No more typing reviews! Try our Samantha, our new voice AI agent.

OpenText Dynamic Application Security Testing vs StackHawk comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 29, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

OpenText Dynamic Applicatio...
Ranking in Dynamic Application Security Testing (DAST)
3rd
Average Rating
7.2
Reviews Sentiment
6.1
Number of Reviews
22
Ranking in other categories
DevSecOps (8th)
StackHawk
Ranking in Dynamic Application Security Testing (DAST)
10th
Average Rating
7.6
Reviews Sentiment
4.6
Number of Reviews
2
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of June 2026, in the Dynamic Application Security Testing (DAST) category, the mindshare of OpenText Dynamic Application Security Testing is 11.6%, up from 10.2% compared to the previous year. The mindshare of StackHawk is 1.7%, up from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Dynamic Application Security Testing (DAST) Mindshare Distribution
ProductMindshare (%)
OpenText Dynamic Application Security Testing11.6%
StackHawk1.7%
Other86.7%
Dynamic Application Security Testing (DAST)
 

Featured Reviews

AP
Cyber Security Consultant at a tech vendor with 10,001+ employees
Enhancements in manual testing align with reporting and integration features
WebInspect works efficiently with Java-based or .NET based applications. However, it struggles with Salesforce applications, where it requires approximately 20-24 hours to crawl and audit but produces minimal findings, necessitating manual verification. The solution offers customization features for crawling and vulnerability detection. It includes various security frameworks and allows selection of specific vulnerability types to audit, such as OWASP Top 10 or JavaScript-based vulnerabilities. When working with APIs, we can select OWASP API Top 10. The tool also supports custom audit features by combining different security frameworks. For on-premises deployment, the setup is complex, particularly regarding SQL server configuration. Unlike Burp Suite or OpenText Dynamic Application Security Testing, which have simpler setup processes, WebInspect requires SQL server setup to function.
Ney Roman - PeerSpot reviewer
DevOps Engineer at Deuna
Vulnerability visibility has improved across microservices but integration still needs refinement
StackHawk can be improved in the way that it is integrated, as at the very beginning, the idea was to, within the pipeline, mount the different resources that our microservices needed to start to run. For example, if we have a service that needed Redis, maybe Kafka, or a database to initialize, we did need to have a Docker Compose file, get up those services, and after that, do the analysis. It didn't have that; it wasn't reachable at the very beginning and it wasn't that good as we expected. But at some point, we decided to mount it as an agent in the Docker file, and it was waiting for new jobs. It was even better, and when we figured out how to integrate it within our EKS cluster, suddenly we started reaching to the services, knowing what was going on, and everything related to security. As long as we have a P2T to our QA site or cluster, we do not have garbage in our databases, but StackHawk does put a little information, a garbage information, doing their job. That's the main area I'm focusing on right now regarding needed improvements.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The feature that has been most influential in identifying vulnerabilities is its ability to crawl the website, understand the structure, and analyze the network packets sent and received."
"I've found the centralized dashboard the most valuable. For the management, it helps a lot to have abilities at the central level."
"The transaction recorder within WebInspect is easy to use, which is valuable for our team."
"Reporting, centralized dashboard, and bird's eye view of all vulnerabilities are the most valuable features."
"It is easy to use, and its reporting is fairly simple."
"There are lots of small settings and tools, like an HTTP editor, that are very useful."
"It's a well-known platform for doing dynamic application scanning."
"The most valuable feature is the static analysis."
"StackHawk has positively impacted my organization by giving us a new vision of how vulnerabilities were seen, as we now have more visibility in that matter."
"StackHawk has positively impacted my organization by introducing an automated process that did not exist previously, and it helped the company achieve PCI certification."
 

Cons

"The first time we ran the module, it was okay, however, the next time we ran it, it almost crashed."
"The solution is on the expensive side. It's something that clients comment on."
"Fortify WebInspect could improve user-friendliness. Additionally, it is very bulky to use."
"The installation could be a bit easier. Usually it's simple to use, but the installation is painful and a bit laborious and complex."
"Not sufficiently compatible with some of our systems."
"My advice to others using Fortify WebInspect is not to use it, there are better solutions in the market."
"I'm not sure licensing, but on the pricing, it's a bit costly. It's a bit overpriced. Though it is an enterprise tool, there are other tools also with similar functionalities."
"I want to enhance automation. Currently, Fortify WebInspect can scan and find vulnerabilities, but users with specific skills need to interpret the results and understand how to address them."
"On a scale of one to ten, I would rate StackHawk an eight, only because I wish the product was a little less expensive."
"StackHawk can be improved in the way that it is integrated, as at the very beginning, the idea was to, within the pipeline, mount the different resources that our microservices needed to start to run."
 

Pricing and Cost Advice

"Its price is almost similar to the price of AppScan. Both of them are very costly. Its price could be reduced because it can be very costly for unlimited IT scans, etc. I'm not sure, but it can go up to $40,000 to $50,000 or more than that."
"Fortify WebInspect is a very expensive product."
"It’s a fair price for the solution."
"The pricing is not clear and while it is not high, it is difficult to understand."
"Our licensing is such that you can only run one scan at a time, which is inconvenient."
"This solution is very expensive."
"The price is okay."
Information not available
report
Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.
900,644 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Government
12%
Manufacturing Company
7%
Computer Software Company
7%
No data available
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise1
Large Enterprise15
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Fortify WebInspect?
While I am not directly involved with licensing, I can share that our project's license for 1-9 applications costs between $15,000 to $19,000. In comparison, Burp Suite costs approximately $500 to ...
What needs improvement with Fortify WebInspect?
WebInspect works efficiently with Java-based or .NET based applications. However, it struggles with Salesforce applications, where it requires approximately 20-24 hours to crawl and audit but produ...
What is your primary use case for Fortify WebInspect?
I am currently working with several tools. For Fortify, I use SCA and WebInspect. Apart from that, I use Burp Suite from PortSwigger. For API testing, I use Postman with Burp Suite or WebInspect fo...
What needs improvement with StackHawk?
I cannot think of anything I would add to StackHawk, with the possible exception of adding any additional code bases that might be out there. I am thinking about a situation where a company might b...
What is your primary use case for StackHawk?
My main use case for StackHawk is primarily as a PCI requirement for DAST. As a quick specific example of how I use StackHawk for that PCI requirement, it is one of the controls that sits alongside...
What advice do you have for others considering StackHawk?
StackHawk is deployed in my organization in the public cloud using the configuration on their site. I use AWS as my cloud provider. I rate this product an eight out of ten.
 

Also Known As

Micro Focus WebInspect, WebInspect
No data available
 

Overview

 

Sample Customers

Aaron's
Information Not Available
Find out what your peers are saying about Veracode, Checkmarx, OpenText and others in Dynamic Application Security Testing (DAST). Updated: June 2026.
900,644 professionals have used our research since 2012.