Invicti vs Software Risk Manager ASPM comparison

Invicti and Black Duck are both solutions in the Application Security Posture Management (ASPM) category. Invicti is ranked #6 with an average rating of 8.5, while Black Duck is ranked #15. Invicti holds a 4.0% mindshare in ASPM, compared to Black Duck’s 4.1% mindshare. Additionally, 96% of Invicti users are willing to recommend the solution.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Mar 22, 2026

Invicti and Software Risk Manager ASPM are notable competitors in the application security sector. Invicti holds an advantage in customer service and pricing, while Software Risk Manager ASPM attracts tech buyers with its superior feature set.

Features: Invicti offers robust automated scanning, integration with multiple development tools, and efficient security testing, streamlining the security process. Software Risk Manager ASPM provides comprehensive vulnerability management, advanced threat detection, and in-depth security analysis, making it suitable for organizations focusing on thorough security measures.

Ease of Deployment and Customer Service: Invicti provides a straightforward deployment process and has accessible customer support, making it ideal for teams seeking a smooth implementation. Software Risk Manager ASPM's extensive features result in a more complex deployment process, but reliable support is still available for organizations requiring robust security functionalities.

Pricing and ROI: Invicti offers a competitive setup cost, focusing on quick ROI through efficient security testing, appealing to cost-conscious buyers. Software Risk Manager ASPM may involve higher initial costs, yet its comprehensive feature set offers substantial value, promising a strong ROI for those prioritizing detailed application security.

To learn more, read our detailed Application Security Posture Management (ASPM) Report (Updated: May 2026).

Buyer's Guide

Application Security Posture Management (ASPM)

May 2026

Download the complete report

Helped 902,270 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex Cloud by Palo Alto N...

Mindshare comparison

As of June 2026, in the Application Security Posture Management (ASPM) category, the mindshare of Cortex Cloud by Palo Alto Networks is 2.2%, up from 0.2% compared to the previous year. The mindshare of Invicti is 4.0%, up from 2.6% compared to the previous year. The mindshare of Software Risk Manager ASPM is 4.1%, up from 2.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Posture Management (ASPM) Mindshare Distribution
Product	Mindshare (%)
Invicti	4.0%
Cortex Cloud by Palo Alto Networks	2.2%
Software Risk Manager ASPM	4.1%
Other	89.7%

Application Security Posture Management (ASPM)

Featured Reviews

Sonali Jha

Technical Solutions Architect at IBM

Cloud security has improved as AI-driven runtime protection detects threats and reduces incidents

In my opinion, Cortex Cloud by Palo Alto Networks could be improved or enhanced in various ways. I don't have an idea about that yet because for that you actually need to use two or three different other tools to make a basic comparison. If you ask me how good the tool is, I would fairly rate it quite high. The tool is very popular, and customers can already see that it is one of the cloud leaders in the security space. The platform had a very good feature which provides documentation links about how to use a specific feature on the UI. It takes you to the proper documentation page where it suggests what to do and tells you about the steps that need to be done for a resource deployment. My thoughts about improving the product which I believe could greatly aid vendors is that it used to be a very user-friendly tool, but now they have incorporated everything under one umbrella. It has XDR, XSOAR, and Cortex Cloud by Palo Alto Networks. Before, we used to have separate modules and separate environments for each of these capabilities or features. Right now, it is a little complex and users would take their own time to know the tool better. This is something that would have been way better, but I would say there would be different opinions on this. Talking about user-friendliness, it has decreased now.

Read full review

PrashantUppuluri

Solution Architect at a tech services company with 51-200 employees

Automated scanning has strengthened web application security and supports hybrid protection

A good scanning engine is what I appreciate about Invicti. When you want to find out the vulnerabilities within your web applications, Invicti has done a thorough job with respect to filtering out the vulnerabilities and identifying the risk factors with respect to the security modules within the solution. Invicti does have a segment of the solution which works on the automated scanning engine. As long as the license is active, the scanners that work within the solution are pretty effective. With respect to SAST and DAST, being a real-time scanning engine is one of the portfolios and one of the selling factors of the solution. Invicti is known to be a solution that works within the hybrid environment, be it cloud, on-premises, or a mix and match across multiple marketplaces. It does a thorough job. Most importantly, Invicti is a very good SAST and DAST solution that is very competitive in the market with respect to competitors. Invicti is a part of the Magic Quadrant with respect to Gartner's Magic Quadrant and has made a very good customer database and pipeline within the marketplace locally. With respect to security impacts in terms of support, Invicti is pretty much supportive. With respect to use cases or the POCs I have run on the solution, we have identified a couple of vulnerabilities and Invicti was able to trace them, detect, and quarantine the attacks.

