Try our new research platform with insights from 80,000+ expert users

Checkmarx One vs Invicti comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex Cloud by Palo Alto N...
Sponsored
Average Rating
10.0
Reviews Sentiment
8.7
Number of Reviews
1
Ranking in other categories
Vulnerability Management (35th), Cloud Workload Protection Platforms (CWPP) (19th), Cloud Security Posture Management (CSPM) (22nd), Cloud-Native Application Protection Platforms (CNAPP) (16th), Data Security Posture Management (DSPM) (13th), Software Supply Chain Security (14th), Cloud Infrastructure Entitlement Management (CIEM) (7th), Application Security Posture Management (ASPM) (9th), Cloud Detection and Response (CDR) (8th)
Checkmarx One
Average Rating
7.6
Reviews Sentiment
6.9
Number of Reviews
71
Ranking in other categories
Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Vulnerability Management (22nd), Container Security (23rd), Static Code Analysis (3rd), API Security (6th), Dynamic Application Security Testing (DAST) (4th), DevSecOps (5th), Risk-Based Vulnerability Management (10th), Application Security Posture Management (ASPM) (3rd)
Invicti
Average Rating
8.2
Reviews Sentiment
6.7
Number of Reviews
30
Ranking in other categories
Static Application Security Testing (SAST) (15th), API Security (10th), Dynamic Application Security Testing (DAST) (5th)
 

Featured Reviews

PG
Identifies vulnerabilities and enables proactive remediation through AI/ML capabilities
The solution helps me to understand misconfigurations in AWS or Azure cloud environments. It detects misconfigurations, suggests remedial actions, and helps identify vulnerabilities across cloud platforms. It provides action recommendations for CVEs against particular vulnerabilities The tool…
Syed Hasan - PeerSpot reviewer
Partner experiences excellent technical support and seamless initial setup
In my opinion, if we are able to extract or show the report, and because everything is going towards agent tech and GenAI, it would be beneficial if it could get integrated with our code base and do the fix automatically. It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from. This would be really helpful.
Kunal M - PeerSpot reviewer
Proactive scanning measures and realistic audit recommendations enhance development focus
Invicti's proactive scanning measures vulnerabilities each time we deploy or push code to a new environment. This feature helps us focus on priorities and prioritize the development team's effort, integrating seamlessly with DevOps to facilitate proactive scans of environments. Invicti also provides audit recommendations that are quite realistic, making it easy to discuss plans with developers.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Overall, Cortex Cloud by Palo Alto Networks is a technically strong product, and I rate it ten out of ten."
"Apart from software scanning, software composition scanning is valuable."
"The most valuable features of Checkmarx are its integration with multiple SCM solutions and CICD tools, its ability to scale according to user licenses, and the quick scanning process."
"We use the solution to validate the source code and do SAST and security analysis."
"The setup is very easy. There is a lot of information in the documents which makes the install not difficult at all."
"The identification of verification-related security vulnerabilities is really important and one of the key things. It also identifies vulnerabilities for any kind of third-party tool coming into the system or any third-party tools that you are using, which is very useful for avoiding random hacking."
"The product's most valuable feature is static code and supply chain effect analysis. It provides a lot of visibility."
"We use the solution for dynamic application testing."
"We were using HPE Security Fortify to scan code for security vulnerabilities, but it can scan only after a successful compile. If the code has dependencies or build errors, the scan fails. With Checkmarx, pre-compile scanning is seamless. This allows us to scan more code."
"Netsparker provides a more interactive interface that is more appealing."
"Invicti's proactive scanning measures vulnerabilities each time we deploy or push code to a new environment."
"It correctly parses DOM and JS and has really good support for URL Rewrite rules, which is important for today's websites."
"It has very good integration with the CI/CD pipeline."
"It has a comprehensive resulting mechanism. It is a one-stop solution for all your security testing mechanisms."
"Scan, proxify the application, and then detailed report along with evidence and remediations to problems."
"Invicti is a good product, and its API testing is also good."
"Invicti is part of our SSDLC portfolio, and DAST dynamic testing is very important for our web applications and portfolios."
 

