Invicti Web + API vs OpenText Core Application Security comparison

Invicti Web + API vs. OpenText Core Application Security

September 2026

Download the complete report

Helped 915,533 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

ROI

Sentiment score

6.8

Acunetix improves security by identifying vulnerabilities, saving time and money, though ROI is variable but valued by many.

Sentiment score

3.7

OpenText Core Application Security automates scans, enhances security, reduces costs, and is essential for minimizing risks and data leaks.

It saves a significant amount of time by covering attack surfaces.

Abdullah Ozkan

Information Security Engineer at Tübitak Bilgem

I have seen a return on investment, as Acunetix helps reduce the man-days and effort needed for scanning bulk applications through automated assessments.

For more quotes and insights, download the Invicti Web + API report

Senior Engineer - Penetration Tester at a government with 10,001+ employees

There is definitive ROI if OpenText Core Application Security is deployed properly; it substantially reduces efforts in securing the solution while averting various application-related risks.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Customer Service

Sentiment score

6.7

Acunetix customer service is responsive and helpful, though some users note delays and prefer reseller involvement for better support.

Sentiment score

7.0

Customer service is praised for responsiveness, but technical support experiences vary, with both effective assistance and unresolved issues.

For high-severity issues, they reach out within two to three hours, and for critical issues, a response is received within 15 minutes.

Lead Cybersecurity at TBO

The technical support from Invicti is very good and fast.

Abdullah Ozkan

Information Security Engineer at Tübitak Bilgem

Support staff not being familiar with the problem.

For more quotes and insights, download the Invicti Web + API report

Senior Engineer - Penetration Tester at a government with 10,001+ employees

Support tickets often stay open for one month to three months, which leads to customer frustration.

Diego Caicedo Lescano

Chief Innovation Officer at SAGGA

I had direct interaction with them, which facilitated how we onboarded Fortify.

Lead Cybersecurity at TBO

The technical support from OpenText is very good.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Scalability Issues

Sentiment score

7.0

Acunetix is versatile for large environments, easy to scale, but licensing and compatibility can be challenging for some.

Sentiment score

7.2

OpenText Core Application Security scales effectively in the cloud but faces pricing and scan-related challenges across industries.

Acunetix can handle increasing workloads and more applications easily.

For more quotes and insights, download the Invicti Web + API report

Senior Engineer - Penetration Tester at a government with 10,001+ employees

If a customer wants to know the tools and the technology used for their application to scan their application, they provide less information on that.

Lead Cybersecurity at TBO

OpenText Core Application Security is highly scalable; it is running on the cloud, and elasticity is one of the best points of a cloud environment.

Wagner Azevedo

Cloud Security Manager at T-Systems International GmbH

Fortify is superior to many solutions because of its scalability and that it does not require massive compute capabilities for its SAST and sandboxing features.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Stability Issues

Sentiment score

8.2

Acunetix is reliable, with stable performance, minimal issues, easy maintenance, and consistent results without unexpected downtimes.

Sentiment score

8.7

OpenText Core Application Security is reliable with minor resource concerns, consistent updates, and occasional JavaScript-related performance issues.

No quotes available

For more quotes and insights, download the Invicti Web + API report

OpenText Core Application Security is stable and has minimal downtime, benefitting from AWS cloud availability.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Room For Improvement

Acunetix users want better accuracy, integration, ease of use, and support due to high costs and limited features.

OpenText Core Application Security faces efficiency, integration, and usability challenges, prompting calls for improvements in AI, interfaces, and pricing.

The main concern is related to false positives; Acunetix needs to work on identifying valid and invalid findings.

For more quotes and insights, download the Invicti Web + API report

Lead Cybersecurity at TBO

I could supply it with maybe a Swagger file or a JSON file, and Acunetix would pick it up, scan all the endpoints according to the OWASP Top Ten, and give me remediation and actionable remediation reports.

Adetunji Adeoje

Team Lead, Application Security at a financial services firm with 5,001-10,000 employees

Acunetix should have better integration with newer tools such as GitHub and Azure DevOps.

