Application Security Penetration Testing Reviews

Showing reviews of the top ranking products in Application Security, containing the term Penetration Testing
Veracode: Penetration Testing
Karen Meohas says in a Veracode review
Information Assurance Manager at xMatters

We have some major clients using Veracode. It saves us time when it comes to doing annual pen tests. When we say we're using Veracode and they are also using Veracode, we don't have to run the test twice. They accept what we have because they know the framework is going to be the same.

A pen test can take a month; it really depends on the number of flaws that are found. So when we don't have to run a pen test twice it saves a lot of time. It not only saves time for my team, but for other teams as well, because when we run a third-party pen test for clients, I not only need to have my team coordinating it, but it requires documentation and it requires my technical support to be involved. So it saves a lot of time for a number of teams.

The report content is very good because the reports are structured in a way that they explain the scope of the scan and what the policy is. A report shows, right at the beginning, if we have passed the scan for the policy or not. That's very helpful when sharing that report externally. It's something that we didn't have before and having that now is extremely useful because it avoids a lot of back and forth with clients. If we share a report and there is no further explanation necessary on how the scan works and what we're doing to fix the flaws, it saves additional manual work that would otherwise be needed to update that information. With Veracode, we can do it automatically, just by pulling a report from the dashboard. In addition, whatever they have on the reports meets industry expectations.

Veracode provides visibility into application status across all testing types, including SAST, DAST, SCA, and manual penetration testing, in a centralized view. I manage the team, I'm not involved in the daily operations. But as a manager, it's extremely helpful, because I just log in to my Veracode instance and, on the homepage, it shows the status of all the scans. If I want more information about something, it's one click. From a managerial perspective, it's extremely helpful. The centralized view helps reduce risk exposure. If there is something wrong with a scan, if a scan doesn't run or a scan is not complete, I know about it from the main dashboard.

In addition, the solution integrates with developer tools. That creates more efficiency in the workflows because they don't need to duplicate work.

Overall, its ability to prevent vulnerable code from going into production is very good. We recently onboarded a new application into the static scan and we had almost 1,000 flaws in the first scan. We were able to mitigate all of them in less than three months. The result was amazing, enabling us to find everything that could potentially create a problem for us.

View full review »
Deepak Naik says in a Veracode review
Product Owner - DevOps at Digite

We also used Contrast Security for real-time scanning on an experimental basis. If that is successful, we will probably roll that out. Contrast Security is very focused on run time scanning. Veracode also has some kind of module for this that we have not explored. However, the Contrast Security tool was suggested to us by one of our customers. We have not compared Veracode and Contrast Security yet.

The other tool which we use is Burp Suite for performing some manual verification. This is apart from what Veracode is not able to. Our customers are also reporting some vulnerabilities because they have their own scans. To verify those types of issues, we use Burp Suite. Burp Suite is pretty handy when you want to quickly do some penetration testing and verify some vulnerabilities. It is definitely a unique tool, and I don't think there is this kind of module with Veracode.

View full review »
Acunetix Vulnerability Scanner: Penetration Testing
Lead Information Security Engineer at a financial services firm with 1,001-5,000 employees

We use it for internal penetration testing, for security reviews.

Acunetix is just one tool of many that we use. We try to cover as much as possible during assessments. We do security assessments of all the code and everything we develop internally. When we do a security assessment, we do a manual code review and we use different kinds of tools, as well as manual testing against the application, etc. It's just one tool within many that we use. It has been very useful in that it's found things that we otherwise might have missed.

View full review »
Senior Test Engineer II at a financial services firm with 201-500 employees

The reporting is pretty good. I haven't seen reporting of that level in any other tool. It also allows for segregation. If I want to generate a report regarding vulnerabilities, I can simply select that particularly vulnerable section and it will generate a report with all the work in the web application. 

Similarly, for PCAD assisting, I can also generate a report — in multiple formats, including PDF, HTML, and doc files. 

Segregation of reports is really, really good with Acunetix; it provides us with a lot of in-depth details. This feature stood out when comparing Acunetix with other tools.

It provides me with a list of vulnerabilities that we weren't able to identify when doing manual penetration testing. It located and picked out some hidden vulnerabilities as well, which are hard to spot with the naked eye.

View full review »
Saminda Jayawardene says in an Acunetix Vulnerability Scanner review
Compliance Manager at a tech services company with 201-500 employees

Our company has more than 300 employees and we have regional offices in Japan and Malaysia. We are in the FinTech industry. We do banking solutions, mobile, branch-based, and agent banking. We are also into government projects.

We have two lines of application testing. One is for internal application deployments. Before all these deployments, we conduct testing with Acunetix and, based on the report generated, we do remediation. Once the remediation is done we will do more testing. Only once all the vulnerabilities have been fixed is it allowed to be deployed in the organization's environment. 

The second use case is that we do application development for banks. Whenever we develop backend applications or web applications, they are all tested for vulnerability. In addition, the mobile application code is tested using Acunetix.

We didn't have much in the way of exposure to this kind of information when I joined the organization. I introduced this system to test all the applications that were going to be released to customers, as well as for our internal vulnerability assessment and penetration testing purposes.

