Try our new research platform with insights from 80,000+ expert users

Rapid7 Metasploit vs Snyk comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Rapid7 Metasploit
Average Rating
7.6
Number of Reviews
18
Ranking in other categories
Vulnerability Management (19th)
Snyk
Average Rating
8.2
Reviews Sentiment
7.3
Number of Reviews
43
Ranking in other categories
Application Security Tools (4th), Container Security (7th), Software Composition Analysis (SCA) (3rd), Software Development Analytics (2nd), DevSecOps (1st)
 

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Rapid7 Metasploit is designed for Vulnerability Management and holds a mindshare of 1.9%, down 1.9% compared to last year.
Snyk, on the other hand, focuses on Application Security Tools, holds 7.6% mindshare, down 8.5% since last year.
Vulnerability Management
Application Security Tools
 

Featured Reviews

Aqeel Junaid - PeerSpot reviewer
Mar 14, 2024
Helps find vulnerabilities in a system to determine whether the system needs to be upgraded
I've been using Rapid7 Metasploit to create vulnerabilities and test exploits. I can create malicious Word documents through the Rapid7 Metasploit framework for testing purposes. I can create a backdoor through the solution to test a web server or a vulnerable machine The most valuable features…
Jayashree Acharyya - PeerSpot reviewer
Mar 4, 2024
Used for image scanning and identifying vulnerabilities, but its integration with other services could be improved
The solution has improved or streamlined our process a lot for securing container images. We wanted to make sure we are deploying the secure Docker images. Snyk allowed us to check whether it is following our standard of docker images or not. We use Azure DevOps as our platform, and Snyk's integration with Azure DevOps was okay. However, Snyk's integration with JFrog Artifactory didn't go well. We use JFrog Artifactory to store the artifacts we download. We wanted to integrate Snyk with JFrog Artifactory to scan the binary artifacts we downloaded, but that broke our JFrog Artifactory for some reason. Instead of using it there, we are calling it directly from the pipeline. Snyk's automation features significantly reduced remediation times a couple of times. Sometimes, our developers scan the code from the environment and find some Java vulnerabilities. We fixed those vulnerabilities in the lower environment itself. The solution does not require any maintenance. The accuracy of Snyk's vulnerability detection is pretty good compared to other tools. I rate the solution's vulnerability detection feature an eight out of ten. I would recommend Snyk to other users because it is easy to implement and integrate with Azure DevOps and GitHub. Overall, I rate the solution a seven out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution is open source and has many small targetted penetration tests that have been written by many people that are useful. You can choose different subjects for the test, such as Oracle databases or Apache servers."
"Technical support has been helpful and responsive."
"The option to generate phishing emails has proven to be very valuable in understanding the behavior of users."
"All of the features are great."
"It allows us to concentrate solely on identified vulnerabilities without the hassle of additional setup."
"Rapid7 Metasploit is a useful product."
"It's not possible to do penetration testing without being very proficient in Metasploit."
"It is scalable. It's in line with our needs."
"The most valuable feature of Snyk is the SBOM."
"It is a stable solution. Stability-wise, I rate the solution a ten out of ten."
"Snyk categorizes the level of vulnerability into high, medium, and low, which helps organizations prioritize which issues to tackle first."
"The most valuable feature is that they add a lot of their own information to the vulnerabilities. They describe vulnerabilities and suggest their own mitigations or version upgrades. The information was the winning factor when we compared Snyk to others. This is what gave it more impact."
"Its reports are nice and provide information about the issue as well as resolution. They also provide a proper fix. If there's an issue, they provide information in detail about how to remediate that issue."
"The most effective feature in securing project dependencies stems from its ability to highlight security vulnerabilities."
"Snyk is a developer-friendly product."
"Snyk helps me pinpoint security errors in my code."
 