KashifJamil

CEO at Xcelliti

It would be beneficial if Fortify could check for CVEs (Common Vulnerabilities and Exposures) in third-party libraries, which I currently use a separate dependency checker tool for.

reviewer2646048

Lead Developer at a legal firm with 1,001-5,000 employees

One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together.

Lead Cybersecurity at TBO

I would say OpenText Core Application Security is not very user-friendly in terms of price; it is quite high.

For more quotes and insights, download the OpenText Core Application Security report

Co-Founder at Insecsys Technologies Private Limited

Setup Cost

Acunetix pricing is considered high, with criticism over transparency and complexity, though some appreciate its value despite increases.

OpenText Core Application Security is considered costly, but features and integration often justify the price for users.

The pricing cost is affordable for small and mid-sized organizations, and when compared to Checkmarx, it is significantly affordable, as Checkmarx is quite expensive.

For more quotes and insights, download the Invicti Web + API report

Lead Cybersecurity at TBO

We secured a special licensing model for penetration testing companies, which is cost-effective.

Abdullah Ozkan

Information Security Engineer at Tübitak Bilgem

The pricing of Acunetix is pretty expensive and could be improved.

Srinivas Walikar

Senior Business Development Manager at Intouch World

No quotes available

For more quotes and insights, download the OpenText Core Application Security report

Valuable Features

Acunetix provides comprehensive, accurate vulnerability identification and management with a user-friendly interface for cloud and on-premises deployment.

OpenText Core Application Security is valued for vulnerability detection, DevOps integration, comprehensive scanning, customization, and enterprise scalability.

Its most valuable role is in enhancing security by identifying potential vulnerabilities efficiently.

Srinivas Walikar

Senior Business Development Manager at Intouch World

The solution is excellent at detecting SQL injection and cross-site scripting vulnerabilities.

KashifJamil

CEO at Xcelliti

For more quotes and insights, download the Invicti Web + API report

Senior Engineer - Penetration Tester at a government with 10,001+ employees

Fortify helps me find serious issues, such as developers inadvertently leaving access tokens, including API access tokens, in the source code.

reviewer2646048

Lead Developer at a legal firm with 1,001-5,000 employees

On demand you have two levels of reports: the first from the tool, which is the same as we can get from Fortify on-premises, and a next level reporting made by experts from OpenText, leading to a more condensed and precise report as level three.

Diego Caicedo Lescano

Chief Innovation Officer at SAGGA

Additionally, you can integrate Fortify in CICD pipeline, so you get real-time updates about the security issues in your pipeline.

For more quotes and insights, download the OpenText Core Application Security report

Lead Cybersecurity at TBO

Categories and Ranking

Invicti Web + API

Ranking in Application Security Tools

16th

Ranking in Static Application Security Testing (SAST)

11th

Average Rating

7.8

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

Vulnerability Management (30th), DevSecOps (7th)

OpenText Core Application S...

Ranking in Application Security Tools

12th

Ranking in Static Application Security Testing (SAST)

9th

Average Rating

8.0

Reviews Sentiment

7.0

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of October 2026, in the Application Security Tools category, the mindshare of Invicti Web + API is 2.4%, down from 2.5% compared to the previous year. The mindshare of OpenText Core Application Security is 3.4%, down from 3.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools Mindshare Distribution
Product	Mindshare (%)
OpenText Core Application Security	3.4%
Acunetix	2.4%
Other	94.2%

Application Security Tools

Featured Reviews

Identifies vulnerabilities across bulk web applications but needs better support and cleaner reports

Senior Engineer - Penetration Tester at a government with 10,001+ employees

The best feature Acunetix offers is the centralized dashboard and the quality of reports it generates, which includes various options for selecting reports and developer options for directly sharing the reports with developers. The centralized dashboard of Acunetix gives visibility into the security aspects of mass applications; for instance, with more than 200 applications, it provides a valuable overview of findings and necessary fixes, along with a high-level summary that helps us achieve compliance through monthly and sometimes weekly scanning. In terms of reporting, Acunetix is excellent because it can generate different types of reports, such as an executive summary report, detailed reports, and developer reports that can be shared directly with developers. Acunetix positively impacts my organization by helping identify outdated libraries and applications, including legacy applications vulnerable to old attacks based on OWASP Top 10, thus aiding in compliance checks for PCI DSS and OWASP. Acunetix provides a centralized report with compliance-related aspects and a vulnerability timeline, effectively helping reduce vulnerabilities and save time.