View full review »
PortSwigger Burp: Penetration Testing
Vijayanathan Naganathan says in a PortSwigger Burp review
Director - Head of Delivery Services at Ticking Minds Technology Solutions Pvt Ltd

Clients come to me for an assessment of their web applications to see the risks that they are facing with their applications. They want to ensure that their application is free of being manipulated and also secure, so they reach out to us to do vulnerability assessment and application penetration testing. We make use of PortSwigger's BurpSuite tool carry this out. We look at it more from an application standpoint, what common vulnerabilities there are like the top 10 OWASP vulnerabilities like Injection(OS/SQL/CMD), broken authentication, session management, cross site request forgery, unvalidated redirects/forwards, etc. Those are the primary uses we make use for this tool.

View full review »
Checkmarx: Penetration Testing
reviewer971370 says in a Checkmarx review
CEO at a tech services company with 11-50 employees

The primary use case is for a white-box penetration testing security. When we work with source code, it's a tool to help us conduct a deep analysis on a source code level. 

We push the zip file with source code to our own stent with the solution and receive a report. Also, we work with the interface to find the vulnerabilities we may have.

The most popular projects for us are the mobile application security assessment. We propose this option to our customers to check source code for iOS and Android mobile applications.

View full review »
Sonatype Nexus Lifecycle: Penetration Testing
Charles Chani says in a Sonatype Nexus Lifecycle review
DevSecOps at a financial services firm with 10,001+ employees

Previously, the developers would do their work and then it would be evaluated using something called penetration testing. With the results of the penetration testing they would go back and make changes, and then we would have to do the penetration testing again. That was a very long-winded process, whereas now, they can develop with confidence knowing that the libraries and binaries that they are using have already passed penetration testing. That saves a lot of time in the lifecycle. It's difficult to even quantify because it's so huge. But we're talking about reducing the development lifecycle by about 90 percent, minimum.

It has helped developer productivity. It's like working in the dark and all of a sudden you've got visibility. You can see exactly what you're using and you have suggestions so that, if you can't use something, you've got alternatives. That is huge.

View full review »
Snyk: Penetration Testing
Nicholas Secrier says in a Snyk review
Information Security Officer at a tech services company with 51-200 employees

If your company develops software, and if you are an open source consumer, you need to have something in place. Do your research and find the best solution. For us, Snyk worked. I am involved in a security working group with my counterparts at our investors. We discussed what we're doing and what we are using and I discussed Snyk there. I discussed it with a couple of companies in particular and shared ideas and I recommended that they have a look at Snyk. Snyk is open source. You can take it for a ride and see if you like it. Once you're happy with it, you can move forward.

The biggest lesson I've learned from using Snyk is that it brings in a little bit of discipline in terms of what people can and cannot use. It also highlights the importance of security. It also adds a little bit of structure by surfacing potential issues. That's one of the most important factors. And having something like Snyk means you can validate and you can demonstrate, when meeting your clients and your investors, that you are meeting security needs and concerns.

In terms of the time it takes for developers to find fixed vulnerabilities, it depends on the type of issue. In some cases, for example, if there is an upgrade and there is a new version of the library, Snyk does make recommendations. If Snyk can do something for you it will do it. It can automatically generate a pull request so you can do a library upgrade. If there is something quite straightforward regarding licensing, they'll highlight that for you. But other issues are a little bit more complex. If it's a container image, for example, and there's no immediate image upgrade, maybe you want to do something like upgrade a library within the image. Some things are quite straightforward, and if Snyk can, it recommends it, and it's pretty easy, pretty straightforward. For other situations it will say you can manually upgrade this, but you'll have to do that process on your own.

Snyk's actionable advice when it comes to container vulnerabilities is aligned with the rest of the solution. We were one of the early users of containers. We have had Snyk in place for nearly two years, so when we started, containers were something very new for them. It's definitely better than other solutions which are free. Can it be better? Yes. As always, things can always be improved, but it's more or less on par with what we have on the regular dependency checks that we have on normal libraries as part of the source code.

If you look purely at the source code, we can do it with a SaaS application. You link your GitHub or your code repository with Snyk and, as you commit code, Snyk scans and reports. For containers, we tend to use the integration part of the CI/CD pipeline as well. All the images are passed through and we're using CLI commands to run this. This requires a little bit of extra setup, but once you put it in place it tends to be quite straightforward and doesn't require any additional work. As for allowing developers to own security for the applications and the containers they run in in the cloud, to be honest with you, in a lot of cases, their main focus is on developing the app. The scanning is more on the infra side. When it comes to containers and streamlining the application installation, that usually falls on the infra. They stay on top of that task. We have it integrated and we keep an eye out in case something has been plugged up. I just ask them to make sure it's addressed as soon as possible.

We're using Qualys to do external scans and external assessments. We also do penetration testing. But at the end of the day, you have to look at what you want from a tool. Maybe there are other solutions out there that claim to do a lot more. I'm sure that there are other vendors that can potentially give you a more integrated and better view, but they come with additional costs and additional complications. It all depends on what you want to do and how you want to achieve that. For us, the purpose of Snyk was to look at the vulnerabilities in the code or Docker container images, and to address the licensing aspect. 

Some companies go with individual solutions for every single part. For example, they use Clair to scan just the containers and something else to scan just the code. They have linting tools and other things. We're not just using Snyk. For example, we also have linting tools for code quality. This is not something that Snyk is doing. We're trying to use what is suitable for us.

View full review »