We performed a comparison between Invicti and Rapid7 InsightAppSec based on real PeerSpot user reviews.
Find out in this report how the two Application Security Tools solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The scanner is light on the network and does not impact the network when scans are running."
"The dashboard is really cool, and the features are really good. It tells you about the software version you're using in your web application. It gives you the entire technology stack, and that really helps. Both web and desktop apps are good in terms of application scanning. It has a lot of security checks that are easily customizable as per your requirements. It also has good customer support."
"When we try to manually exploit the vulnerabilities, it often takes time to realize what's going on and what needs to be done."
"Scan, proxify the application, and then detailed report along with evidence and remediations to problems."
"Crawling feature: Netsparker has very detail crawling steps and mechanisms. This feature expands the attack surface."
"The most valuable feature of Invicti is getting baseline scanning and incremental scan."
"The most attractive feature was the reporting review tool. The reporting review was very impressive and produced very fruitful reports."
"This tool is really fast and the information that they provide on vulnerabilities is pretty good."
"It is very convenient to get reports from the tool, which offers high-level environmental statistics."
"The most valuable feature of this solution is the graphical interface."
"The product’s most valuable feature is UI. It is easy to manage and find vulnerabilities in the application."
"It is a very robust solution."
"The initial setup for us was easy enough. We didn't face too many issues. Deployment took maybe 30 minutes. It's quite quick and doesn't cause too much trouble at the outset."
"The templates feature is very easy. You just choose the kind of attack you want on your web application, and you run it against that template and receive a report. It's great."
"The solution is stable."
"We have seen measurable decrease in the mean time to respond to threats by 20 percent."
"The solution needs to make a more specific report."
"The scanning time, complexity, and authentication features of Invicti could be improved."
"They don't really provide the proof of concept up to the level that we need in our organization. We are a consultancy firm, and we provide consultancy for the implementation and deployment solutions to our customers. When you run the scans and the scan is completed, it only shows the proof of exploit, which really doesn't work because the tool is running the scan and exploiting on the read-only form. You don't really know whether it is actually giving the proof of exploit. We cannot prove it manually to a customer that the exploit is genuine. It is really hard to perform it manually and prove it to the concerned development, remediation, and security teams. It is currently missing the static application security part of the application security, especially web application security. It would be really cool if they can integrate a SAS tool with their dynamic one."
"The support's response time could be faster since we are in different time zones."
"The scannings are not sufficiently updated."
"I think that it freezes without any specific reason at times. This needs to be looked into."
"Right now, they are missing the static application security part, especially web application security."
"Maybe the ability to make a good reporting format is needed."
"The product’s pricing could be flexible."
"The number of web applications we can scan is limited."
"The only concern I have with Rapid7 is that it does not provide enough information about vulnerabilities within AppSec."
"The reporting is definitely an aspect of the solution that's in need of some work. We found that we'd try to use widgets, but often getting them to work for us wasn't very clear. They need to be more user friendly or offer better instructions."
"The interface should be a little bit easier to manage. Sometimes, the logic that they use is kind of strange. They need to work a little bit more on their interface to make it more understandable. The interface is the only problem. I'm using Rapid7, which is very intuitive. There are other applications available in the market with a better interface. They can include more techniques or options to test different types of security because the templates are limited. It would be great to see them follow the MITRE ATT&CK framework or what is there in tools like Veracode and Synopsys."
"They should add more features. I would like to see them do a little more on static analysis and also interactivity analysis. Currently, it does very basic static analysis. It could do a little more static analysis, which is something that would help. A lot more interactivity analysis should also be there. It should basically look at security during interactivity."
"We get a lot of false positives during the tests."
"Rapid7 InsightAppSec needs improvement in detecting phishing pages."
Invicti is ranked 20th in Application Security Tools with 25 reviews while Rapid7 InsightAppSec is ranked 3rd in Dynamic Application Security Testing (DAST) with 12 reviews. Invicti is rated 8.2, while Rapid7 InsightAppSec is rated 8.6. The top reviewer of Invicti writes "A customizable security testing solution with good tech support, but the price could be better". On the other hand, the top reviewer of Rapid7 InsightAppSec writes "A highly scalable and robust product that enables users to automate scans". Invicti is most compared with OWASP Zap, Acunetix, PortSwigger Burp Suite Professional, Tenable.io Web Application Scanning and Snyk, whereas Rapid7 InsightAppSec is most compared with Rapid7 AppSpider, OWASP Zap, Fortify WebInspect, PortSwigger Burp Suite Professional and Qualys Web Application Scanning. See our Invicti vs. Rapid7 InsightAppSec report.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.