Read full review

Saravanan_Radhakrishnan

Senior Manager at Happiest Minds Technologies

Facilitates continuous assessment of applications, covering both static and dynamic security aspects

Code Dx lacks one aspect, the dynamic security part, known as DAST. It's not an on-premise solution; it's in the cloud now. There are compliance standards and data standards where the customer might need to have the data on-premises for dynamic security testing. So that is one shortfall. An area of improvement could be developing an on-premise DAST solution. The current one is a complete cloud-based solution, and that can be one of the areas of improvement.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most beneficial aspect of Cortex Cloud by Palo Alto Networks and Palo Alto in general is that there is a single platform for all cloud providers for securitization."

"The capabilities of Cortex Cloud by Palo Alto Networks are valuable because it is the best product in the market."

"Overall, Cortex Cloud by Palo Alto Networks is a technically strong product, and I rate it ten out of ten."

"The most valuable features I have found in Cortex Cloud by Palo Alto Networks are those that we provided to customers in a stock environment, as we have done some POCs and tried to check how it can help different organizations, and this same solution has been positioned for multiple customers."

"I have absolutely seen improvements in our incident close rates, with mean time to detect and respond reduced significantly, sometimes by at least forty to fifty percent."

"I have seen several benefits from using Cortex Cloud by Palo Alto Networks: It was easy to use and easy to migrate from the IBM platform."

"Cortex Cloud by Palo Alto Networks has impacted our organization positively by keeping our machines secure and our team using the dashboard to find issues quickly."

"From a technical standpoint or pricing, Cortex Cloud by Palo Alto Networks is a stronger solution in the market at the moment compared to other products from ConnectWise or Symantec."

More Cortex Cloud by Palo Alto Networks pros

"I would definitely recommend to those who really want to know in-depth details of their applications/products regarding the security of their web system."

"I am impressed with Invictus’ proof-based scanning. The solution has reduced the incidence of false positive vulnerabilities. It has helped us reduce our time and focus on vulnerabilities."

"Netsparker has done an awesome job with its crawler, as it has found all of the links (also thanks to its good DOM parser)."

"The best features of Invicti are its ability to confirm access vulnerabilities, SSL injection vulnerabilities, and its connectors to other security tools."

"Invicti is a good product, and its API testing is also good."

"The scanner and the result generator are valuable features for us."

"High level of accuracy and quick scanning."

"Its ability to crawl a web application is quite different than another similar scanner, and sometimes it can find more vulnerabilities that another scanner can’t."

More Invicti pros

"The customers were looking for something around static security and dynamic security, and in all those areas, they were looking for an industry leader with a proven solution. Synopsys is a Gartner leader, so I position this particular technology for the technical pre-sales part of it."

Cons

"Cortex Cloud by Palo Alto Networks is creating some confusion in terms of names because this is recent."

"The pricing is high, making ROI challenging to justify, especially during transitions between solutions."

"The negative aspects or areas for improvement in the product include the fact that the cost might be a bit high, which challenges commercials, but not technically."

"Cortex Cloud by Palo Alto Networks is not the cheapest solution in the market, but I know that is the best solution for SOC and Cloud once have all tools to connect cloud issues with SOC procedures, because we are partners with T-Systems."

"Overall, I rate Cortex Cloud by Palo Alto Networks as an eight out of ten. I think that it could improve on price, as I know that the Google solution has the best price, and this is one of the conditions."

"My thoughts about improving the product which I believe could greatly aid vendors is that it used to be a very user-friendly tool, but now they have incorporated everything under one umbrella."

"From the commercial perspective, we have some limitations because Palo Alto has a minimum number of users of endpoints set at 200, which is quite high for the Italian market."

"Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed."

More Cortex Cloud by Palo Alto Networks cons

"The licensing model should be improved to be more cost-effective. There are URL restrictions that consume our license. Compared to other DAST solutions and task tools like WebInspect and Burp Enterprise, Invicti is very expensive. The solution’s scanning time is also very long compared to other DAST tools. It might be due to proof-based scanning."

"Currently, there is nothing I would like to improve."

"The scanning time, complexity, and authentication features of Invicti could be improved."

"The solution needs to make a more specific report."

"Perhaps the custom attack preparation screen might be improved."

"Right now, they are missing the static application security part, especially web application security."

"They could enhance the support for data swap testing for the platform."

