No more typing reviews! Try our Samantha, our new voice AI agent.

FortiDevSec vs Invicti Web + API comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 6, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Vulnerability Management
10th
Average Rating
8.6
Reviews Sentiment
7.1
Number of Reviews
53
Ranking in other categories
Container Security (11th), Cloud Workload Protection Platforms (CWPP) (9th), Cloud Security Posture Management (CSPM) (8th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (7th)
FortiDevSec
Ranking in Vulnerability Management
70th
Average Rating
9.0
Reviews Sentiment
7.5
Number of Reviews
1
Ranking in other categories
Static Application Security Testing (SAST) (46th)
Invicti Web + API
Ranking in Vulnerability Management
30th
Average Rating
7.8
Reviews Sentiment
6.7
Number of Reviews
36
Ranking in other categories
Application Security Tools (16th), Static Application Security Testing (SAST) (11th), DevSecOps (7th)
 

Featured Reviews

reviewer2859021 - PeerSpot reviewer
Sr Security Engineer at a tech vendor with 5,001-10,000 employees
Risk-based triage has transformed container security and now prioritizes high-impact threats
The best features Qualys TotalCloud offers currently include managing cloud infrastructure and container security while facing major challenges such as alert fatigue. Traditional vulnerability scanners flag hundreds of CVEs on short-lived Kubernetes containers, some of which have no internet exposure or are gone before we can even triage them. I leverage Qualys TotalCloud to move beyond static CVSS. I use it to implement runtime exposure, correlation risk reprioritization, and shift-left integration. This notifies developers to fix a base image upstream rather than patching live ephemeral instances. In my work with cloud and container security, the biggest operational hurdle was alert fatigue. I use Qualys to shift left from static CVSS severity to context-aware risk prioritization. I correlated raw vulnerability data with real-time risk factors such as public network exposure, active runtime execution, or overly permissive IAM roles. This allows us to immediately drop the priority of isolated containers and escalate lower-severity CVEs that sit on an exposed, high-risk path. We can map these findings directly back to our CI/CD pipelines so developers can patch the root base images upstream. We have drastically cut down the signal-to-noise ratio, saved a lot of manual hours doing triage work, and ensured engineering effort goes directly towards high-impact risk reduction.
MohammedJaffir - PeerSpot reviewer
Founder at Cipheroot Cybersecurity Solutions
Scans codes in CI/CD pipelines and identifies vulnerabilities
In a customer environment, developers integrate their code with CI/CD pipelines. Most developers use cloud platforms like AWS or Azure and project management tools. FortiDevSec integrates with these CI/CD pipelines using agents such as YAML files. Once integrated, FortiDevSec scans the source code using our product or within the IDE. The most valuable feature is the ability to identify known vulnerabilities in applications by generating reports easily. This development gamification is very useful for developers. Compared to TechSmart and Fortify, FortiDevSec has similar features, but it is much easier to use because of its simple setup. SysTrack, for example, is not very simple. For the CI/CD pipeline, we only need to integrate a YAML file into the security process. Compared to other products, the tool requires fewer steps. We must integrate one file with the CI/CD pipeline, automatically pulling the code report to the repository. Using our API and username, it is easy to scan the environment. The tool's integration is also easy.
Rahul Kumar - PeerSpot reviewer
Senior Engineer - Penetration Tester at a government with 10,001+ employees
Identifies vulnerabilities across bulk web applications but needs better support and cleaner reports
The best feature Acunetix offers is the centralized dashboard and the quality of reports it generates, which includes various options for selecting reports and developer options for directly sharing the reports with developers. The centralized dashboard of Acunetix gives visibility into the security aspects of mass applications; for instance, with more than 200 applications, it provides a valuable overview of findings and necessary fixes, along with a high-level summary that helps us achieve compliance through monthly and sometimes weekly scanning. In terms of reporting, Acunetix is excellent because it can generate different types of reports, such as an executive summary report, detailed reports, and developer reports that can be shared directly with developers. Acunetix positively impacts my organization by helping identify outdated libraries and applications, including legacy applications vulnerable to old attacks based on OWASP Top 10, thus aiding in compliance checks for PCI DSS and OWASP. Acunetix provides a centralized report with compliance-related aspects and a vulnerability timeline, effectively helping reduce vulnerabilities and save time.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"One of the most valuable features of Qualys TotalCloud is FlexScan, which is specifically for internet-facing VMs. We found this feature to be very useful. It was a key differentiator for us."
"By integrating TotalCloud, we have significantly reduced vulnerabilities in our deployment pipeline."
"I depend heavily on the reports that I have from this tool."
"TotalCloud's best feature is the integration of cloud accounts. It helps with the risk and security posture management of our cloud infrastructure."
"The biggest strengths of Qualys TotalCloud are that it is pretty good at cloud visibility, has easy integration, and also has multi-cloud compatibility."
"Qualys TotalCloud's most valuable features are its cloud security posture management, Kubernetes, and container security capabilities."
"I would recommend Qualys TotalCloud to other users because it is cost-efficient and has a good return on investment."
"One of the features I appreciate is the ability to generate daily reports without relying on anyone else."
"In a customer environment, developers integrate their code with CI/CD pipelines. Most developers use cloud platforms like AWS or Azure and project management tools. FortiDevSec integrates with these CI/CD pipelines using agents such as YAML files. Once integrated, FortiDevSec scans the source code using our product or within the IDE."
"After two years it's about 300%."
"The scalability is more than good; it can operate both as a standalone and it can be integrated with other applications, which makes it a very versatile solution to have, and this solution is simple enough, especially with the cloud."
"The solution is comprehensive and easy to use."
"One of the features that I feel is groundbreaking, that I would like to see expanded on, is the IAS feature: The Interactive Application Security Testing module that gets loaded onto an application on a server, for more in-depth, granular findings. I think that is really neat. I haven't seen a lot of competitors doing that."
"It has been able to find some vulnerabilities, and we've been able to remediate our websites and vulnerabilities, thanks to Acunetix."
"Their technical support has been very active. If I have an issue, I can reach out to them and get an answer pretty quick."
"As a team, it's helped us to deliver better security assessments."
"Acunetix is the best service in the world."
 

