No more typing reviews! Try our Samantha, our new voice AI agent.

Invicti vs Orca Security comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Container Security
8th
Average Rating
8.8
Reviews Sentiment
7.0
Number of Reviews
55
Ranking in other categories
Vulnerability Management (5th), Cloud Workload Protection Platforms (CWPP) (7th), Cloud Security Posture Management (CSPM) (6th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (6th)
Invicti
Ranking in Container Security
32nd
Average Rating
8.2
Reviews Sentiment
6.8
Number of Reviews
31
Ranking in other categories
Static Application Security Testing (SAST) (15th), Software Composition Analysis (SCA) (16th), API Security (13th), Dynamic Application Security Testing (DAST) (5th), Application Security Posture Management (ASPM) (12th)
Orca Security
Ranking in Container Security
6th
Average Rating
8.8
Reviews Sentiment
7.0
Number of Reviews
41
Ranking in other categories
Vulnerability Management (8th), Cloud Workload Protection Platforms (CWPP) (5th), API Security (6th), Cloud Security Posture Management (CSPM) (7th), Cloud-Native Application Protection Platforms (CNAPP) (4th), Data Security Posture Management (DSPM) (3rd), Cloud Detection and Response (CDR) (2nd), AI Security (1st)
 

Mindshare comparison

As of November 2026, in the Container Security category, the mindshare of Qualys TotalCloud is 1.8%, up from 1.1% compared to the previous year. The mindshare of Invicti is 1.1%, up from 0.4% compared to the previous year. The mindshare of Orca Security is 4.6%, up from 4.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Container Security Mindshare Distribution
ProductMindshare (%)
Orca Security4.6%
Qualys TotalCloud1.8%
Invicti1.1%
Other92.5%
Container Security
 

Featured Reviews

reviewer2859021 - PeerSpot reviewer
Sr Security Engineer at a tech vendor with 5,001-10,000 employees
Risk-based triage has transformed container security and now prioritizes high-impact threats
The best features Qualys TotalCloud offers currently include managing cloud infrastructure and container security while facing major challenges such as alert fatigue. Traditional vulnerability scanners flag hundreds of CVEs on short-lived Kubernetes containers, some of which have no internet exposure or are gone before we can even triage them. I leverage Qualys TotalCloud to move beyond static CVSS. I use it to implement runtime exposure, correlation risk reprioritization, and shift-left integration. This notifies developers to fix a base image upstream rather than patching live ephemeral instances. In my work with cloud and container security, the biggest operational hurdle was alert fatigue. I use Qualys to shift left from static CVSS severity to context-aware risk prioritization. I correlated raw vulnerability data with real-time risk factors such as public network exposure, active runtime execution, or overly permissive IAM roles. This allows us to immediately drop the priority of isolated containers and escalate lower-severity CVEs that sit on an exposed, high-risk path. We can map these findings directly back to our CI/CD pipelines so developers can patch the root base images upstream. We have drastically cut down the signal-to-noise ratio, saved a lot of manual hours doing triage work, and ensured engineering effort goes directly towards high-impact risk reduction.
PrashantUppuluri - PeerSpot reviewer
Solution Architect at a tech services company with 51-200 employees
Automated scanning has strengthened web application security and supports hybrid protection
A good scanning engine is what I appreciate about Invicti. When you want to find out the vulnerabilities within your web applications, Invicti has done a thorough job with respect to filtering out the vulnerabilities and identifying the risk factors with respect to the security modules within the solution. Invicti does have a segment of the solution which works on the automated scanning engine. As long as the license is active, the scanners that work within the solution are pretty effective. With respect to SAST and DAST, being a real-time scanning engine is one of the portfolios and one of the selling factors of the solution. Invicti is known to be a solution that works within the hybrid environment, be it cloud, on-premises, or a mix and match across multiple marketplaces. It does a thorough job. Most importantly, Invicti is a very good SAST and DAST solution that is very competitive in the market with respect to competitors. Invicti is a part of the Magic Quadrant with respect to Gartner's Magic Quadrant and has made a very good customer database and pipeline within the marketplace locally. With respect to security impacts in terms of support, Invicti is pretty much supportive. With respect to use cases or the POCs I have run on the solution, we have identified a couple of vulnerabilities and Invicti was able to trace them, detect, and quarantine the attacks.
Nykole Denoo - PeerSpot reviewer
Cyber Security Analyst at BNY
Cloud risk visibility has transformed how I prioritize threats and reduce unnecessary spend
From my perspective, Orca Security is a really good tool. I would say one area I would like to see CNAPP platforms get is more intelligence when it comes to risk prioritization, which correlates with vulnerability, exposing assets, identities, and active threats to help the security team focus on risks that are more likely to be exploited. I am a huge advocate for automation. I also think deeper automation for remediation or stronger integration with ticketing and CI/CD pipelines or more customization would help. Executive reporting would help the security team respond significantly faster and communicate risk more effectively if those kinds of improvements are made.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Once you have your vulnerabilities fixed and your patches pushed out using Qualys TotalCloud, then you are able to eliminate threats and cyber risk."
"The best part I like is the on-demand scans."
"It is a cloud-native app that integrates with both IaaS and SaaS. It seamlessly integrates with other platforms."
"Qualys TotalCloud has improved our security posture."
"Qualys TotalCloud has great accuracy and reliability, as it is a very complete program with tools that help experts understand the vulnerabilities of today."
"Qualys TotalCloud has positively impacted my organization by providing visibility into the environment."
"I rate the breadth of FlexScan in providing visibility into on-premises, multicloud, and container environments as fantastic."
"Vulnerability and threat detection and assessment of the criticality of the vulnerabilities exposed are most valuable."
"I would definitely recommend it to those who really want to know in-depth details of their applications/products regarding security."
"The most valuable features that I've found in this solution was the level of accuracy and also that the process of scanning was very quick and we're easily able to change the frame of a scan."
"The solution generates reports automatically and quickly and it's a very user-friendly product."
"This tool is really fast and the information that they provide on vulnerabilities is pretty good."
"Technical support is very professional, 10/10."
"It has very good integration with the CI/CD pipeline."
"It has improved the security of our code by scanning it and finding security defects."
"One of the features I like about this program is the low number of false positives and the support it offers."
"Orca's platform provides an agentless data collection facility that collects information directly from the cloud using APIs, with zero impact on performance."
"Orca Security has helped reduce the time it takes to address cloud security alerts."
"<p>The main feature that I appreciated about Orca Security is that it is 100% agentless and context-aware, meaning it understands what it is doing.</p>"
"Orca Security typically delivers three major positive changes, in my opinion: a faster understanding of risks in cloud environments, better prioritization, and less noise."
"Once our organization is configured, any cloud account under that organization is automatically detected in Orca Security, along with all the assets associated with it."
"If I consider the analogy of the house, I expected to be able to see under the floor, what I did not expect was to be able to see behind all of the walls and through the ceiling and through the roof and into the basement, and everywhere."
"Orca Security has impacted my organization positively by giving us visibility on what is happening in the cloud and helping us detect risks fast."
"Orca's dashboard is excellent. My team needs to be able to focus on specific areas for improvement in our cloud environment. And most recently, we've started to get good use out of sonar, the search capabilities, and the alert creation."
 