"They don't really provide the proof of concept up to the level that we need in our organization. We are a consultancy firm, and we provide consultancy for the implementation and deployment solutions to our customers. When you run the scans and the scan is completed, it only shows the proof of exploit, which really doesn't work because the tool is running the scan and exploiting on the read-only form. You don't really know whether it is actually giving the proof of exploit. We cannot prove it manually to a customer that the exploit is genuine. It is really hard to perform it manually and prove it to the concerned development, remediation, and security teams. It is currently missing the static application security part of the application security, especially web application security. It would be really cool if they can integrate a SAS tool with their dynamic one."

More Invicti cons

"The initial setup is a bit challenging because things are not easy. It needs a lot of technology adaptability plus the customer's environment-specific use cases."

Pricing and Cost Advice

Information not available

"OWASP Zap is free and it has live updates, so that's a big plus."

"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."

"We never had any issues with the licensing; the price was within our assigned limits."

"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."

"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."

"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."

"The price should be 20% lower"

"It is competitive in the security market."

More Invicti pricing and cost advice

"It is more of an enterprise solution for budget-conscious customers. So, it's moderately priced. It's not for everybody."

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Posture Management (ASPM) solutions are best for your needs.

See recommendations

902,270 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

17%

Construction Company

11%

Financial Services Firm

Outsourcing Company

Financial Services Firm

16%

Manufacturing Company

10%

Construction Company

Computer Software Company

Financial Services Firm

16%

Manufacturing Company

14%

University

10%

Construction Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	7
Midsize Enterprise	1
Large Enterprise	4

By reviewers
Company Size	Count
Small Business	14
Midsize Enterprise	4
Large Enterprise	13

No data available

Questions from the Community

What is your experience regarding pricing and costs for Cortex Cloud by Palo Alto Networks?

I am not fully aware of the pricing and licensing of Cortex Cloud by Palo Alto Networks. The pricing is also based on...

See all answers

What needs improvement with Cortex Cloud by Palo Alto Networks?

In my opinion, Cortex Cloud by Palo Alto Networks could be improved or enhanced in various ways. I don't have an idea...

See all answers

What is your primary use case for Cortex Cloud by Palo Alto Networks?

The usual use cases for Cortex Cloud by Palo Alto Networks that I have been working with mostly are as simple as dete...

See all answers

What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?

The setup cost is pretty competitive. For example, if you want to talk about the SAST license, it comes to about $150...

See all answers

What needs improvement with Invicti?

At this time, there is nothing that comes to mind. However, most of the products in the market are pretty much neck-t...

See all answers

What is your primary use case for Invicti?

I have worked on a couple of products, specifically in web application security. I have worked on Invicti, and with r...

See all answers

Ask a question

Earn 20 points

Comparisons

Wiz vs Cortex Cloud by Palo Alto Networks

Compared 11% of the time

Prisma Cloud by Palo Alto Networks vs Cortex Cloud by Palo Alto Networks

Compared 11% of the time

SentinelOne Singularity Cloud Security vs Cortex Cloud by Palo Alto Networks

Compared 8% of the time

WithSecure Elements Exposure Management (XM) vs Cortex Cloud by Palo Alto Networks

Compared 7% of the time

Microsoft Defender for Cloud vs Cortex Cloud by Palo Alto Networks

Compared 5% of the time

More Cortex Cloud by Palo Alto Networks Competitors

Veracode vs Invicti

Compared 8% of the time

Acunetix vs Invicti

Compared 7% of the time

OpenText Dynamic Application Security Testing vs Invicti

Compared 6% of the time

SonarQube vs Invicti

Compared 5% of the time

Checkmarx One vs Invicti

Compared 4% of the time

More Invicti Competitors

PortSwigger Burp Suite Professional vs Software Risk Manager ASPM

Compared 24% of the time

Veracode vs Software Risk Manager ASPM

Compared 10% of the time

Polaris Platform vs Software Risk Manager ASPM

Compared 8% of the time

Checkmarx One vs Software Risk Manager ASPM

Compared 6% of the time

Ivanti Neurons for ASPM vs Software Risk Manager ASPM

Compared 5% of the time

More Software Risk Manager ASPM Competitors

Product Reports

Buyer's Guide

Cortex Cloud by Palo Alto Networks

June 2026

Cortex Cloud by Palo Alto Networks report

Download Cortex Cloud by Palo Alto Networks product report

Buyer's Guide

Invicti

June 2026

Download Invicti product report

Buyer's Guide

Application Security Posture Management (ASPM)

May 2026

Download Software Risk Manager ASPM product report

Also Known As

No data available

Netsparker

Code Dx

Overview

Cortex Cloud by Palo Alto Networks enhances cloud security with features like AI/ML threat detection and automated remediation, ensuring real-time protection and efficient management across cloud environments.

