I believe we also evaluated Zap and Portswigger Burp suite.

The other options I evaluated are AppSpider, Netsparker, and HCL AppScan.

We went with the recommendations of our parent company. This was one of the approved solutions.

Acunetix is the fastest scanner available compared to applications like Netsparker and Fortify WebInspect. The longest scan with Acunetix, and it was for a huge web application, took only four hours. Other scanners did the job in six to eight hours. 

While I like Netsparker, it is really slow compared to other scanners.

There were other tools in the running, although I don't remember off the top of my head which ones. At the time, Acunetix was the winner mainly based on pricing and capability. 

As I said, Acunetix is a secondary tool for us. We use Qualys as our primary DAST solution and when that gets overloaded we turn to Acunetix to supplement some of the load that we're putting on our prime solution.

Compared to other vendors in the field, the speed of Acunetix is just about average. Something like Micro Focus WebInspect scans about ten percent faster. If you're looking at IBM AppScan it might be five percent faster. We're not looking at a huge percentage difference in the time Acunetix takes to scan versus others.

The false-positive rate of Acunetix is definitely not perfect. No tool is going to avoid all false-positives. The false-positive rate of Acunetix falls - I don't want to say below average - but it's almost the same as everyone else. What I have to say, honestly, is that I do find myself correcting a lot of the false-positives that show up in Acunetix right now. We don't get a 50 percent margin, but I estimate that 25 percent of the reported vulnerabilities are false-positives in Acunetix.

We still do use Burp suite on the side. We use it a lot for manual testing and still use it for dynamic testing.

We decided to try Acunetix to see if it would find any different vulnerabilities, etc.

Our experience with Acunetix has not been good, so we are in the process of switching solutions.

We are in the process of evaluating other solutions. We are looking to switch because of the complex licensing. 

I tried some of the other commercial web vulnerability scanners such as Burp Professional embedded and IBM Rational AppScan.

We just did a PoC with a couple of different vendors, and we liked Acunetix the most.

We are very comfortable with the granularity of tests. Sometimes, for certain specific areas, we use different tools, but we feel that Acunetix is much more helpful for all the development teams in understanding the output of the system. In certain cases, the scope of the application and the exposure of the application is varied and then, for additional security measures, we use different tools to evaluate these applications. That makes us much more comfortable in explaining to our customers that we don't only rely on a single tool, that we use multiple tools to identify things in complex environments. Customers want to have different views, not only a single view, of application testing. 

Acunetix provides the primary vulnerability assessment. Once we believe we can rely on Acunetix, we will be able to save money on other licenses. The most interesting part is that the application security vulnerability reports of Acunetix are much more explainable in simple terms, for developers.

Also, the jargon that some of the applications that I have looked at—certain open source applications—use and the setup required are highly technical. You have to do a lot of maintenance to keep the environment up and running. Acunetix is a lot more comfortable. Newly recruited people and project managers can easily understand it. This is one of the winning points of Acunetix.

In our tests of Acunetix, we didn't find much difference, performance-wise, when comparing it with other applications. It's lightweight but it doesn't matter if it is a little bit heavy, since it provides a much broader spectrum of vulnerabilities. Acunetix is much more customizable for granular levels of testing.

In terms of the amount of time it takes to complete a scan using Acunetix, a web application, for example, with two or three endpoints takes between half an hour and 40 minutes. If I use the Kali Linux, it will take more time, and then you have to do much more customization which requires heavy technical knowledge. Other solutions take time to scan and may give a much more broader spectrum, but they do not identify vulnerabilities for the purpose of fixing them. They identify them to explore them. Acunetix scans for most commonly identified issues. The problem with other solutions is that, while we may be able to see a lot of vulnerabilities, if the solution has not been identified we end up with questions as to whether we are able to release it or not. We don't come up against that issue with Acunetix.

Zap, BurpSuite where other tools evaluated.