Try our new research platform with insights from 80,000+ expert users

Invicti vs Rapid7 InsightAppSec comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Invicti
Ranking in Dynamic Application Security Testing (DAST)
4th
Average Rating
8.2
Reviews Sentiment
7.3
Number of Reviews
29
Ranking in other categories
Static Application Security Testing (SAST) (14th), API Security (6th)
Rapid7 InsightAppSec
Ranking in Dynamic Application Security Testing (DAST)
2nd
Average Rating
8.2
Reviews Sentiment
7.5
Number of Reviews
19
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of June 2025, in the Dynamic Application Security Testing (DAST) category, the mindshare of Invicti is 13.5%, down from 14.5% compared to the previous year. The mindshare of Rapid7 InsightAppSec is 11.6%, down from 13.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Dynamic Application Security Testing (DAST)
 

Featured Reviews

Kunal M - PeerSpot reviewer
Proactive scanning measures and realistic audit recommendations enhance development focus
Invicti's proactive scanning measures vulnerabilities each time we deploy or push code to a new environment. This feature helps us focus on priorities and prioritize the development team's effort, integrating seamlessly with DevOps to facilitate proactive scans of environments. Invicti also provides audit recommendations that are quite realistic, making it easy to discuss plans with developers.
Krzysztof Witko - PeerSpot reviewer
Automated authorization streamlines security processes
The previous product, AppSpyder, had a virtual patching module where we could generate patches for third-party web application firewalls, such as Imperva or F5. Currently, InsightAppSec lacks similar functionality. Customers must wait for remediation during the developers' preparation of a new version. Virtual patching could help protect web pages shortly after finishing the scan process.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Invicti's proactive scanning measures vulnerabilities each time we deploy or push code to a new environment."
"The platform is stable."
"The solution generates reports automatically and quickly."
"The scanner is light on the network and does not impact the network when scans are running."
"The best features of Invicti are its ability to confirm access vulnerabilities, SSL injection vulnerabilities, and its connectors to other security tools."
"Its ability to crawl a web application is quite different than another similar scanner."
"This tool is really fast and the information that they provide on vulnerabilities is pretty good."
"It has very good integration with the CI/CD pipeline."
"The templates feature is very easy. You just choose the kind of attack you want on your web application, and you run it against that template and receive a report. It's great."
"I rate stability ten out of ten."
"The most valuable feature of this solution is the graphical interface."
"It uses a signature-based method to check for problems with your code and will provide an alert if anything is found."
"Rapid7 InsightAppSec helps us in both regulatory compliance and in strengthening our security posture."
"The product’s most valuable feature is UI. It is easy to manage and find vulnerabilities in the application."
"The initial setup for us was easy enough. We didn't face too many issues. Deployment took maybe 30 minutes. It's quite quick and doesn't cause too much trouble at the outset."
"We have seen measurable decrease in the mean time to respond to threats by 20 percent."
 

Cons

"The custom attack preparation screen might be improved."
"Currently, there is nothing I would like to improve."
"Reporting should be improved. The reporting options should be made better for end-users. Currently, it is possible, but it's not the best. Being able to choose what I want to see in my reports rather than being given prefixed information would make my life easier. I had to depend on the API for getting the content that I wanted. If they could fix the reporting feature to make it more comprehensive and user-friendly, it would help a lot of end-users. Everything else was good about this product."
"It would be better for listing and attacking Java-based web applications to exploit vulnerabilities."
"The solution's false positive analysis and vulnerability analysis libraries could be improved."
"The licensing model should be improved to be more cost-effective. There are URL restrictions that consume our license. Compared to other DAST solutions and task tools like WebInspect and Burp Enterprise, Invicti is very expensive. The solution’s scanning time is also very long compared to other DAST tools. It might be due to proof-based scanning."
"The proxy review, the use report views, the current use tool and the subset requests need some improvement. It was hard to understand how to use them."
"They need to improve their support in the documentation. Their support mechanism is missing. Their responsiveness, technical staff, and these types of things need to be improved, and comprehensive documentation is required. They should have good self-service portal enhancement"
"In the future, if they can have integration with a lot of ticketing systems then it would be amazing."
"The number of web applications we can scan is limited."
"We get a lot of false positives during the tests."
"In terms of behavioral and pattern recognition, identifying complex attacks such as SQL, blind SQL, JSON, and LDAP injections often results in 94% false positives."
"The product’s pricing could be flexible."
"I would like more details of what the product can do."
"Rapid7 InsightAppSec needs improvement in detecting phishing pages."
"There is room for improvement in the response time of customer service and support levels."
 

Pricing and Cost Advice

"It is competitive in the security market."
"OWASP Zap is free and it has live updates, so that's a big plus."
"The price should be 20% lower"
"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."
"We never had any issues with the licensing; the price was within our assigned limits."
"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."
"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."
"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."
"I rate Rapid7 InsightAppSec’s pricing an eight out of ten."
"I'm not sure how much it costs exactly, but I know it's expensive."
"Its price is competitive. It is not expensive."
"The price of this product is very cheap."
"They offer a good price, but I don't remember its cost. It is fair as compared to the competition. We have opted for project-based licensing, not user-based. We can add any number of users. That doesn't matter. It is worth the money."
"Rapid7 InsightAppSec is cheap."
report
Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.
856,873 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Educational Organization
36%
Financial Services Firm
12%
Computer Software Company
10%
Manufacturing Company
7%
Computer Software Company
16%
Financial Services Firm
15%
Manufacturing Company
11%
Government
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?
As a technical user, I do not handle pricing or licensing, but I am aware that Invicti offers flexible licensing models based on organizational needs.
What do you like most about Invicti?
The most valuable feature of Invicti is getting baseline scanning and incremental scan.
What needs improvement with Invicti?
Invicti's reporting capabilities need enhancement. We need enterprise-level information instead of repo-level details. Unlike Appiro, Invicti does not provide portfolio-level insights into vulnerab...
What do you like most about Rapid7 InsightAppSec?
In Rapid7 InsightAppSec, a distinctive feature is the provision of a CDM for integrating web servers and web applications. To establish the connection between these applications, you only need to p...
What needs improvement with Rapid7 InsightAppSec?
Currently, I do not see any specific areas for improvement except for possibly lowering the price.
What is your primary use case for Rapid7 InsightAppSec?
I use Rapid7 InsightAppSec ( /products/rapid7-insightappsec-reviews ) for dynamic application security testing. My main focus is on the quality of detection, specifically detecting vulnerabilities ...
 

Also Known As

Netsparker
InsightAppSec
 

Overview

 

Sample Customers

Samsung, The Walt Disney Company, T-Systems, ING Bank
CenterPoint Energy, CPA Australia, Hypertherm, First American Financial Corporation, Rackspace
Find out what your peers are saying about Invicti vs. Rapid7 InsightAppSec and other solutions. Updated: April 2025.
856,873 professionals have used our research since 2012.