Cortex Cloud by Palo Alto Networks offers comprehensive cloud security posture management and runtime protection. It reduces manual tasks and accelerates incident investigation through advanced threat detection and AI-driven anomaly detection. With integration to the MITRE ATT&CK framework, it boosts threat response while reducing incident resolution time. Although users find the UI complex and pricing high, its capabilities in securing AWS, Azure, and other environments, as well as its potential integration with CyberArk, emphasize its enterprise-ready design for cloud transformation across diverse industry sectors.

What are the key features of Cortex Cloud by Palo Alto Networks?

Runtime Protection: Ensures real-time security for workloads.
AI/ML-powered Threat Detection: Identifies threats using AI/ML technology.
Automated Remediation: Streamlines threat response through automation.
Comprehensive Detection Coverage: Offers extensive detection capabilities with unified data.
Integration with MITRE ATT&CK: Enhances threat response efficiency.

What benefits or ROI should users consider?

Enhanced Security Visibility: Provides dashboards for better security insights.
Reduced Manual Tasks: Automates processes for efficiency gains.
Improved Threat Response: Accelerates incident resolution with AI-driven anomaly detection.
Seamless Cloud Integration: Supports APIs and multi-cloud environments.

Cortex Cloud by Palo Alto Networks is deployed across industries like telecom, BFSI, and manufacturing for robust cloud security. It's leveraged for detecting misconfigurations and vulnerabilities, aiding cloud transformation and compliance with standards such as GDPR and NIST. The integration across cloud infrastructures, including AWS and Azure, supports policy creation and threat management strategies for diverse enterprises.

Palo Alto Networks

Invicti offers advanced web application security testing focused on identifying vulnerabilities like SQL injection and cross-site scripting. Its Proof-Based Scanning minimizes false positives and integrates seamlessly with CI/CD pipelines, making it an effective tool for enterprise environments.

Invicti provides comprehensive scanning capabilities that include detecting and verifying critical vulnerabilities and security data consolidation. Its scalable scanning engine and robust API support allow for flexible testing across diverse environments, including web and API testing. Despite some drawbacks like limited single sign-on integration and slow scanning speeds for large applications, Invicti remains a popular choice for automating security assessments, ensuring compliance with standards like OWASP Top 10, PCI DSS, and GDPR.

What are the key features of Invicti?

Comprehensive Vulnerability Scanning: Detects vulnerabilities like SQL injection and XSS.
Proof-Based Scanning: Confirms exploitability and reduces false positives.
CI/CD Integration: Seamlessly integrates with development pipelines.
Security Data Consolidation: Centralizes data for better insights.
User-Friendly Interface: Facilitates easy analysis and reporting.
Scalable Scanning Engine: Supports testing in enterprise environments.
Robust API Support: Enhances flexibility in testing.

What benefits and ROI should users look for in reviews?

Proactive Security: Actively identifies and verifies vulnerabilities to prevent breaches.
Regulatory Compliance: Helps maintain compliance with standards like PCI DSS and GDPR.
Efficient Vulnerability Management: Aids in prioritizing remediation efforts.
Integration Capabilities: Streamlines processes with CI/CD pipeline compatibility.

In industries like finance, healthcare, and e-commerce, Invicti is implemented to bolster security through automated vulnerability assessments. Its ability to provide insightful reports and remediation suggestions assists companies in efficiently managing security risks and achieving compliance with critical regulatory standards.

Invicti

Software Risk Manager is an application security posture management (ASPM) solution that enables security and development teams to manage their application security programs at enterprise scale. By unifying policy, test orchestration, correlation, prioritization, and built-in static application security testing (SAST) and software composition analysis (SCA) engines, organizations can streamline their security activities across the enterprise.

Black Duck

Sample Customers

Information Not Available

Samsung, The Walt Disney Company, T-Systems, ING Bank

Discover why companies like: CGI said, "Synopsys and Software Risk Manager have provided the results we’re looking for".

Buyer's Guide

Application Security Posture Management (ASPM)

May 2026

Download Free Report

Find out what your peers are saying about Veracode, Snyk, Checkmarx and others in Application Security Posture Management (ASPM). Updated: May 2026.

DOWNLOAD NOW

902,270 professionals have used our research since 2012.

See our list of best Application Security Posture Management (ASPM) vendors, best Static Application Security Testing (SAST) vendors, and best Software Composition Analysis (SCA) vendors.

We monitor all Application Security Posture Management (ASPM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.