, software security and EU Cyber Resiliance Act specialist, and ZAP is an important part of our day-to-day work. In our assessments we use ZAP to analyze the data flows of our clients’ applications and to test their APIs. We use the results in threat modeling and risk assessment sessions and to prepare further analysis. We run ZAP both manually and in automated pipelines. We also use it to check how authentication, session handling and input validation behave. Because ZAP is open source and scriptable, our clients keep full control over their scans after the handover. For these reasons, we recommend ZAP as a default tool for testing in any testing pipeline.