Acunetix Reviews

The solution's most valuable feature is its capability to scan the rest APIs. 

They should include the features for reporting in the solution's next release. Also, a dashboard feature could help us view scanning targets segregated into different categories. In addition, there should be a feature to export the data into Excel Spreadsheet.

We have been using the solution for 15 years.

The solution is highly stable. I rate its stability an eight out of ten.

I rate the solution's scalability a four out of ten. Our clients are enterprise businesses. Also, we have two solution users in our organization.

For standard use cases, we deploy it on a notebook or a desktop machine. In case of integration with a development system, we deploy it on a server or a virtual memory machine. I rate the solution's initial setup process a five out of ten.

The solution is expensive. Its price is based on the number of targets. It has an annual subscription plan and costs around HK$500,000. I rate its pricing a nine out of ten.

I advise others to stay connected to the solution online to ensure the license is up-to-date. I rate it an eight out of ten.

We needed it to scan our internal network and web applications. 

Our security team of five people used it. We scheduled some monthly scans for web applications, which were not being used, to check for vulnerabilities and also vulnerabilities on new features.

Where I worked was a big group where there were many agencies under it, and we did the security for all other agencies. With Acunetix, we cut the time to make infrastructures and web applications (for our colleagues) more secure.

For one application with two or three critical vulnerabilities and some other vulnerabilities, it took like a week to remediate issues because the scan and findings were really fast. 

What I found to be valuable was the fully automated scanner because it is really fast. 

Acunetix has an awesome crawler. It gives a referral site map of near targets and also goes really deep to find all the inputs without issues. This was valuable because it helped me find some files or directories, like web admin panels without authentication, which were hidden.

Acunetix saves on the cost of time because it is fast.

When Acunetix finds a vulnerability, it also checks for a false positive so it can be a 100 percent sure about the issue that it found. The false positives are really low, maybe one percent.

I had some issues with the JSON parameters where it found some strange vulnerabilities, but it didn't alert the person using it or me about these vulnerabilities, e.g., an error for SQL injection. 

They need more customized scans along with a way to edit their default payloads. While you can select which check to do, you can't add which payload to use.

I used Acunetix 20 months ago at the last agency where I worked.

The scalability was okay. We didn't need to do much work to implement it into the network or some web applications, so I think it's really easy to scale. We didn't need to do work on it because the solution is adaptable to every environment.

There were about 20 websites and other web applications.

I never needed to talk to the Acunetix technical support.

They were previously using Fortify WebInspect, which was good, but very costly.

It was very easy to set up Acunetix, as they give you an installer that does everything. You just need to click: "Install".

It takes a maximum of 10 minutes to deploy, if you want to read everything.

We did other configurations to enable the IP address to talk to all the networks.

We also used Acunetix on a Linux server. The deployment process was the same as Windows. It was just another installer, but for Linux.

It saved us many weeks of work.

We didn't sell anything with Acunetix, so it was just an improvement for ourselves.

If someone would have hacked us, they probably would have caused much damage. However, now with Acunetix, they shouldn't be able to cause to damage.

I think all the scanners, except Burp Suite, are a bit costly.

Implementing Acunetix needs a medium or larger business agency, because you need some money to get Acunetix. It is costly, but if you care about your agency's security, then maybe it's a cost that might help you in the future.

Acunetix is the fastest scanner available compared to applications like Netsparker and Fortify WebInspect. The longest scan with Acunetix, and it was for a huge web application, took only four hours. Other scanners did the job in six to eight hours. 

While I like Netsparker, it is really slow compared to other scanners.

We found 50 unexpected, high vulnerabilities for three web applications. This made our principal a bit mad.

We found three or four DOM-based XSS vulnerabilities using this solution.

It did not require maintenance on our part. We just needed to give it some credentials.

I would rate it as a nine out of 10.

Dynamic application security testing is our primary use case. I don't know if it would be used as a primary solution, but as a supplemental solution, Acunetix is very good for scanning applications and finding vulnerabilities.

We're a global organization. We're a large book publisher around the world. We use it globally: China, Australia, Europe, Asia, India, South America, Canada, and the USA. It's a global solution.

It has been instrumental in supplementing services that we already have. 

