Acunetix by Invicti vs Invicti

Likelihood to Recommend

It is suited well for ad-hoc and scheduled application vulnerability scans. You must review the results to manually filter out false-positives. You must always keep in mind that this is only a vulnerability scan. It can only find a certain class of vulnerabilities, and it can only do that so well. You should definitely not rely on this tool alone for identifying problems. That being said, I have used it along with every other major commercial vulnerability scanner and find it to the best overall ROI compared to more expensive commercial scanners that don't necessarily give you a better user experience or better vulnerability results. I rarely need support from the vendor, but when I do, they have been responsive and able to solve the issue quickly.

Read full review

Aaron Bryson

Director - Red Team (Application, Mobile, Cloud, IoT security, etc.)

Cylance, Inc.Computer & Network Security, 1001-5000 employees

View all 1 answers on this topic

Netsparker is very thorough but can take a very long time to scan a web application. It can also take a long time to learn and configure. Its thoroughness is a very good part of the product but if the application does [not] need this thoroughness it is probably a waste of time to run Netsparker on the website.

Read full review

Glenn Jones

Sr. Systems and Security Architect

Mathematica Policy ResearchResearch, 1001-5000 employees

View all 2 answers on this topic

Pros

Fast.
Easy-to-use.
Great customer support.
Reporting features.
Supports importing state files from other popular application testing tools.
Has other features built-in beyond just scanning for vulnerabilities.

Read full review

Aaron Bryson

Director - Red Team (Application, Mobile, Cloud, IoT security, etc.)

Cylance, Inc.Computer & Network Security, 1001-5000 employees

View all 1 answers on this topic

NetSparker has excellent customer service. When our team had to learn to use it for the first time, we had to communicate directly with NetSparker consultants.
NetSparker is very user-friendly. It's UI is organized and keeps all the different scans we have set-up in a very clean visual.
Netsparker has a selection of workflows and integration tools that make it useful for keeping all of my teammates on the same page.

Read full review

Jatel Desai

Programmer Analyst

Department of Industrial RelationsGovernment Administration, 501-1000 employees

View all 2 answers on this topic

Cons

Does not support multiple endpoints well (e.g. apps and services that do not reside at the same URL).
Has authentication problems with modern enterprise apps which involve a lot of redirects to unrelated endpoints, federated IDs, SSO, etc. This is related to the first point.
The vulnerability detection capability is not as robust as Burp Suite Pro + extensions, Metasploit + auxiliary modules, Nmap + scripts, etc.

Read full review

Aaron Bryson

Director - Red Team (Application, Mobile, Cloud, IoT security, etc.)

Cylance, Inc.Computer & Network Security, 1001-5000 employees

View all 1 answers on this topic

Netsparker Cloud is expensive and restricts the number of website URLs that you are allowed to scan. This restricts us from scanning all of the websites that we create and only allows us to scan a small subset of number of the website we produce.
Netsparker is difficult to configure and I often need to open a ticket with support to figure out how to use the product. I have been vulnerability testing websites for over 10 years and I still don't think I really know how to use Netsparker.
Netsparker can take a very long time to complete a scan due to the number of items it can scan for. Be certain to reduce the technologies that your scan will be looking at. Also, expect a large website to possibly take over two days to complete. Not something you really want to have happen on a developer checking on some source code.

Read full review

Glenn Jones

Sr. Systems and Security Architect

Mathematica Policy ResearchResearch, 1001-5000 employees

View all 2 answers on this topic

Pricing Details

General

Free Trial

Yes

Free/Freemium Version

—

Premium Consulting/Integration Services

—

Entry-level set up fee?

No

Starting Price

$0

Acunetix by Invicti Editions & Modules

Edition

Websites Scanned: 5	$4,500
Websites Scanned: 6-10	$7,200
Websites Scanned: 11-20	$10,800
Websites Scanned: 21-35	$22,540
Websites Scanned: 36-50	$26,600
Websites Scanned: Over 50	Contact for quote

none

Additional Pricing Details

—

General

Free Trial

—

Free/Freemium Version

—

Premium Consulting/Integration Services

—

Entry-level set up fee?

No

Starting Price

—

Invicti Editions & Modules

—

Additional Pricing Details

—

Support Rating

No score

No answers yet

No answers on this topic

Invicti 10.0

Based on 2 answers

NetSparker support is amazing. When first introducing this software to the team, there was a lot of communication going on between Netsparker consultants and our team. They have answered our questions very efficiently and have had consultants come to our department for training. They are open to suggestions for improvements and enhancements as well.

Read full review

Jatel Desai

Programmer Analyst

Department of Industrial RelationsGovernment Administration, 501-1000 employees

View all 2 answers on this topic

Alternatives Considered

Every year, we re-evaluate the tools we are using and licensing. We balance the ever-changing vendor licensing-models, costs, tool features/usability, etc. For the last few years, this has been the best overall commercial tool for our specific use case. However, this is only one of many tools that we use and need.

Read full review

Aaron Bryson

Director - Red Team (Application, Mobile, Cloud, IoT security, etc.)

Cylance, Inc.Computer & Network Security, 1001-5000 employees

View all 1 answers on this topic

I currently use OWASP ZAP, Burp Suite Professional and Veracode Dynamic Scan. ZAP is very easy to use and the web developers use it regularly. Burp Suite is very customizable as is Netsparker but usually take much less time to scan a website. Both of these tools are programmable and allow me to add special items to a scan when I need it. They are also much better documented. Veracode also has a static code analysis tool that we use much more often then the dynamic analysis tool but we do use both parts of Veracode.

Read full review

Glenn Jones

Sr. Systems and Security Architect

Mathematica Policy ResearchResearch, 1001-5000 employees

View all 2 answers on this topic

Return on Investment

Saved money compared to other commercial scanners, especially over the long run.
Scan speed seems to be pretty good compared to some of the bulkier commercial products out there. However, that largely has to do with proper configuration.
A downside is that is requires a bit of extra work just to get it set up to scan APIs, web services, etc.

Read full review

Aaron Bryson

Director - Red Team (Application, Mobile, Cloud, IoT security, etc.)

Cylance, Inc.Computer & Network Security, 1001-5000 employees

View all 1 answers on this topic

NetSparker has saved the team a lot of time since the scans quicker than our older software.
NetSparker has been costing the company a lot compared to previous security software.
Netsparker has helped improved our overall business objectives by finding an efficient and collaborative way to run scans on our systems.

Read full review

Jatel Desai

Programmer Analyst

Department of Industrial RelationsGovernment Administration, 501-1000 employees

View all 2 answers on this topic

Acunetix by Invicti vs Invicti