No more typing reviews! Try our Samantha, our new voice AI agent.

Invicti vs Orca Security comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Invicti
Ranking in Container Security
24th
Ranking in API Security
8th
Average Rating
8.2
Reviews Sentiment
6.8
Number of Reviews
31
Ranking in other categories
Static Application Security Testing (SAST) (11th), Software Composition Analysis (SCA) (8th), Dynamic Application Security Testing (DAST) (4th), Application Security Posture Management (ASPM) (5th)
Orca Security
Ranking in Container Security
10th
Ranking in API Security
4th
Average Rating
8.8
Reviews Sentiment
6.9
Number of Reviews
30
Ranking in other categories
Vulnerability Management (10th), Cloud Workload Protection Platforms (CWPP) (5th), Cloud Security Posture Management (CSPM) (7th), Cloud-Native Application Protection Platforms (CNAPP) (5th), Data Security Posture Management (DSPM) (8th), Cloud Detection and Response (CDR) (2nd), AI Security (3rd)
 

Mindshare comparison

As of March 2026, in the Container Security category, the mindshare of Invicti is 0.7%, up from 0.3% compared to the previous year. The mindshare of Orca Security is 4.0%, down from 4.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Container Security Mindshare Distribution
ProductMindshare (%)
Orca Security4.0%
Invicti0.7%
Other95.3%
Container Security
 

Featured Reviews

Valavan Sivgalingam - PeerSpot reviewer
Senior Manager, Security Engineering at ESS
Dynamic testing regularly identifies web vulnerabilities and has strong false positive confirmations
It has good false positive confirmations, confirmed issues identification, and proof of exploit-related features as part of it. We use Invicti for these things in our portfolios. The solution includes Proof-Based Scanning technology. Invicti is part of our SSDLC portfolio, and DAST dynamic testing is very important for our web applications and portfolios. For both the API endpoints and web applications, we do regular testing on a monthly basis for all our releases. Invicti does a good job. The only concern is on the performance side, but other than that, we find it really helpful in identifying web vulnerabilities. A full scan takes more time based on your website and other factors, but for us, it takes more than two to three days. The scan performance can be improved upon. When we check with them, they discuss proof-based scanning and related aspects. However, there could be intermittent results that could help us.
reviewer2799597 - PeerSpot reviewer
Soc Analyst at a tech consulting company with 11-50 employees
Agentless cloud security has improved attack path visibility but still needs stronger real-time blocking
Yes, as per my experience, it has been very helpful. In our organization, we did not find any major or priority one kind of alerts or risks because we had a very good infrastructure structure and cybersecurity architecture built in our organization. Orca Security helped us find what vulnerabilities or gaps existed which we could improve within our architecture. It helped us in such a way that we used to close the open ports and only allowed internal IPs for necessity. For staging environments and for prod we had DOS protection. If network traffic showed that anybody was trying to flood our systems, we would only accept all and our client-related IPs or an approved list of vendor lists we would have. We would get to know where the gaps are and where the improvements we could make. Being an analyst class engineer, I could use my brain in those areas and it was very helpful to have Orca Security in my arsenal.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Attacking feature: Actually, attacking is not a solo feature. It contains many attack engines, Hawk, and many properties. But Netsparker's attacking mechanism is very flexible. This increases the vulnerability detection rate. Also, Netsparker made the Hawk for real-time interactive command-line-based exploit testing. It's very valuable for a vulnerability scanner."
"The scanner is light on the network and does not impact the network when scans are running."
"I would definitely recommend it to those who really want to know in-depth details of their applications/products regarding security."
"I am impressed by the whole technology that they are using in this solution, as it is really fast and, when using netscan, the confirmation that it gives on the vulnerabilities is pretty cool."
"Netsparker provides a more interactive interface that is more appealing."
"It has a comprehensive resulting mechanism. It is a one-stop solution for all your security testing mechanisms."
"The solution generates reports automatically and quickly and it's a very user-friendly product."
"The scanner and the result generator are valuable features for us."
"Orca Security has patented technologies. It's an agentless solution, so you don't need to install an agent. Instead, it contacts your account provider and fetches metadata, eliminating the need for snapshots or reserved space to copy client infrastructure."
"I would rate the quality of support as nine stars out of ten due to their quick and helpful responses."
"The vulnerability management does not require network scanning or agent technology, so I don't need to modify any of my products in order to do vulnerability assessments."
"With Orca, I feel confident that I have full coverage of all of my resources."
"Orca Security is easier to use than other alternatives; you need a little skill to dominate Orca Security compared to other options and Orca Security is more user-friendly and in this case is more enjoyable."
"Orca gives you great visibility into your assets. It shows you the issues and the things that you need to attend to first, by prioritizing things. You can see a lot of information that is not always visible, even to DevOps, to help you know about the machines and their status. It's very easy to see everything in a single dashboard. That makes it a very useful tool."
"If I consider the analogy of the house, I expected to be able to see under the floor, what I did not expect was to be able to see behind all of the walls and through the ceiling and through the roof and into the basement, and everywhere."
"Orca's platform provides an agentless data collection facility that collects information directly from the cloud using APIs, with zero impact on performance."
 