Read full review

Supports secure development pipelines and improves issue detection but limits internal visibility and needs broader dashboard integration

Lead Cybersecurity at TBO

If you have an internal team and you want your internal team to validate false positives, basically to determine whether it's a valid issue or an invalid issue, then I wouldn't recommend it much. That was the only reason we migrated from Fortify on Demand to another solution. Fortify has another tool which is Fortify WebInspect. On Demand is the outsourcing solution, and WebInspect you can use with your in-house team, which is basically the product developed by the Fortify team. For automated scanning, Fortify helps a lot. Regarding the visibility for the internal team, everyone is moving toward the DevSecOps side, and Fortify team has made good progress that you can integrate into your CICD pipeline. One thing I would highlight is if Fortify can focus more on the centralized dashboard of the tools because nowadays, tools such as SentinelOne also exist for identifying security issues, but they have a centralized dashboard that merges their cloud solution and application security side solution together. If you have one tool that works for different solutions, it helps a lot. They are doing good, but they should invest more on the AI side as well because AI security is evolving these days. On the cloud side, they have already made good progress, but I believe they should explore the new area related to AI security as well.

Read full review

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

915,533 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

12%

Financial Services Firm

11%

Comms Service Provider

Computer Software Company

Financial Services Firm

12%

Outsourcing Company

12%

Manufacturing Company

10%

Construction Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	18
Midsize Enterprise	7
Large Enterprise	19

By reviewers
Company Size	Count
Small Business	18
Midsize Enterprise	8
Large Enterprise	46

Questions from the Community

What is your primary use case for Acunetix Vulnerability Scanner?

In a typical enterprise environment, Acunetix is mainly used for visibility, detection, and investigation across network traffic. The main use cases usually fall into a few core areas, with primary...

What advice do you have for others considering Acunetix Vulnerability Scanner?

I advise that Acunetix is the best option. Invest time in proper initial configuration and scope definitions. The tool is powerful, but its effectiveness depends heavily on how the authenticated ar...

What is your experience regarding pricing and costs for Acunetix?

Everything is perfect and good, including the pricing and all related aspects.

What needs improvement with Micro Focus Fortify on Demand?

Areas for improvement should be contextualized post the OpenText acquisition, but back when I was working with Micro Focus, they focused heavily on enterprise-centric solutions. Now, after the acqu...

What is your primary use case for Micro Focus Fortify on Demand?

For OpenText Core Application Security, I currently support a couple of my clients who are using Fortify on Demand for their web application, CRM, and sales platform. Many good features of Fortify ...

What advice do you have for others considering Micro Focus Fortify on Demand?

I use Fortify on Demand for monitoring up to a certain extent; it provides monitoring and helps analyze and identify issues that could propagate in the application. When used in conjunction with Ar...

PortSwigger Burp Suite Professional vs Invicti Web + API

Comparisons

Compared 7% of the time

OpenText Dynamic Application Security Testing vs Invicti Web + API

Compared 5% of the time

OWASP Zap vs Invicti Web + API

Compared 5% of the time

Checkmarx One vs Invicti Web + API

Compared 4% of the time

Invicti vs Invicti Web + API

Compared 4% of the time

More Invicti Web + API Competitors

SonarQube vs OpenText Core Application Security

Compared 28% of the time

Checkmarx One vs OpenText Core Application Security

Compared 5% of the time

GitHub vs OpenText Core Application Security

Compared 4% of the time

Veracode vs OpenText Core Application Security

Compared 4% of the time

HCL AppScan vs OpenText Core Application Security

Compared 4% of the time

More OpenText Core Application Security Competitors

Product Reports

Download Invicti Web + API product report

Invicti Web + API

October 2026

OpenText Core Application Security

September 2026

OpenText Core Application Security report

Download OpenText Core Application Security product report

Also Known As

AcuSensor

Micro Focus Fortify on Demand

Overview

Acunetix is a robust web application security testing tool offering rapid scanning, user-friendly interfaces, and accurate vulnerability detection with minimal false positives. It supports both cloud and on-premises deployment, making it versatile for various security needs.

