No more typing reviews! Try our Samantha, our new voice AI agent.

Barracuda Application Protection vs Invicti comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 11, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Barracuda Application Prote...
Ranking in API Security
7th
Average Rating
8.2
Reviews Sentiment
6.8
Number of Reviews
10
Ranking in other categories
No ranking in other categories
Invicti
Ranking in API Security
10th
Average Rating
8.2
Reviews Sentiment
6.8
Number of Reviews
31
Ranking in other categories
Static Application Security Testing (SAST) (11th), Container Security (25th), Software Composition Analysis (SCA) (10th), Dynamic Application Security Testing (DAST) (4th), Application Security Posture Management (ASPM) (9th)
 

Mindshare comparison

As of August 2026, in the API Security category, the mindshare of Barracuda Application Protection is 2.1%, up from 0.3% compared to the previous year. The mindshare of Invicti is 4.0%, up from 2.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
API Security Mindshare Distribution
ProductMindshare (%)
Barracuda Application Protection2.1%
Invicti4.0%
Other93.9%
API Security
 

Featured Reviews

Salbu Kumar - PeerSpot reviewer
Manager at Cyvogenix
Application protection has strengthened web security and reduces manual effort for critical services
One area where Barracuda Application Protection could be improved is reporting customization. The dashboards are useful, but more flexible executive-level and technical reporting options would help different teams. Another area is policy tuning for complex applications. While the platform is strong overall, some advanced environments need extra fine-tuning to reduce false positives or adapt custom rules. Deeper integrations with third-party CM and DevSecOps workflows would streamline operations further. Overall, it is a solid platform, but more customization and smoother advanced tuning would make it even better. A simpler onboarding experience for new administrators would be beneficial. The platform has many strong features, but teams without deep WAF experience may need time to become fully comfortable with advanced settings. More AI-driven recommendations for rule tuning, anomaly prioritization, and false positive reduction would help smaller teams operate more efficiently. Another area is pricing flexibility for growing organizations or mid-sized businesses. Overall, the product is strong, but easier management and smarter automation would make it even more attractive.
Valavan Sivgalingam - PeerSpot reviewer
Senior Manager, Security Engineering at ESS
Dynamic testing regularly identifies web vulnerabilities and has strong false positive confirmations
It has good false positive confirmations, confirmed issues identification, and proof of exploit-related features as part of it. We use Invicti for these things in our portfolios. The solution includes Proof-Based Scanning technology. Invicti is part of our SSDLC portfolio, and DAST dynamic testing is very important for our web applications and portfolios. For both the API endpoints and web applications, we do regular testing on a monthly basis for all our releases. Invicti does a good job. The only concern is on the performance side, but other than that, we find it really helpful in identifying web vulnerabilities. A full scan takes more time based on your website and other factors, but for us, it takes more than two to three days. The scan performance can be improved upon. When we check with them, they discuss proof-based scanning and related aspects. However, there could be intermittent results that could help us.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Barracuda Application Protection has significantly improved security posture, reducing the attack surface using WAF plus API protection, automating threats with machine learning-based bot protections, providing zero-trust access to applications, and helping detect and mitigate threats in real-time, resulting in a 50 to 60% reduction in security incidents after deployment."
"Barracuda Application Protection has positively impacted my organization as it is used for multiple clients, and I am also backing up the Exchange servers, which frequently experience attacks in customer environments, allowing for quick restoration, even from yesterday or the day before yesterday."
"Barracuda Application Protection had a positive impact mainly in terms of improved visibility and better handling of automated attack traffic."
"Within the first six months of deployment, we have seen a 60% reduction in security incidents affecting the web application, which directly translated into fewer service interruptions and less time spent on incident response."
"Barracuda Application Protection has positively impacted my organization by managing traffic well, enhancing access security, operational efficiency, and user experience, leading to customer satisfaction."
"Barracuda Application Protection has positively impacted my organization significantly, as it has improved our security by reducing the risk of attacks such as SQL injections and cross-site scripting while enhancing visibility into security events through monitoring and reporting."
"Barracuda Application Protection has positively impacted my organization by reducing the noise, saving our websites and applications because it sits in front of them, which has been very beneficial, as I measured that impact by noticing fewer incidents, fewer downtimes, and better SLAs."
"Barracuda Application Protection has been a solid and dependable solution for protecting public-facing applications."
"Invicti is a good product, and its API testing is also good."
"I would definitely recommend it to those who really want to know in-depth details of their applications/products regarding security."
"NetSparker is a very easy to use and understand product."
"High level of accuracy and quick scanning."
"Technical support is very professional, 10/10."
"When we try to manually exploit the vulnerabilities, it often takes time to realize what's going on and what needs to be done."
"It correctly parses DOM and JS and has really good support for URL Rewrite rules, which is important for today's websites."
"Invicti has done a commendable job with respect to ROI, and with respect to being a cost-effective solution and one of the market leaders as an effective solution for SAST and DAST, Invicti has performed very well."
 

