# Companies using OWASP ZAP

8,932 companies in our data use OWASP ZAP, and 2,994 of them name it in job posts they wrote. Its share of job posts held steady in the three months to August 2026; 2,375 job posts named it from October 2025 to August 2026. Software Development Engineer in Test is the role that names it most often.

Data as of November 9, 2026. Source: Sumble.

## Which companies name OWASP ZAP in the most job posts?

Deloitte leads with 109 job posts naming OWASP ZAP, followed by Money Forward, Inc. and 3Pillar. 3Pillar is the newest of the five companies in the table, with its first job post naming it in May 2024.

| Company | Job posts | People | Recent job post |
|---|---:|---:|---|
| [Deloitte](https://sumble.com/orgs/deloitte) | 109 | 94 | "Experience using common testing tools like Burp, OWASP ZAP, Metasploit, Postman, Swagger, NMAP, Qualys, SQLMap, others." (Penetration Tester (US Citizens Only), Nov 7, 2026) |
| [Money Forward, Inc.](https://sumble.com/orgs/money-forward) | 98 | 0 | "Security & Quality Automation: OWASP ZAP, Burp Suite, Sider (Brakeman), Snyk, VAddy, Dockle, Trivy, and various AI tooling" (Senior iOS Engineer, Nov 7, 2026) |
| [3Pillar](https://sumble.com/orgs/3pillar-global) | 80 | 1 | "Security testing practices – knowledge of OWASP vulnerabilities, experience with security testing tools (OWASP ZAP, Fortify)" (Senior QA Automation Engineer (Python \| Selenium \| Pytest), Jul 7, 2026) |
| [Accenture](https://sumble.com/orgs/accenture) | 72 | 94 | "SonarQube, Checkmarx, Snyk, OWASP ZAP or similar SAST/DAST and vulnerability scanning tools" (devsecops engineer manager, Nov 7, 2026) |
| [株式会社GA technologies / GA technologies Co., Ltd.](https://sumble.com/orgs/株式会社ga-technologies) | 65 | 0 | "脆弱性診断: OWASP ZAP、Burp Suite" (QA Engineer Manager Candidate (Japan's second fastest growing company with 100 billion yen in sales in 10 years..., Jan 12, 2026) |

## Is hiring for OWASP ZAP growing?

Demand for OWASP ZAP is steady: 1.3 in every 10,000 job posts from June to August 2026, close to the 1.2 of March to May. Its busiest month was November 2025, at 1.6.

| Month | Job posts naming it | All job posts | Per 10,000 job posts |
|---|---:|---:|---:|
| Oct 2025 | 172 | 1,413,673 | 1.2 |
| Nov 2025 | 290 | 1,822,119 | 1.6 |
| Dec 2025 | 151 | 1,236,103 | 1.2 |
| Jan 2026 | 200 | 1,828,002 | 1.1 |
| Feb 2026 | 216 | 1,856,647 | 1.2 |
| Mar 2026 | 202 | 1,850,711 | 1.1 |
| Apr 2026 | 223 | 1,728,886 | 1.3 |
| May 2026 | 219 | 1,821,509 | 1.2 |
| Jun 2026 | 206 | 1,909,496 | 1.1 |
| Jul 2026 | 267 | 1,815,180 | 1.5 |
| Aug 2026 | 229 | 1,835,698 | 1.2 |

## How many companies named OWASP ZAP in a job post for the first time in recent months?

From June to August 2026, 244 companies posted their first job naming OWASP ZAP; 202 did from March to May. The 244 from June to August are 8.1% of all 2,994 companies whose job posts name it.

| Period | Companies naming it in a job post for the first time |
|---|---:|
| March to May 2026 | 202 |
| June to August 2026 | 244 |
| October 2025 to August 2026 | 746 |

Companies whose first job post naming it appeared in that period. Recruiters, staffing firms and job boards are left out.

## How do we know which companies use OWASP ZAP?

Of the 8,932 companies here, 5,938 are known from what employees list on their profiles. 638 show up in both job posts and employees' profiles.

| How we know | Companies | Share |
|---|---:|---:|
| Job posts name OWASP ZAP | 2,994 | 34% |
| Employees' profiles list OWASP ZAP | 5,938 | 66% |

## What size are the companies that use OWASP ZAP?

45% of OWASP ZAP users are companies with 50 to 999 employees, the largest size group. 2,024 of its companies have fewer than 50 employees.

| Size | Share | Typical tech page |
|---|---:|---:|
| Under 50 employees | 23% | 22% |
| 50 to 999 | 45% | 38% |
| 1,000 to 5,000 | 17% | 17% |
| Over 5,000 | 15% | 23% |

## Where are OWASP ZAP companies based?

Beyond the United States (35%), OWASP ZAP is unusually common in India, at 14% of its companies. France is less common than usual, at 2.5% against 4.6% on the typical tech page.

| Country | Companies | Share | Typical tech page |
|---|---:|---:|---:|
| United States | 2,998 | 35% | 43% |
| India | 1,216 | 14% | 6.9% |
| United Kingdom | 558 | 6.5% | 6.4% |
| Canada | 291 | 3.4% | 3.6% |
| Brazil | 223 | 2.6% | 2.8% |
| France | 213 | 2.5% | 4.6% |

## Which teams work with OWASP ZAP?

Job posts most often place OWASP ZAP with cybersecurity, security and information security teams. Application security and engineering teams follow, at 28 companies each.

| Team | Companies |
|---|---:|
| Cybersecurity | 65 |
| Security | 53 |
| Information security | 39 |
| Application security | 28 |
| Engineering | 28 |
| Product security | 23 |

