Try our new research platform with insights from 80,000+ expert users

PortSwigger Burp Suite Professional vs Rapid7 InsightAppSec comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

PortSwigger Burp Suite Prof...
Average Rating
8.6
Reviews Sentiment
7.7
Number of Reviews
62
Ranking in other categories
Application Security Tools (8th), Static Application Security Testing (SAST) (6th), Fuzz Testing Tools (1st)
Rapid7 InsightAppSec
Average Rating
8.6
Reviews Sentiment
7.1
Number of Reviews
13
Ranking in other categories
Dynamic Application Security Testing (DAST) (4th)
 

Mindshare comparison

While both are Quality Assurance solutions, they serve different purposes. PortSwigger Burp Suite Professional is designed for Application Security Tools and holds a mindshare of 1.8%, down 2.0% compared to last year.
Rapid7 InsightAppSec, on the other hand, focuses on Dynamic Application Security Testing (DAST), holds 13.2% mindshare, up 13.1% since last year.
Application Security Tools
Dynamic Application Security Testing (DAST)
 

Featured Reviews

Anuradha.Kapoor Kapoor - PeerSpot reviewer
Offers efficient scanning of entire websites but presence of false positive bugs, leading to time-consuming efforts in distinguishing real bugs from false alarms
We have found that so many times, false positive bugs are there, and then we spend a lot of time basically separating them from real bugs. So that's the reason we are looking for some other tool. So we were in discussion with Acunetix. Therefore, the false positive rate is, like, something that we would like to improve. What we are looking for is if this false positive rate goes down because we were OWASP Zap tool users, which was free anyway. But there were a lot of false positives there, and we used to spend a lot of time, like, for security reasons, reproducing those bugs for the development team to fix it. So then we thought, okay, why not we go with the tool? Even if it is not very expensive. But still, every year, we have to renew the license. And we got this tool. Again, we found that in this tool also, even if it is less, there are still a lot of false positive bugs out there. So we again have to spend so much time. So we hired a security tester, who was basically using Acunetix in his previous company for almost three years, and then you said that in that scanning is very slow. The scanning is also slow. Like, sometimes the site scan takes eight hours, six to eight hours. Yeah. And whereas in Acunetix, it took three to four hours. And plus, there are no false positives. I'm not saying none but there's very little. But here, the rate sometimes is very high. These are the two features I think we would like to improve further.
Vikas Dusa - PeerSpot reviewer
Helps to check multiple websites, particularly dynamic and e-commerce websites, for vulnerabilities within the code
In Rapid7 InsightAppSec, a distinctive feature is the provision of a CDM for integrating web servers and web applications. To establish the connection between these applications, you only need to paste the provided CDN into your metadata. Once connected, every piece of information, including vulnerabilities, can be accessed. It also offers demo sessions. If there is any malicious network traffic targeting a specific web application, it is designed to detect and showcase the entire scenario. It provides insights into potential vulnerabilities, including issues related to process scripting or content security policy vulnerabilities. Setting up and configuring scans within the tool is easy, and I would rate it a nine out of ten. It provides videos on YouTube, along with documentation that breaks down the process into step-by-step instructions.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature of Burp Suite Professional is its ability to schedule tasks for scanning websites, which helps in performing regular checks of IP addresses."
"One useful function is the ability to send requests to the repeater without making actual requests through the browser, allowing me to modify requests easily."
"The way they do the research and they keep their profile up to date is great. They identify vulnerabilities and update them immediately."
"The solution is stable."
"We are mostly using it for scanning the entire website. So, we basically create a script with the entire website and then run it for different injections."
"I personally love its capability to automatically and accurately detect vulnerabilities. So, I would say it is the Burp scanner that is THE most powerful, valuable, and an awesome feature."
"Some of the extensions, available using Burp Extender, are also very good and we have found issues by using them."
"PortSwigger Burp Suite Professional is one of the best user-friendly solutions for getting the proxy set up."
"It's very easy to use and user-friendly. It does the job."
"The solution is stable."
"The initial setup for us was easy enough. We didn't face too many issues. Deployment took maybe 30 minutes. It's quite quick and doesn't cause too much trouble at the outset."
"It uses a signature-based method to check for problems with your code and will provide an alert if anything is found."
"Dynamic application security scanning provides predefined templates and supports customization. The ability to scan external and internal applications, including on-premises ones, is precious. Additionally, it is a cloud platform, so we don't need to deploy servers or resources. This makes it time-efficient and cost-effective."
"The product’s most valuable feature is UI. It is easy to manage and find vulnerabilities in the application."
"We have seen measurable decrease in the mean time to respond to threats by 20 percent."
"In Rapid7 InsightAppSec, a distinctive feature is the provision of a CDM for integrating web servers and web applications. To establish the connection between these applications, you only need to paste the provided CDN into your metadata. Once connected, every piece of information, including vulnerabilities, can be accessed. It also offers demo sessions."
 

