Acunetix Vulnerability Scanner Review

It provides quite a lot information about vulnerabilities, but we are also receiving false positives around cross site scripting vulnerabilities


What is our primary use case?

We use it as a dynamic scanner for testing our websites. We also adjust it into another tool that we use which allows us to share our report with our developers.

How has it helped my organization?

It has been able to find some vulnerabilities, and we've been able to remediate our websites and vulnerabilities, thanks to Acunetix. We can go back in and have them retested, which is kind of nice, because we can click on the vulnerabilities which it has found. It will also give us quite a bit of information, along with responses, so we can go back and manually test it to make sure it's not a false positive. So, it has been especially useful in that way.

What is most valuable?

The crawl only scan for trying to figure out at which points of the site that you'll actually be able to reach within the full scan. That's pretty useful. If you're just trying to test your login sequence, it is nice. It'll tell you which parts of your website it will initially scan, and you can actually go through and disable parts if you know you're not going to have to scan those parts. Then, later on, you go back and do a full scan for deep penetration of the site.

What needs improvement?

There are quite a few false positives that come out. It's mostly based upon finding XSS vulnerabilities, even though we know that XSS vulnerabilities do not exist within some of the web applications because of some frameworks we're using. So, we're not entirely sure why it finds a bunch of these cross site scripting vulnerabilities, but these are main false positives that we have come across.

You can't actually change your password after you've set it unless you go back into the administration account and you change it there. Thus, if you're locked out and don't remember your password, that's a thing.

If you're exporting vulnerabilities to view so you can ingest them into another viewer, the ability to select all the vulnerabilities would be nice. Because as of right now, you have to manually go through and click on every single vulnerability that you want to export.

With the implementation, when we started, there were a lot of issues. They've actually fixed a lot of the issues in the past (almost) year now. Initially, when you were creating a login sequence, when you wanted to edit it, you actually had to go back, open it in a text document, then edit the request that way because you weren't able to edit it through the GUI. Now, they've updated that, so you can actually go back and edit it, which is very nice.

We had some issues, not particularly bugs, like with the user interface, e.g., "Why isn't this here?" Just specific tools that we were looking for initially, which they ended up implementing later on.

For how long have I used the solution?

Less than one year.

What do I think about the stability of the solution?

We have not recently had any stability issues. We were having some issue with the speed of the login initially, but ever since they updated that, it has gotten a lot better.

Only one person is needed for maintenance. It's pretty low maintenance. They'll send you an email update when there's a physical update to the application. You just go and download the new application, then install it the same way you would have originally. It keeps all your scans and targets, so it is very easy for maintenance.

What do I think about the scalability of the solution?

The scalability has moved along nicely and been able to keep up with the expansion of our website and the added targets. However, with a dynamic scanner, the scans take longer as the site gets larger. So, there is more tweaking here and there about what would be best in how to speed up the scans and what we really need to include when we are scanning. This is quite easy to adjust: How we are going to be scanning and what we are going to be scanning.

We have 15 plus targets. We set them up on a schedule, so we can get the most scans here and there on a continuous line. We have eight people currently using it.

How are customer service and technical support?

Their technical support has been very active. If I have an issue, I can reach out to them and get an answer pretty quick.

I had a one-on-one meeting with a support analyst at Acunetix and gave them a bunch of feedback on what we thought. We saw some of those ideas trickling out into the next release, and some releases after that. While I don't know if they're responding directly to requests, or some other person had these suggestions ahead of us, but they definitely are putting in more positive changes.

Which solution did I use previously and why did I switch?

I'm still learning how to use this solution. We were using the Burp Suite and its scan before this, which is very similar. I would actually say that the Burp Suite finds quite a bit more vulnerabilities than Acunetix does.

How was the initial setup?

It was very easy to set up. It was just almost plug and play. Initially, it was not Linux compatible, but after a little while they actually came out with compatibility for Linux, which was nice.

We use it on Windows now. Initially, I wanted to set it up on a Linux box, and it didn't have compatibility for that, but they added the compatibility over the past several months, I just never really got around to installing it onto the Linux boxes. Now that we have everything already set up here, we don't really want to migrate a bunch of our scans.

The deployment took me a week to a week and a half to do, get everything set up, and all our first scans tested. However, this was from a very inexperienced point of view. I'm sure somebody who was more experienced and didn't come fresh out of college would've been able to set it up in a day.

Everything is web-based and relatively intuitive, which is very nice. Knowing what I know now versus back then, the first thing I would've done is set up a certification for a web portal. However, I installed it as it was correctly, but I was very cautious about what I was doing because I wasn't very experienced. It was a very easy install and set up.

What about the implementation team?

I did the implementation with another security engineer. There is a lot of documentation to help, with a lot of forums on the Acunetix website and off of the Acunetix website.

What's my experience with pricing, setup cost, and licensing?

Our license is good through June. We're really trying to ramp up here to see if it is a viable option to renew it.

Which other solutions did I evaluate?

We still do use Burp suite on the side. We use it a lot for manual testing and still use it for dynamic testing.

We decided to try Acunetix to see if it would find any different vulnerabilities, etc.

What other advice do I have?

While there has not been any real reduction in remediation time, there has been a reduction in scan time. Because when you're doing a Burp scan, it can take a long time. Whereas, with Acunetix, you can basically just set it, then it will scan throughout the night.

On bigger sites, the speed can be a little tricky unless you are narrowing it down to smaller sections of the site. On small sites, half a million lines of code or less, it has gotten pretty nice and quick, down to a couple hours now for a whole scan. So, it's getting there. They are pushing out quite a few updates, every now and then.

There is something called AcuSensor, and you can install that on local servers for a deeper scan. This has worked for us, but we haven't installed it on all of our boxes yet, but I think we will pretty soon.

It's been used quite extensively here within our company. Every website is using this along with other scanners.

Which version of this solution are you currently using?

12
**Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
More Acunetix Vulnerability Scanner reviews from users
Learn what your peers think about Acunetix Vulnerability Scanner. Get advice and tips from experienced pros sharing their opinions. Updated: January 2021.
456,966 professionals have used our research since 2012.
Add a Comment
Guest