Cons

"Barracuda Application Protection can be improved as it still has a lot of false positives in learning mode and complex tuning is needed sometimes."
"One area where Barracuda Application Protection can improve is in policy tuning and ease of configuration, especially for complex application and API-heavy environments."
"The reporting functionality is quite poor in its current state."
"Additionally, I can say that deeper API security features such as automation, API discovery, scheme validations, and improved protections for modern environments are needed."
"The interface of Barracuda Application Protection is generally intuitive but can become complex for advanced configurations."
"Another area is pricing flexibility for growing organizations or mid-sized businesses."
"I do not have much to say about the improvement, but a more innovative solution for sniffing more on the network would be great, and having the advanced ability to close off ports when they could be getting tested from hackers for intrusion would be helpful."
"Improving the operating system structure, firmware, and overall performance would enhance loading times for devices."
"Netsparker is one of the costliest products in the market. The licensing is tied to the URL, and it's restricted."
"Sometimes, it is slow; when we are running this application and browsing other applications concurrently, it makes other applications work slow."
"Invicti's reporting capabilities need enhancement. We need enterprise-level information instead of repo-level details. Unlike Appiro, Invicti does not provide portfolio-level insights into vulnerability remediation over time."
"Netsparker doesn't provide the source code of the static application security testing."
"Maybe the ability to make a good reporting format is needed."
"The scanning time, complexity, and authentication features of Invicti could be improved."
"Invicti takes too long with big applications, and there are issues with the login portal."
"Speed: It spends about one hour on scanning; I would like it to be less than 30 minutes."
 

Pricing and Cost Advice

Information not available
"We never had any issues with the licensing; the price was within our assigned limits."
"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."
"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."
"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."
"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."
"It is competitive in the security market."
"The price should be 20% lower"
"OWASP Zap is free and it has live updates, so that's a big plus."
report
Use our free recommendation engine to learn which API Security solutions are best for your needs.
908,800 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
27%
Manufacturing Company
12%
Transportation Company
12%
Outsourcing Company
9%
Financial Services Firm
14%
Manufacturing Company
9%
Construction Company
8%
Computer Software Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise2
Large Enterprise26
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise4
Large Enterprise13
 

Questions from the Community

What is your experience regarding pricing and costs for Barracuda Application Protection?
My overall experience with the pricing, setup cost, and licensing of Barracuda Application Protection is fairly positive, as I feel the pricing is very competitive compared to similar web applicati...
What needs improvement with Barracuda Application Protection?
Barracuda Application Protection can be improved as it still has a lot of false positives in learning mode and complex tuning is needed sometimes. Their support can be slow in critical situations. ...
What is your primary use case for Barracuda Application Protection?
My main use case for Barracuda Application Protection is that we put this in front of our web apps, normally in cloud and sometimes in on-premises to filter traffic. A quick specific example of an ...
What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?
The setup cost is pretty competitive. For example, if you want to talk about the SAST license, it comes to about $150 or sometimes less than $100, depending on the conversion or the number of licen...
What needs improvement with Invicti?
At this time, there is nothing that comes to mind. However, most of the products in the market are pretty much neck-to-neck competitors. Speaking about it, there are a couple of factors which they ...
What is your primary use case for Invicti?
I have worked on a couple of products, specifically in web application security. I have worked on Invicti, and with respect to PAM, I have worked with BeyondTrust. I have not worked specifically fo...
 

Also Known As

No data available
Netsparker
 

Overview

 

Sample Customers

Information Not Available
Samsung, The Walt Disney Company, T-Systems, ING Bank
Find out what your peers are saying about Barracuda Application Protection vs. Invicti and other solutions. Updated: June 2026.
908,800 professionals have used our research since 2012.