## Which roles mention OWASP ZAP most?

No single role dominates for OWASP ZAP; Software Development Engineer in Test leads with 19% of the job posts. Software Development Engineer in Test posts naming it numbered 111 from March to May 2026 and 111 from June to August.

| Role | Share | Oct 2025 to Aug 2026 | Mar to May 2026 | Jun to Aug 2026 |
|---|---:|---:|---:|---:|
| Software Development Engineer in Test | 19% | 449 | 111 | 111 |
| Security Engineer | 14% | 323 | 92 | 101 |
| Penetration Tester | 10% | 237 | 67 | 68 |
| DevSecOps Engineer | 7.3% | 173 | 38 | 47 |
| Application Security Engineer | 7% | 167 | 40 | 49 |
| Product Security | 4.5% | 107 | 25 | 28 |

## Which companies started naming OWASP ZAP in job posts recently?

Between April and August 2026, OWASP ZAP appeared for the first time in job posts at 282 companies: 171 commercial, 65 mid-market and 46 enterprise. Another 6 were AI-native companies, which we list separately.

| Group | Company | Job posts, April to August 2026 |
|---|---|---:|
| AI native | [Coreshield Technologies](https://sumble.com/orgs/coreshield-technology) | 2 |
| AI native | [Spyne](https://sumble.com/orgs/spyne-ai) | 1 |
| AI native | [gnani.ai](https://sumble.com/orgs/gnani-innovations) | 1 |
| AI native | [Skit.ai](https://sumble.com/orgs/skit-ai) | 1 |
| AI native | [Terra Security](https://sumble.com/orgs/terrasecurity) | 1 |
| Commercial | [Infopulse](https://sumble.com/orgs/infopulse) | 4 |
| Commercial | [Manulife IT Delivery Center Asia Inc.](https://sumble.com/orgs/manulife-it-delivery-asia-center) | 4 |
| Commercial | [PT Adicipta Inovasi Teknologi](https://sumble.com/orgs/pt-adicipta-inovasi-teknologi-adins) | 4 |
| Commercial | [Addvisor Group](https://sumble.com/orgs/addvisor) | 4 |
| Commercial | [Magnatec Systems Private Limited](https://sumble.com/orgs/magnatec-systems) | 4 |
| Mid-market | [Stefanini LATAM](https://sumble.com/orgs/stefanini-latam) | 6 |
| Mid-market | [Koniag Government Services](https://sumble.com/orgs/koniag-government-services) | 4 |
| Mid-market | [Zeta Global](https://sumble.com/orgs/zeta-global) | 3 |
| Mid-market | [East West Bank](https://sumble.com/orgs/east-west-bank) | 3 |
| Mid-market | [LUX MED](https://sumble.com/orgs/lux-med) | 3 |
| Enterprise | [Sanofi](https://sumble.com/orgs/sanofi) | 4 |
| Enterprise | [Fujitsu](https://sumble.com/orgs/fujitsu) | 4 |
| Enterprise | [First Citizens Bank](https://sumble.com/orgs/first-citizens-bank) | 4 |
| Enterprise | [Raytheon Technologies](https://sumble.com/orgs/raytheon) | 3 |
| Enterprise | [MSC Mediterranean Shipping Company](https://sumble.com/orgs/mediterranean-shipping) | 3 |

Companies that named OWASP ZAP in a job post for the first time between April and August 2026, ranked by their job posts in those months. AI-native companies get a group of their own, whatever their size. Recruiters and job boards are left out.

## What else do OWASP ZAP companies use?

OWASP ZAP companies are 40 times as likely as similar companies to use sqlmap: 7.7% of them, against 0.19%. Next is Burp Suite: 74% of these companies use it, against 2.3% of similar ones.

| Tool | Companies | Also name it | Typical | Times as common |
|---|---:|---:|---:|---:|
| sqlmap | 161 | 7.7% | 0.19% | 40 times |
| Burp Suite | 1,545 | 74% | 2.3% | 32 times |
| Semgrep | 115 | 5.5% | 0.18% | 31 times |
| Acunetix | 122 | 5.8% | 0.2% | 29 times |
| Trivy | 250 | 12% | 0.43% | 28 times |
| Checkmarx | 436 | 21% | 0.8% | 26 times |
| Snyk | 481 | 23% | 1% | 23 times |
| OpenVAS | 138 | 6.6% | 0.29% | 23 times |

Shares are out of the 2,101 companies whose job posts name OWASP ZAP, not counting firms whose job posts name almost every technology.

## Which project themes come up in OWASP ZAP job posts?

380 job posts naming OWASP ZAP describe broad digital transformation, and 60 describe Cloud Cost Optimization work. Security Infrastructure Modernization is next, in 51 job posts.

| Project theme | Job posts |
|---|---:|
| Digital Transformation | 380 |
| Cloud Cost Optimization | 60 |
| Security Infrastructure Modernization | 51 |
| Cloud Migration | 39 |

## About this data

Sumble built this page. Sumble gives sales, marketing and other GTM teams technographics and hiring signals for the companies they sell to: the technologies each company uses, which teams are hiring and for what, and who reports to whom. That helps a team know who to contact, why now, and what to say.

Sumble covers more than 3.6 million companies, 93 million job posts collected since 2022 and 194 million employee profiles, and tracks more than 37,000 technologies. It finds which technologies a company uses by reading its job posts and its employees' public profiles.

Sumble has a free plan, and the same data is available through its API and MCP server.

A company counts when its own job posts or its employees' public profiles name the technology. Hiring is that technology's share of all job posts collected each month. Quotes are copied word for word from the companies' job posts.

Every figure on this page comes from Sumble's own analysis, and you won't find it outside Sumble.