No more typing reviews! Try our Samantha, our new voice AI agent.

Barracuda Application Protection vs Invicti comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 11, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Barracuda Application Prote...
Ranking in API Security
12th
Average Rating
8.4
Reviews Sentiment
6.6
Number of Reviews
8
Ranking in other categories
No ranking in other categories
Invicti
Ranking in API Security
8th
Average Rating
8.2
Reviews Sentiment
6.8
Number of Reviews
31
Ranking in other categories
Static Application Security Testing (SAST) (10th), Container Security (24th), Software Composition Analysis (SCA) (8th), Dynamic Application Security Testing (DAST) (4th), Application Security Posture Management (ASPM) (5th)
 

Mindshare comparison

As of April 2026, in the API Security category, the mindshare of Barracuda Application Protection is 2.2%. The mindshare of Invicti is 3.4%, up from 2.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
API Security Mindshare Distribution
ProductMindshare (%)
Invicti3.4%
Barracuda Application Protection2.2%
Other94.4%
API Security
 

Featured Reviews

Salbu Kumar - PeerSpot reviewer
Manager at Cyvogenix
Application protection has strengthened web security and reduces manual effort for critical services
One area where Barracuda Application Protection could be improved is reporting customization. The dashboards are useful, but more flexible executive-level and technical reporting options would help different teams. Another area is policy tuning for complex applications. While the platform is strong overall, some advanced environments need extra fine-tuning to reduce false positives or adapt custom rules. Deeper integrations with third-party CM and DevSecOps workflows would streamline operations further. Overall, it is a solid platform, but more customization and smoother advanced tuning would make it even better. A simpler onboarding experience for new administrators would be beneficial. The platform has many strong features, but teams without deep WAF experience may need time to become fully comfortable with advanced settings. More AI-driven recommendations for rule tuning, anomaly prioritization, and false positive reduction would help smaller teams operate more efficiently. Another area is pricing flexibility for growing organizations or mid-sized businesses. Overall, the product is strong, but easier management and smarter automation would make it even more attractive.
Valavan Sivgalingam - PeerSpot reviewer
Senior Manager, Security Engineering at ESS
Dynamic testing regularly identifies web vulnerabilities and has strong false positive confirmations
It has good false positive confirmations, confirmed issues identification, and proof of exploit-related features as part of it. We use Invicti for these things in our portfolios. The solution includes Proof-Based Scanning technology. Invicti is part of our SSDLC portfolio, and DAST dynamic testing is very important for our web applications and portfolios. For both the API endpoints and web applications, we do regular testing on a monthly basis for all our releases. Invicti does a good job. The only concern is on the performance side, but other than that, we find it really helpful in identifying web vulnerabilities. A full scan takes more time based on your website and other factors, but for us, it takes more than two to three days. The scan performance can be improved upon. When we check with them, they discuss proof-based scanning and related aspects. However, there could be intermittent results that could help us.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Within the first six to seven months of deployment, I saw a 60% reduction in security incidents, incidents affecting the web application which directly translated into fewer service interruptions and less time spent on incident response."
"Barracuda Application Protection has positively impacted my organization by managing traffic well, enhancing access security, operational efficiency, and user experience, leading to customer satisfaction."
"Barracuda Application Protection's best features are protecting APIs and defending against zero-day vulnerabilities."
"Barracuda Application Protection has positively impacted my organization as it is used for multiple clients, and I am also backing up the Exchange servers, which frequently experience attacks in customer environments, allowing for quick restoration, even from yesterday or the day before yesterday."
"Within the first six months of deployment, we have seen a 60% reduction in security incidents affecting the web application, which directly translated into fewer service interruptions and less time spent on incident response."
"Barracuda Application Protection had a positive impact mainly in terms of improved visibility and better handling of automated attack traffic."
"Barracuda Application Protection is helping our current organization in a meaningful way by reducing web-based security incidents through blocking malicious traffic before it reaches the application and end-user machines."
"Barracuda Application Protection has been a solid and dependable solution for protecting public-facing applications."
"The most valuable features that I've found in this solution was the level of accuracy and also that the process of scanning was very quick and we're easily able to change the frame of a scan."
"I would tell potential users that it's really one of the best products in the market for web application security or Dynamic Application Security Testing (DAST)."
"It correctly parses DOM and JS and has really good support for URL Rewrite rules, which is important for today's websites."
"Technical support is very professional, 10/10."
"We use simultaneous products, but I found this to be the best of the lot."
"The scanner is light on the network and does not impact the network when scans are running."
"It has a comprehensive resulting mechanism. It is a one-stop solution for all your security testing mechanisms."
"This tool is really fast and the information that they provide on vulnerabilities is pretty good."
 