Scheduling of testing cuts down on the manual, tedious activities that go into setting up a test site.

One of the features that I feel is groundbreaking, that I would like to see expanded on, is the IAS feature: The Interactive Application Security Testing module that gets loaded onto an application on a server, for more in-depth, granular findings. I think that is really neat. I haven't seen a lot of competitors doing that.

I would like to see them build up that IAS tool, the Interactive Application Security Testing module that is embedded with PHC. That's a very cool function.

I would also like to see them enhance the database. I don't know what version of OWASP Top Ten vulnerabilities they actually employ for Acunetix, but there are some versions of OWASP Top Ten vulnerabilities out there and I would like to see some PCI included as well within Acunetix. That would be great.

The stability is great. We have never had any service drops. Whether we have run a web service where we allow our security professionals to access Acunetix over a URL, we have never had any problems with someone signing into the actual server and running Acunetix from a platform; or from an application perspective, where they're launching applications from the desktop of the server. Both have been pretty great. 

We are only using Acunetix as a secondary solution. We already employ Qualys as our primary solution but that was getting overworked. We needed to relieve it of some of the workload that we were sending it. What we did was look at a solution like Acunetix to help supplement some of the work that Qualys is doing for us. But since it is a secondary tool, scalability was never really an issue because we weren't asking the solution to scale at all.

Tech support is not a 24-hour. It's more of a ticketing-type of solution where you e-mail the support team. We always go through our reseller for support. Response time is average, about a day or so until they respond.

The setup and upgrades could be easier. I would like to see a wizard to take you step-by-step.

Upgrading v7 to v8, we had to do a fresh reinstall. We had to uninstall it and reinstall it rather than just reaching out, grabbing an update and have it fix itself. We had to go into some files and re-input a key and we actually needed to call support to help us with upgrading from 7 to 8. We had to create a support ticket, call one of the resellers of Acunetix, and get some assistance with that.

So a wizard would be great, a step-by-step instructional program that guides administrators or security professionals along the way, especially with upgrades from version to version or initial installs.

They should make it a little easier for security professionals or system administrators to get the software into the actual infrastructure. Without that, people are running around, searching for Wikis and documentation that supports deployment on multiple devices. I know when I was first working with Acunetix and getting it deployed into our environment, we ran across those issues. I would like them to make it a little easier, where automation plays a key in driving deployment of Acunetix, versus a manual installation process.

If you know what you're doing, the deployment of Acunetix can take less than 30 minutes.

Everything was done internally.

Return on investment is hard to track because it really depends on the criticality of the vulnerabilities and what the business costs or impact could be if those vulnerabilities were actually exploited. We have a vigorous application security program so testing activities like SAST and DAST must take place. I know if we were to remove our DAST program and not test our websites, we could see an immediate cost-effect as a result. But since Acunetix is used as a secondary tool, we don't know if it actually provided any real cost metrics where we could say: "Okay, because of our use, we have saved X amount of dollars because it found Y amount of vulnerabilities that saved us Z amount of time remediating." Those metrics are not known.

We have a corporate deal and we're almost at the end of that contract. We are looking to renew Acunetix, but we were told that the price was increasing greatly because of some advanced capabilities, or miscalculations of value. It's increasing by 3.5-fold from what the initial quote was. Because of that, we have to go back to the drawing board and figure out cost-to-capability value, versus features that we could get for that same amount.

At the current pricing structure, it doesn't save us money. It winds up costing the program money due to the fact that it's increasing in cost. At the time when we signed up initially, it was very beneficial because of its cost. When we looked at all other vendors and what they were asking, to provide a third of what Acunetix was capable of doing, it was an easy decision. With the IAS modules and everything else that we got as an add-on, it made it a real value compared to all the other competitors out there. But now that it's coming to a cost where it's line with market value, it becomes more of a competition.

There were other tools in the running, although I don't remember off the top of my head which ones. At the time, Acunetix was the winner mainly based on pricing and capability. 

As I said, Acunetix is a secondary tool for us. We use Qualys as our primary DAST solution and when that gets overloaded we turn to Acunetix to supplement some of the load that we're putting on our prime solution.