Cons

"Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed."
"Licensing models and Swift language support are the aspects in which this product needs to improve. Swift is a new language, in which major customers require support for lower prices."
"I would like the product to include more debugging and developed tools. It needs to also add enhancements on the coding side."
"The solution's user interface could be improved because it seems outdated."
"The interactive application security testing, or IAST, the interactive part where you're looking at an application that lives in a runtime environment on a server or virtual machine, needs improvement."
"Integration into the SDLC (i.e. support for last version of SonarQube) could be added."
"I think the CxAudit tool has room for improvement. At the beginning you can choose a scan of a project, but in any event the project must be scanned again (wasting time)."
"I expect application security vendors to cover all aspects of application security, including SAST, DAST, and even mobile application security testing. And it would be much better if they provided an on-premises and cloud option for all these main application security features."
"The validation process needs to be sped up."
"Invicti's reporting capabilities need enhancement. We need enterprise-level information instead of repo-level details. Unlike Appiro, Invicti does not provide portfolio-level insights into vulnerability remediation over time."
"The scannings are not sufficiently updated."
"Netsparker doesn't provide the source code of the static application security testing."
"The custom attack preparation screen might be improved."
"The support's response time could be faster since we are in different time zones."
"The solution needs to make a more specific report."
"They could enhance the support for data swap testing for the platform."
"They don't really provide the proof of concept up to the level that we need in our organization. We are a consultancy firm, and we provide consultancy for the implementation and deployment solutions to our customers. When you run the scans and the scan is completed, it only shows the proof of exploit, which really doesn't work because the tool is running the scan and exploiting on the read-only form. You don't really know whether it is actually giving the proof of exploit. We cannot prove it manually to a customer that the exploit is genuine. It is really hard to perform it manually and prove it to the concerned development, remediation, and security teams. It is currently missing the static application security part of the application security, especially web application security. It would be really cool if they can integrate a SAS tool with their dynamic one."
 

Pricing and Cost Advice

Information not available
"The number of users and coverage for languages will have an impact on the cost of the license."
"Be cautious of the one-year subscription date. Once it expires, your price will go up."
"If you want more, you have to pay more. You have to pay for additional modules or functionalities."
"Checkmarx is comparatively costlier than other products, which is why some of the customers feel reluctant to go for it, though performance-wise, Checkmarx can compete with other products."
"It is a good product but a little overpriced."
"This solution is expensive. The customized package allows you to buy additional users at any time."
"The solution is costly."
"The pricing was not very good. This is just a framework which shouldn’t cost so much."
"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."
"We never had any issues with the licensing; the price was within our assigned limits."
"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."
"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."
"OWASP Zap is free and it has live updates, so that's a big plus."
"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."
"The price should be 20% lower"
"It is competitive in the security market."
report
Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.
872,778 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Performing Arts
14%
Computer Software Company
9%
Manufacturing Company
8%
Comms Service Provider
8%
Financial Services Firm
19%
Computer Software Company
13%
Manufacturing Company
10%
Government
6%
Financial Services Firm
18%
Computer Software Company
14%
Manufacturing Company
9%
Government
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business30
Midsize Enterprise9
Large Enterprise38
By reviewers
Company SizeCount
Small Business13
Midsize Enterprise4
Large Enterprise13
 

Questions from the Community

What is your experience regarding pricing and costs for Cortex Cloud by Palo Alto Networks?
The solution is costly, with high-end capabilities suitable for enterprises. It is less affordable for startups or sm...
What needs improvement with Cortex Cloud by Palo Alto Networks?
Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed.
What is your primary use case for Cortex Cloud by Palo Alto Networks?
The solution helps me to understand misconfigurations in AWS or Azure cloud environments. It detects misconfiguration...
What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...
What do you like most about Checkmarx?
Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.
What is your experience regarding pricing and costs for Checkmarx?
The pricing is relatively expensive due to the product's quality and performance, but it is worth it.
What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?
As a technical user, I do not handle pricing or licensing, but I am aware that Invicti offers flexible licensing mode...
What do you like most about Invicti?
The most valuable feature of Invicti is getting baseline scanning and incremental scan.
What needs improvement with Invicti?
The main concern is on the performance side, but other than that, we find it really helpful in identifying web vulner...
 

Also Known As

No data available
No data available
Netsparker
 

Overview

 

Sample Customers

Information Not Available
YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Samsung, The Walt Disney Company, T-Systems, ING Bank
Find out what your peers are saying about Checkmarx One vs. Invicti and other solutions. Updated: September 2025.
872,778 professionals have used our research since 2012.