Cons

"In my opinion, the combination of detection and protection features in Qualys TotalCloud cannot protect but can only detect."
"Although TotalCloud is a helpful tool, some of its advanced features are still under development."
"It is already perfect, but they can bring some newer dashboards and customization options for the dashboard. It would be great to be able to include on-prem assets on the dashboard."
"I chose a rating of nine out of ten because there is a complex interface that sometimes overwhelms new engineers."
"Qualys TotalCloud needs to enhance its scanning capabilities in the IP domain, as it currently lacks the functionality to resolve IPs to their corresponding domain names."
"To be honest, I would move out from this tool because it does not give a full view of vulnerability."
"There is room for improvement in the support."
"The support process is inefficient due to the excessive number of replies required when submitting tickets."
"When scanning a large web-based application, it tends to process slow and takes a long time especially on crawling and attacking part."
"Maybe supported clients can be improved. It still does not search vulnerabilities in DB2 databases, for example."
"I think that it freezes without any specific reason at times. This needs to be looked into."
"The support's response time could be faster since we are in different time zones."
"The scanner itself should be improved because it is a little bit slow."
"Sometimes, it is slow; when we are running this application and browsing other applications concurrently, it makes other applications work slow."
"The proxy review, the use report views, the current use tool and the subset requests need some improvement. It was hard to understand how to use them."
"Netsparker is one of the costliest products in the market. The licensing is tied to the URL, and it's restricted."
"I think the downside of Orca Security is the reports."
"<p>There is one issue that I encountered: when Orca Security provides CVEs and we attempt to implement its solutions, sometimes those solutions are not available on the cloud and cannot be implemented.</p>"
"The documentation for Orca Security could be improved."
"As with all software, the user interface can always be made simpler to use."
"The interface can be a bit cranky and sometimes takes a lot of time to load."
"I would like to see an option to do security checks on a code level."
"In two implementation projects that I participated in, the customers reported difficulty with the options for generating specific reports."
"A notable limitation with Orca Security is its scanning feature. The automatic scan only runs every 24 hours, and if an alert is remediated within an hour, it still remains until the next scheduled scan."
 

