does the ZAP full scan run faster if there are fewer vulnerabilities?

[Mario Alberto Ochoa Gonzalez]

As I have investigated, it does not inherently take less time if there are fewer vulns but please let me know... I'm using the containerized version

[Simon Bennetts]

ZAP will run roughly the same tests whether or not there are vulnerabilities.

There may be some slight variations:

• If there appears to be a vulnerability, ZAP may run more tests before finding there is not one
• If there is a vulnerability that ZAP finds quickly, then it will not carry on looking for the same vulnerability
• If there are SQL vulnerabilities that can only be detected by timing attacks, then ZAP will take a bit longer

But those will all be fairly minor differences.

Cheers,

Simon