Cons

"My only concerns are that it is not very user-friendly and the response time is slow."
"Additionally, I can say that deeper API security features such as automation, API discovery, scheme validations, and improved protections for modern environments are needed."
"Another area is pricing flexibility for growing organizations or mid-sized businesses."
"Policy fine-tuning requires a lot of effort and time from the employees, such as the senior SOC analyst, and sometimes it gives a lot of false positives that also require manual effort."
"Improving the operating system structure, firmware, and overall performance would enhance loading times for devices."
"Barracuda Application Protection could be improved with a more user-friendly interface to enable all types of people to be able to use it, especially the less technical users."
"One area where Barracuda Application Protection can improve is in policy tuning and ease of configuration, especially for complex application and API-heavy environments."
"I do not have much to say about the improvement, but a more innovative solution for sniffing more on the network would be great, and having the advanced ability to close off ports when they could be getting tested from hackers for intrusion would be helpful."
"Right now, they are missing the static application security part, especially web application security."
"Asset scanning could be better. Once, it couldn't scan assets, and the issue was strange. The price doesn't fit the budget of small and medium-sized businesses."
"Invicti's reporting capabilities need enhancement."
"The scanner itself should be improved because it is a little bit slow."
"The licensing model should be improved to be more cost-effective. There are URL restrictions that consume our license. Compared to other DAST solutions and task tools like WebInspect and Burp Enterprise, Invicti is very expensive. The solution’s scanning time is also very long compared to other DAST tools. It might be due to proof-based scanning."
"Maybe the ability to make a good reporting format is needed."
"Maybe supported clients can be improved. It still does not search vulnerabilities in DB2 databases, for example."
"They don't really provide the proof of concept up to the level that we need in our organization."
 

Pricing and Cost Advice

Information not available
"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."
"We never had any issues with the licensing; the price was within our assigned limits."
"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."
"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."
"OWASP Zap is free and it has live updates, so that's a big plus."
"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."
"It is competitive in the security market."
"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."
report
Use our free recommendation engine to learn which API Security solutions are best for your needs.
890,124 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
No data available
Financial Services Firm
16%
Manufacturing Company
9%
Computer Software Company
7%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise2
Large Enterprise25
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise4
Large Enterprise13
 

Questions from the Community

What is your experience regarding pricing and costs for Barracuda Application Protection?
My experience with pricing, setup cost, and licensing is that I feel it is a bit costlier, but the features that it provides are good. However, I am not the one making decisions on costing and limi...
What needs improvement with Barracuda Application Protection?
I have one thing to share about the features. I did not observe any major stability issues. The platform works reliably during monitoring. If I want to tell what needs improvement, policy tuning re...
What is your primary use case for Barracuda Application Protection?
I work with Barracuda Application Protection as part of SOC monitoring and web application security, which helped me to detect and block web-based attacks such as SQL injection, suspicious requests...
What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?
The setup cost is pretty competitive. For example, if you want to talk about the SAST license, it comes to about $150 or sometimes less than $100, depending on the conversion or the number of licen...
What needs improvement with Invicti?
At this time, there is nothing that comes to mind. However, most of the products in the market are pretty much neck-to-neck competitors. Speaking about it, there are a couple of factors which they ...
What is your primary use case for Invicti?
I have worked on a couple of products, specifically in web application security. I have worked on Invicti, and with respect to PAM, I have worked with BeyondTrust. I have not worked specifically fo...
 

Also Known As

No data available
Netsparker
 

Overview

 

Sample Customers

Information Not Available
Samsung, The Walt Disney Company, T-Systems, ING Bank
Find out what your peers are saying about Barracuda Application Protection vs. Invicti and other solutions. Updated: April 2026.
890,124 professionals have used our research since 2012.