Even the links and categorization they used where strikingly similar to ZAP’s output.
Now, not everybody knows about ZAP and they might benefit from such assessments, it also happens that the higher ups tend to not trust their people and seeing a spreadsheet with a logo from a security company is comforting to them, but at any rate, I found no value at all whatsoever from the experience except from the commendation of the CEO about our good security practices since nothing major showed up on the audit (I had taken a cursory look at bed practices and used common sense like defaulting to distrust user input)
All I’m trying to say is, using a tool like ZAP (https://www.zaproxy.org/), which also happens to be an amazing tool for development too usually can take you very far with its automated testing, and if the higher ups still need a rubber stamp from a third party, well, that’s up to them…