Compared to other vendors in the field, the speed of Acunetix is just about average. Something like Micro Focus WebInspect scans about ten percent faster. If you're looking at IBM AppScan it might be five percent faster. We're not looking at a huge percentage difference in the time Acunetix takes to scan versus others.

The false-positive rate of Acunetix is definitely not perfect. No tool is going to avoid all false-positives. The false-positive rate of Acunetix falls - I don't want to say below average - but it's almost the same as everyone else. What I have to say, honestly, is that I do find myself correcting a lot of the false-positives that show up in Acunetix right now. We don't get a 50 percent margin, but I estimate that 25 percent of the reported vulnerabilities are false-positives in Acunetix.

At the current pricing structure, I would tell people to do their research. If you have X amount of dollars to spend in the budget, and you're looking for a good solution, definitely consider Acunetix, but also consider other tools for similar features and functionalities where you may get a little bit more bang for your dollar, frankly, versus a tool that's still maturing as it's starting to take market share. Acunetix is a very intermediate tool. It's not an advanced DAST solution. It's still in its infancy. There's a lot of the solution to still build out, a lot of features to still work on, but it is definitely a tool that's worth looking into. Keep in mind, for that same price structure, you can get more established, more brand-name solutions.

The speed of the solution is about average. I use a lot of DAST solutions and I can't say that I'm blown away by the amount of time it takes to complete a security assessment, but I do like that it's not slow. It's not the fastest tool I've ever seen, but it's not the slowest tool I've ever seen, so it meets my expectations. It is a fast application but I'm not blown out of the water by it.

It definitely meets the benchmark. Like I said, it doesn't fall below expectations. When you're running Acunetix against a site, looking for security vulnerabilities, you're not blown away by the speed, but you're not sitting there for a day-and-a-half waiting for results or waiting for a scan to complete. It really depends on the size of the application and the granularity of that application. Acunetix performs just as expected. It's not a bad thing. 

We have very large applications, so it could be less about the solution and more about the depth of our applications. A lot of our applications have special prerequisites that Acunetix just can't expect or predict. A lot of it is giving Acunetix the proper permissions and things of that nature to go in-depth with DAST scans. On average, depending on the application, it can take anywhere from six to eight hours.

We host Acunetix on our own environment. I don't think they have a SaaS solution yet. We host it in an in Azure environment where we put it on our own server - a dedicated server - specialized to doing DAST security scans - and we are happy. We're not unhappy with Acunetix, but we're not greatly excited that this is the best tool ever. But we are very impressed by some of the things that it has been doing. It's that middle ground. It's a good tool. I would definitely recommend it.

The remediation rate is based on the maturity of our development team. Acunetix doesn't provide a format that makes remediation easier. It does what every tool does and gives us the vulnerability, explains the vulnerability, and gives us some remediation guidelines or tips, but that's what everyone does. So it really depends on the workload of our development team, and what backlog they have or what their sprints look like going into the next cycle. It has very little to do with the tool and more to do with the capability and workload of the development teams.

Using it on a secondary basis, we have found some medium vulnerabilities but no critical vulnerabilities which required immediate remediation. What I do notice about Acunetix is that there's a lot of "white noise," a lot of "background noise," things that just don't apply. When filtering those out and removing the false-positives that don't apply to the actual application, we may find one cross-site scripting. That may be a medium vulnerability but not a high vulnerability because of business impact. There are different risk ratios that we apply to different findings, but we haven't found anything critical with Acunetix. It could just be that we don't have any critical vulnerabilities in that environment - although I don't think that's the case. In terms of DOM-based cross-site scripting vulnerabilities, it all depends on the application.

We don't have it deployed on any Linux server. It's on our Windows environment. We have it in Azure, in a cloud, so it's a Microsoft framework that we have Acunetix installed on top of.

All of our users of Acunetix are in development and security roles. The number of users is well into the hundreds. I administrate the tool, I set the roles and also manage users and user interface and interaction. We have a dedicated server team that does maintenance and deployment. If we need to deploy another instance of Acunetix, that is usually done by our server team. They handle all server infrastructure activities. I am the senior security engineer, so I handle all security-related activities.

We don't have plans to increase our usage of Acunetix. We may stop usage. Acunetix is raising the cost of licensing. It's 3.5 times what we were initially quoted. As a secondary solution, we're trying to figure out, is it worth the extra cost just to have it do some supplemental scans for us. We're still evaluating that.

