No more typing reviews! Try our Samantha, our new voice AI agent.

Invicti vs Onapsis comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Invicti
Average Rating
8.2
Reviews Sentiment
6.8
Number of Reviews
31
Ranking in other categories
Static Application Security Testing (SAST) (10th), Container Security (24th), Software Composition Analysis (SCA) (8th), API Security (9th), Dynamic Application Security Testing (DAST) (4th), Application Security Posture Management (ASPM) (5th)
Onapsis
Average Rating
8.0
Number of Reviews
1
Ranking in other categories
Application Security Tools (36th)
 

Mindshare comparison

Invicti and Onapsis aren’t in the same category and serve different purposes. Invicti is designed for Dynamic Application Security Testing (DAST) and holds a mindshare of 8.5%, up 6.9% compared to last year.
Onapsis, on the other hand, focuses on Application Security Tools, holds 0.9% mindshare, up 0.2% since last year.
Dynamic Application Security Testing (DAST) Mindshare Distribution
ProductMindshare (%)
Invicti8.5%
Veracode15.7%
Checkmarx One15.0%
Other60.8%
Dynamic Application Security Testing (DAST)
Application Security Tools Mindshare Distribution
ProductMindshare (%)
Onapsis0.9%
SonarQube13.6%
Checkmarx One8.8%
Other76.7%
Application Security Tools
 

Featured Reviews

Valavan Sivgalingam - PeerSpot reviewer
Senior Manager, Security Engineering at ESS
Dynamic testing regularly identifies web vulnerabilities and has strong false positive confirmations
It has good false positive confirmations, confirmed issues identification, and proof of exploit-related features as part of it. We use Invicti for these things in our portfolios. The solution includes Proof-Based Scanning technology. Invicti is part of our SSDLC portfolio, and DAST dynamic testing is very important for our web applications and portfolios. For both the API endpoints and web applications, we do regular testing on a monthly basis for all our releases. Invicti does a good job. The only concern is on the performance side, but other than that, we find it really helpful in identifying web vulnerabilities. A full scan takes more time based on your website and other factors, but for us, it takes more than two to three days. The scan performance can be improved upon. When we check with them, they discuss proof-based scanning and related aspects. However, there could be intermittent results that could help us.
it_user19113 - PeerSpot reviewer
SAP Security Consulting Engineer at a computer software company with 10,001+ employees
It checks for and reports vulnerabilities on all SAP systems at the OS, DB and SAP levels.
I really love how Onapsis X1 is able to check SAP for threats; the reporting was something I felt could be improved. It could be a little easier to use and to publish for consumption with a larger audience. Currently, it takes some background jobs and additional work to get them published. It was difficult to get interactive reports to the different levels of the business. I would have to download them and send them out, or save them on my SharePoint site and send out a weekly link. In the version of the product I was usingת I had to log into the X1 system directly to get to the reports. Reporting would be used by several different areas of the organizationת many of whom would be at the director and executive levels. It would not make sense to have them log directly into the tool to look at these reports. Add to this that there was only one ID that could be used to log in and view the reports. To solve this problemת I had to run all of the different reports; executive summary down to detailed analysis and then export them out to my security team SharePoint site. To automate this processת a batch script was created to run after the X1 analyzed the systems. The script would pull the reports and place them in the SharePoint site automatically, but it was a bit of a hassle to get set up.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It has a comprehensive resulting mechanism. It is a one-stop solution for all your security testing mechanisms."
"The best features of Invicti are its ability to confirm access vulnerabilities, SSL injection vulnerabilities, and its connectors to other security tools."
"This tool is really fast and the information that they provide on vulnerabilities is pretty good."
"High level of accuracy and quick scanning."
"OWASP Zap is free and it has live updates, so that's a big plus."
"Technical support is very professional, 10/10."
"I am impressed with Invictus’ proof-based scanning. The solution has reduced the incidence of false positive vulnerabilities. It has helped us reduce our time and focus on vulnerabilities."
"The most attractive feature was the reporting review tool. The reporting review was very impressive and produced very fruitful reports."
"It has hardened our SAP system by providing details of vulnerabilities in our SAP landscape."
 

Cons

"The scannings are not sufficiently updated."
"They could enhance the support for data swap testing for the platform."
"I think that it freezes without any specific reason at times."
"The support's response time could be faster since we are in different time zones."
"The solution's false positive analysis and vulnerability analysis libraries could be improved."
"When scanning a large web-based application, it tends to process slow and takes a long time especially on crawling and attacking part."
"Right now, they are missing the static application security part, especially web application security."
"The scanner itself should be improved because it is a little bit slow."
"Reporting was something I felt could be improved. It could be a little easier to use and to publish for consumption with a larger audience."
 

Pricing and Cost Advice

"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."
"We never had any issues with the licensing; the price was within our assigned limits."
"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."
"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."
"The price should be 20% lower"
"OWASP Zap is free and it has live updates, so that's a big plus."
"It is competitive in the security market."
"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."
Information not available
report
Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.
893,164 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
16%
Manufacturing Company
9%
Computer Software Company
7%
Government
6%
Energy/Utilities Company
16%
University
13%
Construction Company
11%
Outsourcing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise4
Large Enterprise13
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?
The setup cost is pretty competitive. For example, if you want to talk about the SAST license, it comes to about $150 or sometimes less than $100, depending on the conversion or the number of licen...
What needs improvement with Invicti?
At this time, there is nothing that comes to mind. However, most of the products in the market are pretty much neck-to-neck competitors. Speaking about it, there are a couple of factors which they ...
What is your primary use case for Invicti?
I have worked on a couple of products, specifically in web application security. I have worked on Invicti, and with respect to PAM, I have worked with BeyondTrust. I have not worked specifically fo...
Ask a question
Earn 20 points
 

Comparisons

 

Also Known As

Netsparker
No data available
 

Overview

 

Sample Customers

Samsung, The Walt Disney Company, T-Systems, ING Bank
Sony, US Army, Westinghouse, AXA. Galicia, Daimler, Roche, Levi's, Siemens, ABB, KPMG, Mercardo Libre, Verizon, Bacardi, Adgas, Sicpa, Whirlpool, Leaseplan
Find out what your peers are saying about Veracode, Checkmarx, OpenText and others in Dynamic Application Security Testing (DAST). Updated: May 2026.
893,164 professionals have used our research since 2012.