Checkmarx One vs Invicti comparison

Read 28 Invicti reviews

3,009 Views
1,606 Comparison Views

96% willing to recommend

Checkmarx One

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

Invicti and Checkmarx One are both key players in the security testing tools category, serving different user preferences. Invicti appears to have the upper hand in terms of pricing and customer service, whereas Checkmarx One is favored for its comprehensive features.

Features: Invicti offers ease of integration, accurate vulnerability scans, and streamlined security assessments. Checkmarx One stands out with static and dynamic application security testing and broader security coverage.

Room for Improvement: Invicti could improve its reporting outputs, scalability, and handling of larger projects. Checkmarx One needs more intuitive navigation, faster analysis times, and could simplify deployment.

Ease of Deployment and Customer Service: Invicti is known for its straightforward deployment and responsive customer service. Checkmarx One, while more complex to deploy, provides comprehensive support, though response times vary.

Pricing and ROI: Invicti's pricing is considered reasonable, offering a positive ROI. Checkmarx One, although more expensive, delivers substantial returns, justifying its cost with advanced features.

To learn more, read our detailed Checkmarx One vs. Invicti Report (Updated: November 2024).

Checkmarx One vs. Invicti

November 2024

Download the complete report

Helped 824,067 peers since 2012

Categories and Ranking

Checkmarx One

Ranking in Static Application Security Testing (SAST)

3rd

Ranking in API Security

2nd

Average Rating

7.6

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Application Security Tools (3rd), Vulnerability Management (20th), Static Code Analysis (2nd), DevSecOps (2nd), Risk-Based Vulnerability Management (6th)

Invicti

Ranking in Static Application Security Testing (SAST)

14th

Ranking in API Security

5th

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Dynamic Application Security Testing (DAST) (3rd)

Mindshare comparison

As of December 2024, in the Static Application Security Testing (SAST) category, the mindshare of Checkmarx One is 12.4%, down from 13.9% compared to the previous year. The mindshare of Invicti is 1.4%, up from 1.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST)

Featured Reviews

Rohit Kesharwani

Manager, Engineering at 7-Eleven.

Provides good security analysis and security identification within the source code

We integrate Checkmarx into our software development cycle using GitLab's CI/CD pipeline. Checkmark has been the most helpful for us in the development stage. The solution's incremental scanning feature has impacted our development speed. The solution's vulnerability detection is around 80% to 90% accurate. I would recommend Checkmarx to other users because it is one of the good tools for doing security analysis and security identification within the source code. Overall, I rate Checkmarx a nine out of ten.

Read full review

Amr Abdelnaser

Senior Information Security Analyst at EastNets Holding Ltd.

A safe solution used to detective vulnerabilities for dynamic and complex testing

The Invicti is the scope application tool. The solution is installed on-premise but could be installed as a web version. Starting from the latest version, the web version could be used. They have a web application server. The deployment of the solution involves installing the EXE and configuring your machine.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"From my point of view, it is the best product on the market."

"The user interface is excellent. It's very user friendly."

"Helps us check vulnerabilities in our SAP Fiori application."

"The most valuable feature of Checkmarx is the user interface, it is very easy to use. We do not need to configure anything, we only have to scan to see the results."

"Checkmarx offers many valuable features, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), Infrastructure as Code (IAC), Supply Chain Security, and API Security."

"It has all the features we need."

"The most valuable features of Checkmarx are the Best Fix Location and the Payments option because you can save a lot of time trying to mitigate the configuration. Using these tools can save you a lot of time."

"We use the solution for dynamic application testing."

More Checkmarx One pros

"It has very good integration with the CI/CD pipeline."

"Netsparker has valuable features, including the ability to scan our website, an interactive approach, and security data integration."

"Crawling feature: Netsparker has very detail crawling steps and mechanisms. This feature expands the attack surface."

"The scanner and the result generator are valuable features for us."

"The most valuable feature of Invicti is getting baseline scanning and incremental scan."

"Attacking feature: Actually, attacking is not a solo feature. It contains many attack engines, Hawk, and many properties. But Netsparker's attacking mechanism is very flexible. This increases the vulnerability detection rate. Also, Netsparker made the Hawk for real-time interactive command-line-based exploit testing. It's very valuable for a vulnerability scanner."

"The scanner is light on the network and does not impact the network when scans are running."

"Invicti's best feature is the ability to identify vulnerabilities and manually verify them."

More Invicti pros

Cons

"Checkmarx needs improvement in its Dynamic Application Security Testing (DAST) and API security features."

"Implementing a blackout time for any user or teams: Needs improvement."

"Checkmarx needs to be more scalable for large enterprise companies."

"You can't use it in the continuous delivery pipeline because the scanning takes too much time."