Overall, Acunetix is definitely a seven out of ten. I like the product. It's doing a lot of what its competitors are doing. It's running great DAST scans and it has a rich database of vulnerabilities that it can report and it also provides a web component of its solution where you don't necessarily have to sign on to a physical server or a virtual device to interact. You can, but you can also contact Acunetix through a web interface, which is great. But the interface, in general, is still very simplistic, which may be a good or bad thing. The reporting could be a little bit better. When ending a scan I would like to see more graphical representations, maybe trends from scan to scan, of how the overall maturity is going of the application project that it's scanning or assessing. The reporting is okay. It does give you the option to do PDFs or CSVs. More reporting formats, like an Excel format, maybe an XML format, would be great.

Integration into other tools is very limited for Acunetix. While we're trying to incorporate a CI/CD process where we're integrating with JIRA and we're integrating with Jenkins and Chef, it becomes problematic. Other tools give you a high integration capability to connect into different solutions that you may already have, like JIRA. All findings that Acunetix happens to run across could be sent straight to JIRA. That would increase our remediation rate because it's very seldom that developers read PDFs of security vulnerabilities. One of the things that Qualys does is allow us to integrate into our JIRA environment, into our Jenkins environment, etc. We haven't seen the same capabilities with Acunetix. 

Because of these things, I have to give it a seven. It's ultimately a great tool, a great scanner, and you can really rely on some of its findings once it's tuned.

This solution is a WAF (web application firewall). The primary use case of this solution is to secure web applications against cross-site scripting and other forms of malware that occur at the application level.

We last used Acunetix in December and we have switched to Barracuda.

The scalability is more than good. It can operate both as a standalone and it can be integrated with other applications, which makes it a very versatile solution to have. 

This solution is simple enough, especially with the cloud. You can download the client onto your machines and then you start filtering your traffic from there.

An area that we wanted to test was if it will tie bandwidth and does it throttle traffic?

How much bandwidth usage does it consume when it sorts out the traffic. When monitoring the traffic we always have issues with the bandwidth consumption and the throttling of traffic.

Everything now is moving to the cloud. If they would consider SD1 possibilities, it would give it the longevity that it needs in the market. They may not need it, as they would be able to integrate it with other SD1 platforms as an extra feature.

By definition, they are not next-generation. The next-generation is fully cloud, properly load-balanced, and you would want something that is tailored along those lines from the get-go. It would give you more deployment, less support, and less technical hands looking at the solution.

We have been dealing with Acunetix since 2017. 

We provide services to our clients.

It's a stable solution. It doesn't report a lot of false positives or false negatives. You can put it on and look at your logs and your reports.

This solution is scalable.

I haven't contacted technical support because I am supposed to be the first line of their support. Contacting them would mean that I have problems beyond my scope.

We are now doing a profile on Barracuda because we are partners but we don't have clients yet. It is very difficult to profile because we don't have a live environment. The only way we could have a live environment is if we deploy it in-house.

We deployed in-house to test the cloud solution and we are moving to LV1 solutions within our MSP.

We were bringing everything on top of a CASB, a cloud broker for security. We had to look at different solutions to see what could be brought on top of the CASBplatform and what we would be leaving out from the previous partnerships. We wanted to look at a different solution.

The initial setup is straightforward. You just need to download the client from the website or get a license from them, then you can deploy it.

It can take a couple of hours or less to deploy.

We have a team in the company.

This is a solution that I would recommend.

I would rate it an eight out of ten.

Our primary use case is to secure web applications, especially against cross-scripting and other forms of malware that happen at an application level.

The scalability is good. The scalability is more than good because it can operate both as a standalone and it can be integrated as part of applications. So that really makes it a very, very versatile solution to have.

We want to see how much bandwidth usage it consumes. When we monitor traffic we have issues with the consumption and throttling of the traffic. 

We've been using Acunetix since 2017.

It is a stable solution. It doesn't have a lot of false positives. You get your logs and reports without any problems. 

I haven't contacted technical support because I'm supposed to be the first line of their support. If I need to contact their support, it's because I have problems beyond my scope. 

