How do you integrate OWASP ZAP into CI/CD without slowing delivery to a crawl?

The usual failure mode is a security gate so slow or noisy that teams bypass it. For OWASP ZAP, the practical levers are: scan only what changed on pull requests and keep the exhaustive scan for a nightly or pre-release run; cache whatever database or ruleset the tool downloads so CI is not re-fetching it every job; and parallelise across services rather than scanning a monorepo serially.

Severity policy matters as much as speed. Blocking on every finding trains people to add blanket suppressions. A workable policy blocks on Critical (and often High) with a documented, time-boxed exception process, while everything lower is tracked as a ticket rather than a hard stop.

For this tool specifically, tune baseline vs full scans, spidering and AJAX spidering, authenticated scans with session tokens, the API scan for OpenAPI specs, taming scan duration in CI, and interpreting alerts by risk and confidence. Finally, make the gate honest: failing the job when a High-risk alert appears on a deployed test environment. A gate that warns but never blocks is documentation, not a control.