Cons

"I think areas with shortcomings that need improvement are more integration and automation."
"Rapid7 Metasploit can add a GUI feature because it is only available online."
"Metasploit cannot be installed on a machine with an antivirus."
"At the time I was using it, the graphical user interface needed some improvements."
"I would like to see more capabilities, more functions, and more features. More types of attack vectors."
"There are numerous outdated exploits in their database that should be updated."
"It is necessary to add some training materials and a tutorial for beginners."
"The initial setup was a bit "tweaky" for the open-source version."
"Offering API access in the lower or free open-source tiers would be better. That would help our customers. If you don't have an enterprise plan, it becomes challenging to integrate with the rest of the systems. Our customers would like to have some open-source integrations in the next release."
"We use Bamboo for CI.CD, and we had problems integrating Snyk with it. Ultimately, we got the two solutions to work together, but it was difficult."
"The solution's integration with JFrog Artifactory could be improved."
"It can be improved from the reporting perspective and scanning perspective. They can also improve it on the UI front."
"The documentation sometimes is not relevant. It does not cover the latest updates, scanning, and configurations. The documentation for some things is wrong and does not cover some configuration scannings for the multiple project settings."
"We've also had technical issues with blocking newly introduced vulnerabilities in PRs and that was creating a lot of extra work for developers in trying to close and reopen the PR to get rid of some areas. We ended up having to disable that feature altogether because it wasn't really working for us and it was actually slowing down developer velocity."
"There is always more work to do around managing the volume of information when you've got thousands of vulnerabilities. Trying to get those down to zero is virtually impossible, either through ignoring them all or through fixing them. That filtering or information management is always going to be something that can be improved."
"Snyk's API and UI features could work better in terms of speed."
 

Pricing and Cost Advice

"I use the open-source version of this product. Pricing is not relevant."
"It is a reasonably priced solution. I would rate it from five out of ten."
"On a scale of one to ten, where one is cheap and ten is expensive, I rate the product's pricing a six. So it's fairly priced."
"There are two versions available, one of which is the Pro version, and the other is the free version."
"The pricing structure involves a one-time purchase cost of approximately twenty thousand dollars or euros for all customers."
"I have used the free version of Rapid7 Metasploit."
"It is expensive. Our license expired, and our company is not thinking to renew because of our budget."
"The great advantage with Rapid7 Metasploit, of course, is that it's free."
"Presently, my company uses an open-source version of the solution. The solution's pricing can be considered quite reasonable owing to the features they offer."
"Compared to Veracode, Snyk is definitely a cheaper tool."
"We do have some missing licenses issues, especially with non-SPDX compliant one, but we expect this to be fixed soon"
"I didn't think the price was that great, but it wasn't that bad, either. I'd rate their pricing as average in the market."
"I would rate the pricing of Snyk at two. I'm currently using the free version, which the company offers before buying the full version. So, the price is affordable, especially for an enterprise."
"Snyk is a premium-priced product, so it's kind of expensive. The big con that I find frustrating is when a company charges extra for single sign-on (SSO) into their SaaS app. Snyk is one of the few that I'm willing to pay that add-on charge, but generally I disqualify products that charge an extra fee to do integrated authentication to our identity provider, like Okta or some other SSO. That is a big negative. We had to pay extra for that. That little annoyance aside, it is expensive. You get a lot out of it, but you're paying for that premium."
"On a scale of one to ten, where one is cheap and ten is expensive, I rate the pricing a three. It is a cheap solution."
"The product has good pricing."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
814,649 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
18%
Financial Services Firm
10%
Manufacturing Company
10%
University
7%
Financial Services Firm
15%
Computer Software Company
15%
Manufacturing Company
9%
Insurance Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Rapid7 Metasploit?
I use Rapid7 Metasploit for payload generation and Post-Exploitation.
What needs improvement with Rapid7 Metasploit?
Rapid7 Metasploit could be made easier for new users to learn.
How does Snyk compare with SonarQube?
Snyk does a great job identifying and reducing vulnerabilities. This solution is fully automated and monitors 24/7 to find any issues reported on the internet. It will store dependencies that you a...
What do you like most about Snyk?
The most effective feature in securing project dependencies stems from its ability to highlight security vulnerabilities.
What needs improvement with Snyk?
I'm not responsible for the tool. As far as I know, there are no major concerns or features that we lack. We had some issues integrating into our pipeline, however, they were resolved.
 

Comparisons

 

Also Known As

Metasploit
No data available
 

Learn More

 

Overview

 

Sample Customers

City of Corpus Christi, Diebold, Lumenate, Nebraska Public Power District, Prairie North Regional Health, Apptio, Automation Direct, Bob's Stores, Cardinal Innovations Healthcare Solutions, Carnegie Mellon University
StartApp, Segment, Skyscanner, DigitalOcean, Comic Relief
Find out what your peers are saying about Tenable, Qualys, Wiz and others in Vulnerability Management. Updated: October 2024.
814,649 professionals have used our research since 2012.