How to scan at scale with OWASP ZAP

Tiago Mendo, CTO of Probely, describes how his team moved from manual web testing to automated scanning of a very large number of web applications with OWASP ZAP. He defines scale as roughly 150 scans a day and explains why they replaced ZAP's built-in crawler with their own, using ZAP only for the scanning step. This creates friction, since ZAP crawls before it scans, batches URLs in ways that can leave threads idle, and needs a separate instance per target for security and resource reasons.

The middle of the talk covers tuning. He explains batch sizes and thread counts chosen by trial and error, grouping URLs by response time and injection points so slow pages do not stall fast ones, and adding dynamic delays so scans do not take targets offline. He also covers session handling, detecting lost sessions periodically rather than on every request, prioritising authenticated and parameterised requests, placing destructive endpoints last, and disabling risky tests that could modify data.

He closes with false positives and resource use. Time-based payloads produced too many false positives, so the team repeated measurements in interleaved waves and extracted evidence to confirm findings. They also filtered low-value informational results, handled disk growth through periodic defragmentation, and used post-processing for their own rules. The main takeaway is that large-scale scanning depends on trade-offs that need tuning rather than default settings.