Apache JMeter vs. Layer7 API Security vs. Mandiant Advantage (discontinued)

JMeter is well suited for Java applications where the user can script the scenario once and make changes to accommodate for as many numbers of users for load test execution. The image and selection of any files or exporting files scenario is handled well.

It is less appropriate to test Ajax applications where it is required to script click per use.

Incentivized

Well suited for publishing internal services with very high security, protecting against attacks, and managing on-demand load. Also good for transform messages and SQL to Rest services. Not appropriate for business logic implementation.

Incentivized

Mandiant Advantage Security Validation, designed by Mandiant company, can automate a testing program to give us authetic and real world data on how our security controls are effectively working / performing. This solution provides trusted evidence on how well our security controls work against threats targeting our organization. This enables security teams to emulate real attack behaviors against security controls authentically throughout the attack lifecycle and the entire security stack.

Incentivized

• Easy of use - in generate load like HTTP requests, and processing/analyzing the responses. No coding is necessary at the basic level, just need to understand load testing and the infrastructure being tested.
• Automatic management of things like cookies to help with session state support - so you don't specifically have to worry about it or handle it
• Lots of testing/configuration options to suit your needs in making the right load generation (sampling requests), and analyzing the results, including any pre and post processing of the results first. Things like the Beanshell/BSF pre/post processors, response assertion, regular expression extractor, XPath extractor, CSV data set config
• There is a JMeter cloud service called BlazeMeter that I think would be useful for those that need to scale up high load without provisioning their own systems. I've not personally tried it though, but I recently attended a meetup presentation that highlighted nice useful features that BlazeMeter provides. One should evaluate the service if they are considering JMeter and need to expand beyond existing hardware resources.

• SOAP to Rest / Rest to SOAP web services transformation.
• Secure authorization and authetication (JWT, OpenIP Connect, OAuth, SAML and more). WASP Features as injection protection.
• Easy rule writing without coding.

Incentivized

• Mandiant ASM combines sources of information such, as assets through the internet cloud resources and suppliers from third parties. This comprehensive approach provides organizations with an understanding of their external attack surface.
• With scanning Mandiant ASM identifies threats and vulnerabilities present on the external attack surface and promptly notifies users. Whenever a new threat or vulnerability is detected an alert is generated to empower enterprises to take action in mitigating the risks.
• Mandiant ASM assesses risks based on their likelihood of exploitation impact on organizations and severity. This prioritization enables organizations to focus their efforts, on addressing the risks effectively.

Incentivized

• Jmeter requires many tweaks with respect to its configuration file and thread properties. users need to edit theses files themselves. There could be some interface where we can edit this fields.
• Jmeter cannot handle more threads and hangs up when we increase the number of threads. This causes lot of inconvenience. In these situations, user can be notified that such change would be lead to slow performance so that user can do as required. The same appears when we try to view huge files on graph listener.
• Jmeter should optimize the read and write access to output csv since it acts as overhead to the I/O performance. This affects our test results for the application which we are testing.

• It would be nice to have an integration with services like Github for managing projects and versions.

Incentivized

• Portal / Dashboard
• Integration across tools
• System resources efficiency

Incentivized

Price, Wiki and user sharing. Having access to the information provided by the developers and other open source providers is key for me. The ability to share information and get answers directly is very important to success in software testing. And the price of this product currently is amazing. Too many companies charge way too much money for products that are far behind in their value and pertinence

The purpose related to performance and load testing through Apache JMeter works fine but the usability of the tool should be improved quite a lot. If someone starts with the Jmeter fresh without prior experience, they need to put more efforts in understanding the tool. The UI is not that great which is the main reason not to give high rating on usability.

Incentivized

The Layer7 API Management is a great solution, but, sometimes the documentation is not clear or has lack of examples.

Incentivized

The product is easy to use, it is a useful tool, and has good support.

Incentivized

I have been using JMeter for the last year. By using this tool, you can make sure the system will work under varied loads. It helps us to simulate real time scenarios by creating required virtual users and make sure the application will work under load. Perform load, stress, and stability testing using JMeter.

Incentivized

The support team is good and the response time is reasonable, but (there is always a but), when support inquiries are made by someone experienced, and the question is not trivial, it is boring and takes a long time to get the case escalated to the next level of support.

Incentivized

I have used LoadRunner and Silkperformer, and so far Jmeter turns out be the easiest to use of all these. While each of them have their own ROI, Jmeter can be picked by anyone in hours and start testing within a day. While with other tools, we need to get license, install them (takes a while) and setup tests and firewalls, etc.

We evaluated 3 tools and decided on Layer7 API Management because it had the shortest implementation times and fastest learning curve, without losing power of customization and scalability.

Incentivized

There are many parameters which are the differentiator between mandiant and Cymulate but some of the key differentitors are listed below: 1) Manpower costs are less and justified as compared to Cymulate 2) Better technologies innovation 3) Good reputation in market 4) Good cummulative man hour experience Also, they are in the market from last 20 years and they have a huge client base.

Incentivized

• Good ROI on improving the performance of the application.
• Finding issues in the performance.
• Benchmark the performance results.
• CON: Need skillset to create and maintain the scripts in Java.
• Scripts are reusable and it is executed by any user.
• Need Client and Server setup to execute the scripts.

Incentivized

• Very fast implementation and is easy to learn & use.

Incentivized

• .
• Automation plays a role in saving time by streamlining operations related to attack surface management. These include automated asset discovery, vulnerability scanning and continuous monitoring of threat intelligence. As a result security teams can allocate their efforts towards projects such as security planning and incident response.
• ASM provides a view of the external attack surface, for businesses encompassing internet facing assets, cloud resources and third party vendors. This enhances the understanding of assets enabling organizations to identify and prioritize risks effectively and make decisions on security investments
• One notable advantage is cost savings. By eliminating the need to purchase and maintain security tools ASM becomes a solution for enterprises. It can replace products, like asset discovery tools, vulnerability management tools and threat intelligence feeds with its capabilities.

Incentivized