Pricing and Cost Advice

"As a middle management member, I do not have direct pricing knowledge, but based on the knowledge from our meetings, its pricing is competitive."
"It isn't cheap, but it's reasonable. It helps us to manage things with very few resources."
"Its price seems higher compared to other tools, but it is worth it. If they could adjust the pricing and make it comparable with other tools, that would be great."
"Qualys TotalCloud is expensive."
"Qualys TotalCloud offers competitive pricing given its comprehensive suite of features, including integration, assessment, remediation, and detection capabilities, all within a single platform."
"The pricing is comparable. It is built into our other product, so I cannot piecemeal it. It is a part of our subscription."
"While Qualys TotalCloud's pricing is currently acceptable, it is becoming increasingly expensive and may soon be considered overpriced."
"Qualys TotalCloud is cost-efficient and was selected for its value compared to other products."
"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."
"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."
"OWASP Zap is free and it has live updates, so that's a big plus."
"The price should be 20% lower"
"We never had any issues with the licensing; the price was within our assigned limits."
"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."
"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."
"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."
"While it's competitive with Palo Alto Prisma, I think Orca's list price is very high. I would advise Orca to lower it because, at that price, I might consider alternatives like Wiz, which also offers agentless services."
"Orca Security charges are based on cloud workloads. So, it's based on workloads. If we look at one feature, it might be expensive."
"I think their pricing model is aligned with market demand. Of course, Orca could probably better align their pricing model with the needs of smaller businesses as well as some larger-scale enterprises with millions of assets. But in all fairness, I think the Orca sales team has been accommodating and ensured that we're happy with the pricing."
"The most expensive solution is Palo Alto. They claim to be very robust. The next most expensive is Wiz, followed by Orca and all the rest."
"The pricing depends on how many assets you have running in your cloud and how many environments you have. If you have a dev environment, test environment, and a production environment then it's really important that you have coverage for all of them."
"Its license is a bit expensive."
"Overall, the pricing is reasonable and the discounts have been acceptable."
"We have a total of 25 licenses for this solution. The solution is on a pay-and-you-use model."
report
Use our free recommendation engine to learn which Container Security solutions are best for your needs.
921,714 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
18%
Outsourcing Company
12%
Manufacturing Company
11%
Financial Services Firm
10%
Financial Services Firm
12%
Manufacturing Company
9%
Construction Company
9%
Outsourcing Company
6%
Financial Services Firm
13%
Manufacturing Company
11%
Computer Software Company
9%
Outsourcing Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise11
Large Enterprise39
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise4
Large Enterprise13
By reviewers
Company SizeCount
Small Business18
Midsize Enterprise9
Large Enterprise16
 

Questions from the Community

What is your experience regarding pricing and costs for Qualys TotalCloud?
We purchased Qualys TotalCloud for GCP and Azure as well. It is comparatively better than others regarding pricing. T...
What needs improvement with Qualys TotalCloud?
I am unsure about how Qualys TotalCloud can be improved. I do not have anything else to add about the needed improvem...
What is your primary use case for Qualys TotalCloud?
My main use case for Qualys TotalCloud is telemetry, although I am unsure about the specifics. A quick specific examp...
What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?
The setup cost is pretty competitive. For example, if you want to talk about the SAST license, it comes to about $150...
What needs improvement with Invicti?
At this time, there is nothing that comes to mind. However, most of the products in the market are pretty much neck-t...
What is your primary use case for Invicti?
I have worked on a couple of products, specifically in web application security. I have worked on Invicti, and with r...
What needs improvement with Orca Security?
Regarding how Orca Security can be improved, I think there is not much; it is fully completed and it is great.
What is your primary use case for Orca Security?
My main use case for Orca Security is to secure infrastructure, course, and service. A specific example of how I use ...
What advice do you have for others considering Orca Security?
My advice to others looking into using Orca Security is to practice and study the platform in test scenarios. My impr...
 

Also Known As

Qualys TotalCloud with FlexScan
Netsparker
No data available
 

Overview

 

Sample Customers

Information Not Available
Samsung, The Walt Disney Company, T-Systems, ING Bank
BeyondTrust, Postman, Digital Turbine, Solarisbank, Lemonade, C6 Bank, Docebo, Vercel, and Vivino
Find out what your peers are saying about Invicti vs. Orca Security and other solutions. Updated: October 2026.
921,714 professionals have used our research since 2012.