Cons

"The main area needing improvement is integration. Although the team is strengthening TotalCloud, integration can be enhanced with SIEM, SOAR, ITSM, and other sources."
"It has been working very well, but it would be helpful if the dashboard could generate reports tailored to specific compliance needs. For example, in India, we have to comply with RBI and SEBI guidelines. It w"
"It is already perfect, but they can bring some newer dashboards and customization options for the dashboard. It would be great to be able to include on-prem assets on the dashboard."
"Qualys TotalCloud's increasing complexity, due to the development and deployment of multiple solutions, is making the GUI difficult to navigate."
"The support process is inefficient due to the excessive number of replies required when submitting tickets."
"An area for improvement would be to focus on risks related to AI, such as large language models and potential data leakage."
"The cost of Qualys TotalCloud is high and could be more competitive."
"The areas in the solution that have room for improvement include the UI/UX design, which should be improved, and they should integrate more artificial intelligence into the product."
"The only drawback I see with FortiDevSec is the lack of extensions."
"The vulnerability identification speed should be improved."
"In terms of additional features, we are currently missing some tools that would allow us to work more efficiently with the mobile environment, with Android and iOS."
"It would be nice to have a feature to "retest" only a single vulnerability that the customer reports as patched, and delete it from the next scans since it has already been patched."
"I had some issues with the JSON parameters where it found some strange vulnerabilities, but it didn't alert the person using it or me about these vulnerabilities, e.g., an error for SQL injection."
"However, it doesn't seem very helpful or useful for scanning web services, and that has what I feel that the organization could work better on that."
"It is difficult to create a proxy connection."
"I rate its stability six out of ten."
"There is room for improvement in website authentication because I've seen other products that can do it much better."
 

Pricing and Cost Advice

"Qualys TotalCloud offers competitive pricing given its comprehensive suite of features, including integration, assessment, remediation, and detection capabilities, all within a single platform."
"Although Qualys TotalCloud is relatively expensive due to its unique automation features, its cost-effectiveness is rated an eight out of ten, with ten being the most costly."
"Qualys TotalCloud is cost-efficient and was selected for its value compared to other products."
"I am not sure about the pricing. From what I understand, it is a bit on the higher side, but I do not have the exact numbers."
"Qualys TotalCloud is expensive, but it offers a premier solution with no headaches."
"Its price seems higher compared to other tools, but it is worth it. If they could adjust the pricing and make it comparable with other tools, that would be great."
"As a middle management member, I do not have direct pricing knowledge, but based on the knowledge from our meetings, its pricing is competitive."
"Qualys TotalCloud offers cost-effective licensing flexibility."
Information not available
"The pricing and licensing are reasonable to a point. In order to run multiple scans at a time, we are going to have to purchase a 100 count license, which is an overkill. Though, compared to what we were paying for, the cost seems reasonable."
"The costs aren't very expensive. It costs around $3000 or $4000."
"Acunetix was around the same price as all the other vendors we looked at, nothing special."
"It is a bit expensive. If you need to check five applications, you have to pay almost 14,000. It is an agreement for two years at 7,000 per year for only five applications. You cannot change the applications in the license. So, you are stuck with the same license for the five applications for one full year."
"The price is exceptionally high."
"The solution is expensive."
"When compared with other products, the pricing is a little bit high. But it gives value for the price. It serves the purpose and is worthwhile for the price we pay."
"The pricing is a little high, and moreover, it's kind of domain-based."
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
917,433 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
18%
Outsourcing Company
12%
Manufacturing Company
11%
Financial Services Firm
10%
Construction Company
23%
Comms Service Provider
12%
Manufacturing Company
8%
Outsourcing Company
8%
Manufacturing Company
12%
Financial Services Firm
11%
Comms Service Provider
11%
Computer Software Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise10
Large Enterprise38
No data available
By reviewers
Company SizeCount
Small Business18
Midsize Enterprise7
Large Enterprise19
 

Questions from the Community

What is your experience regarding pricing and costs for Qualys TotalCloud?
I was not involved in pricing, setup cost, and licensing, but I can say that the setup was fast, within a quarter, an...
What needs improvement with Qualys TotalCloud?
In terms of improvements, the features we are using in Qualys TotalCloud are working in the best optimal way, and I d...
What is your primary use case for Qualys TotalCloud?
I have been using Qualys TotalCloud for the last eight months to scan the hardware and the virtual devices in our inf...
Ask a question
Earn 20 points
What is your primary use case for Acunetix Vulnerability Scanner?
In a typical enterprise environment, Acunetix is mainly used for visibility, detection, and investigation across netw...
What advice do you have for others considering Acunetix Vulnerability Scanner?
I advise that Acunetix is the best option. Invest time in proper initial configuration and scope definitions. The too...
What is your experience regarding pricing and costs for Acunetix?
Everything is perfect and good, including the pricing and all related aspects.
 

Also Known As

Qualys TotalCloud with FlexScan
No data available
AcuSensor
 

Overview

 

Sample Customers

Information Not Available
Information Not Available
Joomla!, Digicure, Team Random, Credit Suisse, Samsung, Air New Zealand
Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Static Application Security Testing (SAST). Updated: October 2026.
917,433 professionals have used our research since 2012.