“It is not a replacement for a professional penetration test.”

Transcript evidence from Simon Bennetts — OWASP ZAP: past, present, and future.