The initial setup was really straightforward. You can do it even if you're not an expert, you just need to download the appliance from their website and then you deploy. It took a few hours. 

I would recommend Acunetix.

Everything is going cloud-based. They should consider implementing SD-WAN abilities. It will give them the longevity they need.

I would rate it an eight out of ten. Even though some solutions are cloud-native by definition, they are not really next generation because the next generation is fully cloud and properly load balanced.

For the last two years, we've primarily used the solution for specific scanning of external web applications for some of our clients.

For us, the most valuable aspect of the solution is the log-sequence feature.

The main components covering most of the SQL injection findings are quite useful.

We've never faced any maintenance issues.

The solution limits the number of scans. It would be much better if we could have unlimited scans.

We've been using the solution for almost two years now.

We've found the solution to be quite stable. We haven't had any issues with it at all.

The scalability of the solution is quite good. We've never faced any issues with scaling.

Currently, 15 people use the solution in our organization. They're all developers and consultants. We use it every day.

For now, everything about the solution has been fine, so we haven't reached out to technical support.

Before switching to this solution we used the Burp Suite Pro. We switched because we found this solution's findings more accurate. It has better performance.

The initial setup was very straightforward. It was easy. We didn't find it complex at all. The initial setup only takes one to two hours.

I didn't implement the solution personally, however, one of my colleagues did. The installation was handled in-house.

We buy the license annually.

We're Acunetix customers. I'm not sure which version number we are using, but it is the latest one.

Overall, I believe Acunetix to be one of the best products on the market. I'd recommend it. it's very reliable.

I'd rate it seven out of ten.

We use it as a dynamic scanner for testing our websites. We also adjust it into another tool that we use which allows us to share our report with our developers.

It has been able to find some vulnerabilities, and we've been able to remediate our websites and vulnerabilities, thanks to Acunetix. We can go back in and have them retested, which is kind of nice, because we can click on the vulnerabilities which it has found. It will also give us quite a bit of information, along with responses, so we can go back and manually test it to make sure it's not a false positive. So, it has been especially useful in that way.

The crawl only scan for trying to figure out at which points of the site that you'll actually be able to reach within the full scan. That's pretty useful. If you're just trying to test your login sequence, it is nice. It'll tell you which parts of your website it will initially scan, and you can actually go through and disable parts if you know you're not going to have to scan those parts. Then, later on, you go back and do a full scan for deep penetration of the site.

There are quite a few false positives that come out. It's mostly based upon finding XSS vulnerabilities, even though we know that XSS vulnerabilities do not exist within some of the web applications because of some frameworks we're using. So, we're not entirely sure why it finds a bunch of these cross site scripting vulnerabilities, but these are main false positives that we have come across.

You can't actually change your password after you've set it unless you go back into the administration account and you change it there. Thus, if you're locked out and don't remember your password, that's a thing.

If you're exporting vulnerabilities to view so you can ingest them into another viewer, the ability to select all the vulnerabilities would be nice. Because as of right now, you have to manually go through and click on every single vulnerability that you want to export.

With the implementation, when we started, there were a lot of issues. They've actually fixed a lot of the issues in the past (almost) year now. Initially, when you were creating a login sequence, when you wanted to edit it, you actually had to go back, open it in a text document, then edit the request that way because you weren't able to edit it through the GUI. Now, they've updated that, so you can actually go back and edit it, which is very nice.

We had some issues, not particularly bugs, like with the user interface, e.g., "Why isn't this here?" Just specific tools that we were looking for initially, which they ended up implementing later on.

We have not recently had any stability issues. We were having some issue with the speed of the login initially, but ever since they updated that, it has gotten a lot better.

Only one person is needed for maintenance. It's pretty low maintenance. They'll send you an email update when there's a physical update to the application. You just go and download the new application, then install it the same way you would have originally. It keeps all your scans and targets, so it is very easy for maintenance.

The scalability has moved along nicely and been able to keep up with the expansion of our website and the added targets. However, with a dynamic scanner, the scans take longer as the site gets larger. So, there is more tweaking here and there about what would be best in how to speed up the scans and what we really need to include when we are scanning. This is quite easy to adjust: How we are going to be scanning and what we are going to be scanning.

