Try our new research platform with insights from 80,000+ expert users

Invicti vs NGINX App Protect comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 4, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Invicti
Ranking in API Security
7th
Average Rating
8.2
Reviews Sentiment
6.7
Number of Reviews
30
Ranking in other categories
Static Application Security Testing (SAST) (14th), Dynamic Application Security Testing (DAST) (5th)
NGINX App Protect
Ranking in API Security
3rd
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
24
Ranking in other categories
Web Application Firewall (WAF) (16th), Container Security (23rd)
 

Mindshare comparison

As of August 2025, in the API Security category, the mindshare of Invicti is 2.8%, up from 1.6% compared to the previous year. The mindshare of NGINX App Protect is 2.9%, down from 4.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
API Security
 

Featured Reviews

Kunal M - PeerSpot reviewer
Proactive scanning measures and realistic audit recommendations enhance development focus
Invicti's proactive scanning measures vulnerabilities each time we deploy or push code to a new environment. This feature helps us focus on priorities and prioritize the development team's effort, integrating seamlessly with DevOps to facilitate proactive scans of environments. Invicti also provides audit recommendations that are quite realistic, making it easy to discuss plans with developers.
Saurav Kumar - PeerSpot reviewer
Offers protection to users from external threats
NGINX App Protect secures our company's application, and it has helped me a lot, considering that we have critical infrastructure in India where we see how lots of attacks come onto our organization's servers. The tool offers protection against multiple threats present in India's IT ecosystem. The tool helps our company to make our payments secure, meaning it has the ability to provide a secure payment environment in India. Speaking about the improvements in our company's application performance since implementing NGINX App Protect, the gRPC support for the solution is very low. My company is not getting any proper documentation on how to deploy gRPC over NGINX App Protect. I recommend the product to those who plan to use it. People can use the product as their company's base server, WAF, or for its proxy manager, depending on the business requirements. My company follows PCI DSS compliance because we operate in a payment-related industry. Right now, my company follows all the standards, so we comply with all the requirements and policies. I rate the tool an eight out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The scanner and the result generator are valuable features for us."
"I like that it's stable and technical support is great."
"The dashboard is really cool, and the features are really good. It tells you about the software version you're using in your web application. It gives you the entire technology stack, and that really helps. Both web and desktop apps are good in terms of application scanning. It has a lot of security checks that are easily customizable as per your requirements. It also has good customer support."
"Invicti's best feature is the ability to identify vulnerabilities and manually verify them."
"Scan, proxify the application, and then detailed report along with evidence and remediations to problems."
"The platform is stable."
"When we try to manually exploit the vulnerabilities, it often takes time to realize what's going on and what needs to be done."
"The most valuable feature of Invicti is getting baseline scanning and incremental scan."
"Overall, I rate NGINX App Protect between eight and nine."
"We were looking for a product that is capable of complete automation and a container based solution. It's working."
"It has the best documentation features."
"The most valuable feature of NGINX App Protect is its open source."
"The initial setup was simple and took three to four days."
"The stability of the product is very impressive since it handles 60,000 to 70,000 requests or transactions per second."
"The most valuable feature of NGINX App Protect is the reverse proxy."
"NGINX App Protect has complete control over the HTTP session."
 

Cons

"They could enhance the support for data swap testing for the platform."
"The scanning time, complexity, and authentication features of Invicti could be improved."
"Invicti's reporting capabilities need enhancement."
"The support's response time could be faster since we are in different time zones."
"Reporting should be improved. The reporting options should be made better for end-users. Currently, it is possible, but it's not the best. Being able to choose what I want to see in my reports rather than being given prefixed information would make my life easier. I had to depend on the API for getting the content that I wanted. If they could fix the reporting feature to make it more comprehensive and user-friendly, it would help a lot of end-users. Everything else was good about this product."
"The licensing model should be improved to be more cost-effective. There are URL restrictions that consume our license. Compared to other DAST solutions and task tools like WebInspect and Burp Enterprise, Invicti is very expensive. The solution’s scanning time is also very long compared to other DAST tools. It might be due to proof-based scanning."
"The proxy review, the use report views, the current use tool and the subset requests need some improvement. It was hard to understand how to use them."
"The higher level vulnerabilities like Cross-Site Scripting, SQL Injection, and other higher level injection attacks are difficult to highlight using Netsparker."
"Its technical support could be better."
"NGINX App Protect would be improved with integration with Shape and F5 WAF, which would make it easy for users to manage all their web application security with a single solution."
"The product's user interface is an area with shortcomings as it can be quite confusing for users, making it an area where improvements are required."
"Currently, the policies have to be handled manually, and you have to create from scratch, which can be a bit time-consuming, in a large environment."
"Setting policies and parameters through the UI should be more automated because the process is manual, where we can only edit one rule at a time."
"The product's price is high, making it an area of concern where improvements are required. The tool's licensing model is also not good."
"The setup of NGINX App Protect is complex. The full process took one week to complete. Additionally, we had to change the network infrastructure platform which took one month."
"They could provide a better user interface."
 

Pricing and Cost Advice

"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."
"We never had any issues with the licensing; the price was within our assigned limits."
"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."
"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."
"OWASP Zap is free and it has live updates, so that's a big plus."
"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."
"The price should be 20% lower"
"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."
"The price of NGINX App Protect is approximately $3,000 annually. All of our licenses are observed by a managed service partner."
"The pricing is reasonable because NGINX operates on an instance basis."
"The price of NGINX App Protect is not much different from the products that fall under the leader category of Gartner Magic Quadrant."
"There is a monthly or annual subscription to use NGINX App Protect. There are not any additional costs to the subscription."
"There are not any additional costs we had to pay to use NGINX App Protect."
"There is a license needed to use NGINX App Protect."
"NGINX App Protect is expensive."
"NGINX is not expensive."
report
Use our free recommendation engine to learn which API Security solutions are best for your needs.
865,384 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
18%
Computer Software Company
14%
Manufacturing Company
10%
Government
9%
Financial Services Firm
16%
Computer Software Company
15%
Comms Service Provider
9%
Manufacturing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?
As a technical user, I do not handle pricing or licensing, but I am aware that Invicti offers flexible licensing models based on organizational needs.
What do you like most about Invicti?
The most valuable feature of Invicti is getting baseline scanning and incremental scan.
What needs improvement with Invicti?
The main concern is on the performance side, but other than that, we find it really helpful in identifying web vulnerabilities. A full scan takes more time based on your website and other factors, ...
What is your experience regarding pricing and costs for NGINX App Protect?
I don't know the pricing yet because in my other project, I was not part of the buying side and I was just starting to look at options.
What needs improvement with NGINX App Protect?
It would be better if it were easier to implement and if there was more information from F5 regarding hardware requirements and specifications to deploy the service, to avoid disruptions after impl...
 

Also Known As

Netsparker
NGINX WAF, NGINX Web Application Firewall
 

Overview

 

Sample Customers

Samsung, The Walt Disney Company, T-Systems, ING Bank
Information Not Available
Find out what your peers are saying about Invicti vs. NGINX App Protect and other solutions. Updated: July 2025.
865,384 professionals have used our research since 2012.