Acunetix is distinguished by its capability to identify critical vulnerabilities such as cross-site scripting and SQL injection with high precision. It integrates seamlessly with CI/CD tools, supporting continuous scanning and large-scale application management. The centralized dashboard and detailed automated reporting streamline operations. Despite its benefits, users suggest improvements like reducing false positives, flexible pricing, and enhanced API scanning. Better integration with platforms like GitHub and Azure DevOps is sought, alongside more comprehensive customization and faster scanning. Mobile application scanning and improved team collaboration tools are also desired.

What features make Acunetix stand out?

Rapid Scanning: Delivers fast and comprehensive security assessments.
User-Friendliness: Intuitive interface simplifies operations for diverse teams.
Detailed Reporting: Automated reports enhance vulnerability management.
High Accuracy: Detects vulnerabilities with minimal false positives.
CI/CD Integration: Seamless integration supports continuous development processes.

What benefits should users consider when evaluating?

Vulnerability Detection: Critical for identifying potential security threats efficiently.
Flexibility: Supports both cloud and on-premises environments.
Compliance Support: Aids in meeting standards like PCI DSS.
Scalability: Capable of handling large-scale web applications.

Acunetix is widely implemented across industries undertaking web application security assessments, including those requiring penetration testing and vulnerability assessment. It ensures applications meet security protocols and complies with standards while fitting into CI/CD workflows for secure pre-release checks.

Invicti

OpenText Core Application Security offers robust features like static and dynamic scanning, real-time vulnerability tracking, and seamless integration with development platforms, designed to enhance code security and reduce operational costs.

OpenText Core Application Security is a cloud-based, on-demand service providing accurate and deep scanning capabilities with detailed reporting. Its integrations with development platforms ensure an enhanced security layer in the development lifecycle, benefiting users by lowering operational costs and facilitating efficient remediation. The platform addresses needs for intuitive interfaces, API support, and comprehensive vulnerability assessments, helping improve code security and accelerate time-to-market. Despite its strengths, challenges exist around false positives, report clarity, and language support, alongside confusing pricing and package options. Enhancements are sought in areas like CI/CD pipeline configuration, report visualization, scan times, and integration with third-party tools such as GitLab, container scanning, and software composition analysis.

What features define OpenText Core Application Security?

Static and Dynamic Scanning: Offers thorough analysis to identify vulnerabilities during development.
Real-time Vulnerability Tracking: Continuously updates and monitors potential security threats.
Seamless Development Platform Integration: Enhances security processes without disrupting workflows.
Cloud-Based Service: Provides flexible, on-demand security capabilities with accurate results.
API Support: Allows smooth integration and automation within existing systems.

What benefits should users look for in reviews?

Reduced Operational Costs: Optimizes resources by lowering costs associated with security management.
Efficient Remediation: Speeds up the process of identifying and resolving vulnerabilities.
Enhanced Code Security: Strengthens overall application security during the development lifecycle.
Accelerated Time-to-Market: Streamlines development stages by integrating essential security tools.

Industries like mobile applications, e-commerce, and banking leverage OpenText Core Application Security for its ability to identify vulnerabilities such as SQL injections. Integrating seamlessly with DevSecOps and security auditing processes, this tool supports developers in writing safer code, ensuring secure application deployment and enhancing software assurance.

OpenText

Sample Customers

Joomla!, Digicure, Team Random, Credit Suisse, Samsung, Air New Zealand

SAP, Aaron's, British Gas, FICO, Cox Automative, Callcredit Information Group, Vital and more.