We have 15 plus targets. We set them up on a schedule, so we can get the most scans here and there on a continuous line. We have eight people currently using it.

Their technical support has been very active. If I have an issue, I can reach out to them and get an answer pretty quick.

I had a one-on-one meeting with a support analyst at Acunetix and gave them a bunch of feedback on what we thought. We saw some of those ideas trickling out into the next release, and some releases after that. While I don't know if they're responding directly to requests, or some other person had these suggestions ahead of us, but they definitely are putting in more positive changes.

I'm still learning how to use this solution. We were using the Burp Suite and its scan before this, which is very similar. I would actually say that the Burp Suite finds quite a bit more vulnerabilities than Acunetix does.

It was very easy to set up. It was just almost plug and play. Initially, it was not Linux compatible, but after a little while they actually came out with compatibility for Linux, which was nice.

We use it on Windows now. Initially, I wanted to set it up on a Linux box, and it didn't have compatibility for that, but they added the compatibility over the past several months, I just never really got around to installing it onto the Linux boxes. Now that we have everything already set up here, we don't really want to migrate a bunch of our scans.

The deployment took me a week to a week and a half to do, get everything set up, and all our first scans tested. However, this was from a very inexperienced point of view. I'm sure somebody who was more experienced and didn't come fresh out of college would've been able to set it up in a day.

Everything is web-based and relatively intuitive, which is very nice. Knowing what I know now versus back then, the first thing I would've done is set up a certification for a web portal. However, I installed it as it was correctly, but I was very cautious about what I was doing because I wasn't very experienced. It was a very easy install and set up.

I did the implementation with another security engineer. There is a lot of documentation to help, with a lot of forums on the Acunetix website and off of the Acunetix website.

Our license is good through June. We're really trying to ramp up here to see if it is a viable option to renew it.

We still do use Burp suite on the side. We use it a lot for manual testing and still use it for dynamic testing.

We decided to try Acunetix to see if it would find any different vulnerabilities, etc.

While there has not been any real reduction in remediation time, there has been a reduction in scan time. Because when you're doing a Burp scan, it can take a long time. Whereas, with Acunetix, you can basically just set it, then it will scan throughout the night.

On bigger sites, the speed can be a little tricky unless you are narrowing it down to smaller sections of the site. On small sites, half a million lines of code or less, it has gotten pretty nice and quick, down to a couple hours now for a whole scan. So, it's getting there. They are pushing out quite a few updates, every now and then.

There is something called AcuSensor, and you can install that on local servers for a deeper scan. This has worked for us, but we haven't installed it on all of our boxes yet, but I think we will pretty soon.

It's been used quite extensively here within our company. Every website is using this along with other scanners.

Our primary use case is scanning our websites for security flaws.

The usability and overall scan results are good.

The vendor messed up our contract when they changed the licensing scheme and downgraded our license without any notification. It was dropped from a premium license with unlimited scan targets to a professional license with 10 targets per year. This is insufficient for us because we have about 50 public websites, and twice that number between internal and development sites. We ran out of scanning targets after only two months, so we have been evaluating other products since then.

There is room for improvement with respect to technical support.

We were having trouble with our Active Directory Federation Services. They couldn't work out how to authenticate the websites.

There is room for improvement in website authentication because I've seen other products that can do it much better.

We have been using the Acunetic Vulnerability Scanner for seven years.

We have not had any problems with stability.

Scalability has not been a problem except when it comes to licensing.

Technical support was not overwhelmingly good, but it was okay. They couldn't provide solutions to every problem that we encountered, although they helped us from time to time.

The pricing is not as good as we expected. I would say that Acunetix is expensive because there are products on the market with similar features that are equally or better-priced.

When we started with Acunetix seven years ago, it was quite good in terms of being competitively priced. It was up to the task and financially suitable. Now, however, with the change in the licensing scheme, it is a rather large step in terms of price. It has gone up by a factor of 30 in the past two years.

Our experience with Acunetix has not been good, so we are in the process of switching solutions.

The product is quite good, but their sales techniques are poor and the sales teams need to be improved. They also should have provided a lot more information about the new licensing scheme when they changed it.

I would rate this solution an eight out of ten.