The Zed Attack Proxy (ZAP) is an OWASP Flagship project and the largest open source web application security tool measured by active contributors. While it is an ideal tool for people new to appsec it also has many features specifically intended for advanced penetration testing. In this talk Simon will give a quick introduction to ZAP and then talk about some of the latest changes that have been made, including features that will not have been presented at any other conference.