Cons

"Currently, there is nothing I would like to improve."
"The support's response time could be faster since we are in different time zones."
"Perhaps the custom attack preparation screen might be improved."
"The proxy review, the use report views, the current use tool and the subset requests need some improvement."
"Maybe the ability to make a good reporting format is needed."
"Asset scanning could be better. Once, it couldn't scan assets, and the issue was strange. The price doesn't fit the budget of small and medium-sized businesses."
"The solution needs to make a more specific report."
"The support's response time could be faster since we are in different time zones."
"I believe they need more time developing this solution, which means they need to be more comprehensive and extended in their approach."
"We are PCI DSS compliant, so we need to scan our environment externally with tools vetted by the PCI DSS organization. Orca doesn't scan the environment externally. It only scans what's currently in the cloud."
"The main drawback in an agentless approach is that if the solution detects a virus or malware in the environment, we need to manually remove it. But from my experience with other production environments, it's not straightforward to install agents in the hope they will automatically remediate viruses, even from production environments... Ultimately, the ability to auto-remediate is something that I would like to see."
"Orca Security could improve its ticket creation process."
"Orca needs improvement in snoozing or dismissing specific alarms. Currently, snoozing dismisses all future vulnerabilities related to a CVE."
"There were a couple of times when Orca was down when I was trying to access it. I work strange hours because all of my team is in the UK right now. It was 2 a.m. on a Saturday and I was trying to log in but it wasn't working. But relative to my other security tools, Orca is definitely the most stable that I've seen."
"I would like to see an option to do security checks on a code level."
"I would like to see an option to do security checks on a code level. This is possible because they have access to all of the code running in the cloud provider, and combining their site-scanning solution with that would be a nice add-on."
 

Pricing and Cost Advice

"OWASP Zap is free and it has live updates, so that's a big plus."
"The price should be 20% lower"
"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."
"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."
"We never had any issues with the licensing; the price was within our assigned limits."
"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."
"It is competitive in the security market."
"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."
"Orca Security is cheaper compared to other solutions in the same space."
"The most expensive solution is Palo Alto. They claim to be very robust. The next most expensive is Wiz, followed by Orca and all the rest."
"Orca is very competitive when compared to the alternatives and is not the most expensive in the market, that's for sure."
"The pricing depends on how many assets you have running in your cloud and how many environments you have. If you have a dev environment, test environment, and a production environment then it's really important that you have coverage for all of them."
"I think their pricing model is aligned with market demand. Of course, Orca could probably better align their pricing model with the needs of smaller businesses as well as some larger-scale enterprises with millions of assets. But in all fairness, I think the Orca sales team has been accommodating and ensured that we're happy with the pricing."
"Orca Security charges are based on cloud workloads. So, it's based on workloads. If we look at one feature, it might be expensive."
"Overall, the pricing is reasonable and the discounts have been acceptable."
"Its license is a bit expensive."
report
Use our free recommendation engine to learn which Container Security solutions are best for your needs.
885,311 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Manufacturing Company
9%
Computer Software Company
8%
Government
7%
Financial Services Firm
15%
Computer Software Company
12%
Manufacturing Company
9%
Healthcare Company
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise4
Large Enterprise13
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise8
Large Enterprise8
 

Questions from the Community

What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?
The setup cost is pretty competitive. For example, if you want to talk about the SAST license, it comes to about $150 or sometimes less than $100, depending on the conversion or the number of licen...
What needs improvement with Invicti?
At this time, there is nothing that comes to mind. However, most of the products in the market are pretty much neck-to-neck competitors. Speaking about it, there are a couple of factors which they ...
What is your primary use case for Invicti?
I have worked on a couple of products, specifically in web application security. I have worked on Invicti, and with respect to PAM, I have worked with BeyondTrust. I have not worked specifically fo...
What do you like most about Orca Security?
It's for protection. It's an agentless tool. We don't need to install anything at a customer's premises. We can just scan the entire assets in the cloud.
What needs improvement with Orca Security?
I think the downside of Orca Security is the reports. I don't have any good reports ready to deliver to an executive. If I need to deliver some reports to my account manager or an executive, I don'...
What is your primary use case for Orca Security?
I normally use Orca Security for AppSec, and one of the features that I use commonly is the application security. I love it because it's already covered in the same license, and I can get a good ov...
 

Comparisons

 

Also Known As

Netsparker
No data available
 

Overview

 

Sample Customers

Samsung, The Walt Disney Company, T-Systems, ING Bank
BeyondTrust, Postman, Digital Turbine, Solarisbank, Lemonade, C6 Bank, Docebo, Vercel, and Vivino
Find out what your peers are saying about Invicti vs. Orca Security and other solutions. Updated: March 2026.
885,311 professionals have used our research since 2012.