"When we first ran it on a big project, there wasn't enough memory on the computer. It originally ran with eight gigabytes, and now it runs with 32. The software stopped at some point, and while I don't think it said it ran out of memory, it just said "stopped" and something else. We had to go to the logs and send them to the integrator, and eventually, they found a memory issue in the logs and recommended increasing the memory. We doubled it once, and it didn't seem enough. We doubled it again, and it helped."

"The integration could improve by including, for example, DevSecOps."

"Checkmarx is not good because it has too many false positive issues."

"Checkmarx could improve by reducing the price."

More Checkmarx One cons

"The solution needs to make a more specific report."

"The scanning time, complexity, and authentication features of Invicti could be improved."

"The custom attack preparation screen might be improved."

"Asset scanning could be better. Once, it couldn't scan assets, and the issue was strange. The price doesn't fit the budget of small and medium-sized businesses."

"Reporting should be improved. The reporting options should be made better for end-users. Currently, it is possible, but it's not the best. Being able to choose what I want to see in my reports rather than being given prefixed information would make my life easier. I had to depend on the API for getting the content that I wanted. If they could fix the reporting feature to make it more comprehensive and user-friendly, it would help a lot of end-users. Everything else was good about this product."

"The proxy review, the use report views, the current use tool and the subset requests need some improvement. It was hard to understand how to use them."

"The solution's false positive analysis and vulnerability analysis libraries could be improved."

"Currently, there is nothing I would like to improve."

More Invicti cons

Pricing and Cost Advice

"We have purchased an annual license to use this solution. The price is reasonable."

"We have a subscription license that is on a yearly basis, and it's a pretty competitive solution."

"For around 250 users or committers, the cost is approximately $500,000."

"This solution is expensive. The customized package allows you to buy additional users at any time."

"Its price is fair. It is in or around the right spot. Ultimately, if the price is wrong, customers won't commit, but they do tend to commit. It is neither too cheap nor too expensive."

"Checkmarx is comparatively costlier than other products, which is why some of the customers feel reluctant to go for it, though performance-wise, Checkmarx can compete with other products."

"The pricing was not very good. This is just a framework which shouldn’t cost so much."

"The tool's pricing is fine."

More Checkmarx One pricing and cost advice

"It is competitive in the security market."

"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."

"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."

"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."

"We never had any issues with the licensing; the price was within our assigned limits."

"OWASP Zap is free and it has live updates, so that's a big plus."

"The price should be 20% lower"

"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."

More Invicti pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

824,067 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

22%

Computer Software Company

15%

Manufacturing Company

10%

Government

Educational Organization

55%

Financial Services Firm

Computer Software Company

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.

What do you like most about Checkmarx?

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

What is your experience regarding pricing and costs for Checkmarx?

The pricing is relatively expensive due to the product's quality and performance, but it is worth it.

What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?

As a technical user, I do not handle pricing or licensing, but I am aware that Invicti offers flexible licensing models based on organizational needs.

What do you like most about Invicti?

The most valuable feature of Invicti is getting baseline scanning and incremental scan.

What needs improvement with Invicti?

Currently, there is nothing I would like to improve.

SonarQube Server (formerly SonarQube) vs Checkmarx One

Comparisons

Compared 48% of the time

Veracode vs Checkmarx One

Compared 13% of the time

Fortify on Demand vs Checkmarx One

Compared 5% of the time

Coverity vs Checkmarx One

Compared 4% of the time

Snyk vs Checkmarx One

Compared 4% of the time

More Checkmarx One Competitors

Acunetix vs Invicti

Compared 16% of the time

OWASP Zap vs Invicti

Compared 16% of the time

Qualys Web Application Scanning vs Invicti

Compared 7% of the time

PortSwigger Burp Suite Professional vs Invicti

Compared 7% of the time

SonarQube Server (formerly SonarQube) vs Invicti

Compared 5% of the time

More Invicti Competitors

Product Reports

Download Checkmarx One product report

Checkmarx One

December 2024

Download Invicti product report

December 2024

Also Known As

No data available

Netsparker

Learn More

Checkmarx

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Invicti helps DevSecOps teams automate security tasks and save hundreds of hours each month by identifying web vulnerabilities that matter. Combining dynamic with interactive testing (DAST + IAST) and software composition analysis (SCA), Invicti scans every corner of an app to find what other tools miss with 99.98% accuracy, delivering on the promise of Zero Noise AppSec. Invicti helps discover all web assets — even ones that are lost, forgotten, or created by rogue departments. With an array of out-of-the-box integrations, DevSecOps teams can get ahead of their workloads to hit critical deadlines, improve processes, and communicate more effectively while reducing risk and hitting the ROI goals.

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Samsung, The Walt Disney Company, T-Systems, ING Bank