Shipvane · 4 AE roles
Marco E. · joined Cargolio
Fleetora · first roles in DECompanies using OWASP ZAP_
As of 4 November 2026, 312 companies name OWASP ZAP in their own job postings; it leaves no trace on websites or in DNS.
As of 4 November 2026 · refreshed daily · counts move as websites, DNS and career sites are re-read.
- Largest market
- –
- Companies with 51+ staff
- –
- Top industry
- –
- Team that names it most
- IT operations & business systems · 335 postings
- Hiring on it, last 30 days
- 238 companies
- Most often alongside
- Burp Suite · 296 companies
Where OWASP ZAP shows up
Each population is counted on its own. We never add them up without saying so, because they answer different questions.
Companies whose own pages load OWASP ZAP's scripts or embeds, or whose domain's mail and hosting records (SPF, DKIM, MX, CNAME) point at OWASP ZAP. From our crawl of 41.5M company websites and the DNS sweep behind it. Reach: the tool is in the building.
Companies whose own postings say the team works in OWASP ZAP. Read hourly from ~70 applicant tracking systems, with the function, a quote and a date. Intent: the team that runs it is hiring.
Companies in the footprint whose postings also name OWASP ZAP. The rest of the posting population (312) runs OWASP ZAP without a public trace on the site or in DNS, which is where job data earns its place.
Companies on OWASP ZAP
Companies with 51+ employees and at least medium-confidence evidence in their own postings; job boards and portals left out.
Filter by country, size, team and source, open verified e-mails for the decision makers, or push new matches to your CRM every week.
Free plan: 1,000 records, no card. The first 20 are above; e-mails are verified at the mail server when you open them.
Who runs OWASP ZAP inside the company
The 312 companies whose postings name OWASP ZAP: by country, size and the function of the role. The second number in the function table is companies.
| postings · companies | |
|---|---|
| IT operations & business systems | 335 · 237 |
| Software engineering | 208 · 137 |
| Engineering (non-software) | 16 · 8 |
| Data & AI | 11 · 6 |
| Quality, safety & environment | 11 · 10 |
| Legal, compliance & risk | 7 · 1 |
| construction and civil | 4 · 3 |
| Education & training | 4 · 4 |
| healthcare clinical | 4 · 1 |
| Business development & strategy | 3 · 1 |
| companies | share | |
|---|---|---|
| United States | 176 | 56% |
| United Kingdom | 19 | 6% |
| India | 18 | 6% |
| Germany | 11 | 4% |
| Canada | 8 | 3% |
| Australia | 7 | 2% |
| France | 7 | 2% |
| Brazil | 6 | 2% |
| Spain | 5 | 2% |
| Switzerland | 4 | 1% |
| MY | 4 | 1% |
| United Arab Emirates | 3 | 1% |
| companies | share | |
|---|---|---|
| Self-employed | 9 | 3% |
| 2-10 employees | 20 | 6% |
| 11-50 employees | 52 | 17% |
| 51-200 employees | 51 | 16% |
| 201-500 employees | 57 | 18% |
| 501-1000 employees | 26 | 8% |
| 1001-5000 employees | 44 | 14% |
| 5001-10000 employees | 16 | 5% |
| 10,001+ employees | 37 | 12% |
| postings | |
|---|---|
| Postings, last 30 days | 356 |
| Postings, last 90 days | 510 |
| All open postings | 665 |
238 companies opened a role that names OWASP ZAP in the last 30 days. A hiring team that names its tools is the moment to write to the person who owns the stack.
What OWASP ZAP teams also ask for
Tools named in the same postings as OWASP ZAP. Office software is left out.
OWASP ZAP against the rest of its category
Ranked by companies naming each tool in postings. Whole category →
Quote the sentence with the date and the link. The numbers change daily; the link always shows the current ones.
312 companies name OWASP ZAP in their own job postings; it leaves no trace on websites or in DNS, so the posting layer is the whole picture. (Breaknorm, 4 November 2026, https://breaknorm.co/tools/owasp-zap)
Read from the source, not self-reported
Every number on this page can be traced to a page we crawled or a posting we read. Full methodology →
- Website codeScripts, tags and embeds found on the company's own pages in our crawl of 41.5M sites. A tool counts once per company.
- DNS recordsSPF includes, DKIM selectors, MX and CNAME records of the company's domain that point at OWASP ZAP or another vendor. Swept in cycles; dedicated mail-provider and hosting facets open once coverage passes 80% per country.
- Job postingsRead hourly from the applicant tracking systems behind company career sites. A tool counts when the employer's own text names it as the team's system; candidate wish-lists and apply boilerplate are excluded. Confidence low, medium or high per company.
- Sending infrastructureCold-e-mail sending domains are look-alike domains on a provider's infrastructure (DNS records, certificate logs) that redirect to the company. Absence is not evidence: only companies with a found sending domain are counted.
- CompaniesCountry, size and industry come from the company profile we build from its website; headcount from LinkedIn where known, otherwise estimated. Job boards, portals and aggregators are kept out of lists.
OWASP ZAP data: questions
How many companies use OWASP ZAP?
312 as of 4 November 2026: 0 carry OWASP ZAP on their website or in their DNS records and 312 name it in their own job postings; 0 show up in both. We keep the two counts apart because they measure different things.
What does "website or DNS" mean?
Our crawler finds OWASP ZAP's scripts, embeds and tags on the company's own pages, and our DNS sweep reads the domain's mail and hosting records (SPF includes, DKIM selectors, MX, CNAMEs) that point at OWASP ZAP. Either one puts the company in the footprint. The sweep is still running, so this number grows week by week.
Why is the job-posting number so much smaller?
A posting only names a tool when the team that will use it is hiring and chooses to say so. That makes it a smaller but stronger signal: it tells you which team runs OWASP ZAP, with a quote and a date. The footprint tells you reach.
How fresh is this?
Career sites are read hourly, websites are re-crawled on a rolling schedule and DNS is re-swept in cycles. The date at the top is when these counts were computed.
Can I get the list?
Yes. The first 20 are on this page; the full 312 with verified e-mails and a weekly feed of new OWASP ZAP users is in the product. Counting is free.
Get this list your way
The same data as a search, over MCP and the API, as bulk files, or pushed to you as it changes.
Every company on OWASP ZAP,
with the person who owns it
Connect the MCP server or the API, filter on OWASP ZAP, and get 1,000 records free.