Try our new research platform with insights from 80,000+ expert users

Invicti vs Wallarm NG WAF comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 4, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Invicti
Ranking in API Security
5th
Average Rating
8.2
Reviews Sentiment
7.3
Number of Reviews
29
Ranking in other categories
Static Application Security Testing (SAST) (15th), Dynamic Application Security Testing (DAST) (3rd)
Wallarm NG WAF
Ranking in API Security
12th
Average Rating
8.6
Reviews Sentiment
7.1
Number of Reviews
5
Ranking in other categories
Web Application Firewall (WAF) (36th)
 

Mindshare comparison

As of April 2025, in the API Security category, the mindshare of Invicti is 2.5%, up from 2.0% compared to the previous year. The mindshare of Wallarm NG WAF is 3.7%, down from 4.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
API Security
 

Featured Reviews

Kunal M - PeerSpot reviewer
Proactive scanning measures and realistic audit recommendations enhance development focus
Invicti's proactive scanning measures vulnerabilities each time we deploy or push code to a new environment. This feature helps us focus on priorities and prioritize the development team's effort, integrating seamlessly with DevOps to facilitate proactive scans of environments. Invicti also provides audit recommendations that are quite realistic, making it easy to discuss plans with developers.
it_user666765 - PeerSpot reviewer
Deployment is simple. Machine learning techniques lower the false-positives alerts rate.
The use of a WAF becomes especially relevant in the case of concrete vulnerabilities, such as those uncovered via penetration tests or source code reviews. Even if it were possible to fix the vulnerability in the application promptly and with a reasonable amount of effort, the modified version can generally only be deployed at the next maintenance interval; often 2-4 weeks later (a patch dilemma). For a WAF with whitelisting, vulnerabilities can be fixed promptly (hotfix) so that they cannot be exploited before the next scheduled maintenance. WAFs are especially fast in this aspect, meaning they can collaborate with source code analysis tools, so that detected external vulnerabilities can automatically result in a recommended rule set for the WAF. A WAF is particularly important in securing productive web applications which themselves in turn consist of multiple components and which cannot be quickly changed by the operator; e.g., in the case of poorly documented applications or regarding third-party products without sufficient maintenance cycles. A WAF is the only option for promptly closing external vulnerabilities.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Scan, proxify the application, and then detailed report along with evidence and remediations to problems."
"Netsparker provides a more interactive interface that is more appealing."
"High level of accuracy and quick scanning."
"It has a comprehensive resulting mechanism. It is a one-stop solution for all your security testing mechanisms."
"One of the features I like about this program is the low number of false positives and the support it offers."
"The most attractive feature was the reporting review tool. The reporting review was very impressive and produced very fruitful reports."
"I like that it's stable and technical support is great."
"The platform is stable."
"Helps us to monitor situation in regards to attacks to our sites and prevents a lot of them."
 

Cons

"The scanner itself should be improved because it is a little bit slow."
"The scannings are not sufficiently updated."
"Asset scanning could be better. Once, it couldn't scan assets, and the issue was strange. The price doesn't fit the budget of small and medium-sized businesses."
"The license could be better. It would help if they could allow us to scan multiple URLs on the same license. It's a major hindrance that we are facing while scanning applications, and we have to be sure that the URLs are the same and not different so that we do not end up consuming another license for it. Netsparker is one of the costliest products in the market. The licensing is tied to the URL, and it's restricted. If you have a URL that you scanned once, like a website, you cannot retry that same license. If you are scanning the same website but in a different domain or different URL, you might end up paying for a second license. It would also be better if they provided proper support for multi-factor authentications. In the next release, I would like them to include good multi-factor authentication support."
"The proxy review, the use report views, the current use tool and the subset requests need some improvement. It was hard to understand how to use them."
"The custom attack preparation screen might be improved."
"The solution's false positive analysis and vulnerability analysis libraries could be improved."
"Invicti's reporting capabilities need enhancement. We need enterprise-level information instead of repo-level details. Unlike Appiro, Invicti does not provide portfolio-level insights into vulnerability remediation over time."
"The biggest problem for us was the stability and speed using the first version of Wallarm. Now, it is fine."
 

Pricing and Cost Advice

"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."
"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."
"OWASP Zap is free and it has live updates, so that's a big plus."
"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."
"The price should be 20% lower"
"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."
"We never had any issues with the licensing; the price was within our assigned limits."
"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."
"​Pricing must be cheaper than the competition and the licensing must be good.​"
report
Use our free recommendation engine to learn which API Security solutions are best for your needs.
845,406 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Educational Organization
52%
Financial Services Firm
9%
Computer Software Company
7%
Manufacturing Company
4%
Computer Software Company
19%
Real Estate/Law Firm
9%
Comms Service Provider
7%
Financial Services Firm
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?
As a technical user, I do not handle pricing or licensing, but I am aware that Invicti offers flexible licensing models based on organizational needs.
What do you like most about Invicti?
The most valuable feature of Invicti is getting baseline scanning and incremental scan.
What needs improvement with Invicti?
Invicti's reporting capabilities need enhancement. We need enterprise-level information instead of repo-level details. Unlike Appiro, Invicti does not provide portfolio-level insights into vulnerab...
Ask a question
Earn 20 points
 

Comparisons

 

Also Known As

Netsparker
Wallarm NG-WAF
 

Overview

 

Sample Customers

Samsung, The Walt Disney Company, T-Systems, ING Bank
Panasonic. Miro. Rappi. Wargaming. Gannett. Omio. Acronis. Workforce Software. Tipalti. SEMRush.
Find out what your peers are saying about Invicti vs. Wallarm NG WAF and other solutions. Updated: March 2025.
845,406 professionals have used our research since 2012.