Cons

"Integration is a big problem."
"The biggest drawback is reporting. It's not so good. I can download them, but they're not so informative."
"The one feature that I would like to see in Burp is active scanning of REST based web services. A lot of organizations are providing APIs to access their services to support different business models like SaaS. Scanning these APIs is still a challenge for many security product companies."
"There should be a heads up display like the one available in OWASP Zap."
"Scanning needs to be improved in enterprise and professional versions."
"Currently, the scanning is only available in the full version of Burp, and not in the Community version."
"The technical support team's response time is mostly delayed and should be improved."
"The price could be better. The rest is fine."
"The interface should be a little bit easier to manage. Sometimes, the logic that they use is kind of strange. They need to work a little bit more on their interface to make it more understandable. The interface is the only problem. I'm using Rapid7, which is very intuitive. There are other applications available in the market with a better interface. They can include more techniques or options to test different types of security because the templates are limited. It would be great to see them follow the MITRE ATT&CK framework or what is there in tools like Veracode and Synopsys."
"They should add more features. I would like to see them do a little more on static analysis and also interactivity analysis. Currently, it does very basic static analysis. It could do a little more static analysis, which is something that would help. A lot more interactivity analysis should also be there. It should basically look at security during interactivity."
"Rapid7 InsightAppSec needs improvement in detecting phishing pages."
"I would like more details of what the product can do."
"When you add new projects for the same product, it either duplicates or replaces the scan configuration. If I run a scan for the same product with a different scan configuration, it should keep the previous scan configuration and not replace it with the new scan configuration. It should just add the new scan configuration. That would be helpful. They do keep the results as it is, but the scan configuration keeps changing. For example, I have set a scan configuration to a full scan, and next week, I want to run a new scan for the same product with some changes or new functionalities. I want to run a partial scan. Currently, if I change the scan configuration to partial, it changes the old one also to partial. That should be improved."
"The dynamic scanning feature has simplified and improved the security testing process. I suggest adding a SaaS feature to the solution to support scanning SaaS applications, making it more comprehensive. It would be beneficial if the solution could also scan mobile applications. It only scans web applications and should also cover mobile applications, including firmware recommendations."
"We get a lot of false positives during the tests."
"The product’s pricing could be flexible."
 

Pricing and Cost Advice

"There are multiple versions available of PortSwigger Burp Suite, such as enterprise, commercial, professional, and beginners."
"This solution requires a license. It is expensive but you receive a lot of functionality for the price."
"It's a lower priced tool that we can rely on with good standard mechanisms."
"Burp Suite is affordable."
"It has a yearly license. I am satisfied with its price."
"We pay a yearly licensing fee for the solution, which is neither cheap nor expensive."
"Licensing costs are about $450/year for one use. For larger organizations, they're able to test against multiple applications while simultaneously others might have multiple versions of applications which needs to be tested which is why we have the enterprise edition."
"PortSwigger Burp Suite Professional is an expensive solution."
"The price of this product is very cheap."
"I'm not sure how much it costs exactly, but I know it's expensive."
"I rate Rapid7 InsightAppSec’s pricing an eight out of ten."
"Its price is competitive. It is not expensive."
"Rapid7 InsightAppSec is cheap."
"They offer a good price, but I don't remember its cost. It is fair as compared to the competition. We have opted for project-based licensing, not user-based. We can add any number of users. That doesn't matter. It is worth the money."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
831,158 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
Financial Services Firm
12%
Government
11%
Manufacturing Company
8%
Computer Software Company
19%
Financial Services Firm
14%
Manufacturing Company
10%
Government
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Is OWASP Zap better than PortSwigger Burp Suite Pro?
OWASP Zap and PortSwigger Burp Suite Pro have many similar features. OWASP Zap has web application scanning available with basic security vulnerabilities while Burp Suite Pro has it available with ...
What do you like most about PortSwigger Burp Suite Professional?
The solution helped us discover vulnerabilities in our applications.
What is your experience regarding pricing and costs for PortSwigger Burp Suite Professional?
The pricing for Burp Suite Professional is not very high, however, it could be more flexible for clients.
What do you like most about Rapid7 InsightAppSec?
In Rapid7 InsightAppSec, a distinctive feature is the provision of a CDM for integrating web servers and web applications. To establish the connection between these applications, you only need to p...
What needs improvement with Rapid7 InsightAppSec?
The dynamic scanning feature has simplified and improved the security testing process. I suggest adding a SaaS feature to the solution to support scanning SaaS applications, making it more comprehe...
What is your primary use case for Rapid7 InsightAppSec?
We use Rapid7 InsightAppSec for dynamic application security scanning. We scan our web applications to identify vulnerabilities and then address the issues based on the report. It is a task solutio...
 

Also Known As

Burp
InsightAppSec
 

Overview

 

Sample Customers

Google, Amazon, NASA, FedEx, P&G, Salesforce
CenterPoint Energy, CPA Australia, Hypertherm, First American Financial Corporation, Rackspace
Find out what your peers are saying about PortSwigger Burp Suite Professional vs. Rapid7 InsightAppSec and other solutions. Updated: May 2022.
831,158 professionals have used our research since 2012.