Checkmarx Software Composition Analysis vs Invicti comparison

Checkmarx Software Composit...

Read 31 Invicti reviews

6,949 Views
1,529 Comparison Views

96% willing to recommend

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx Software Composition Analysis and Invicti based on real PeerSpot user reviews.

Find out in this report how the two Software Composition Analysis (SCA) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Checkmarx Software Composition Analysis vs. Invicti Report (Updated: June 2026).

Checkmarx Software Composition Analysis vs. Invicti

June 2026

Download the complete report

Helped 908,800 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx Software Composit...

Ranking in Software Composition Analysis (SCA)

14th

Average Rating

9.0

Reviews Sentiment

7.6

Number of Reviews

Ranking in other categories

No ranking in other categories

Invicti

Ranking in Software Composition Analysis (SCA)

10th

Average Rating

8.2

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

Static Application Security Testing (SAST) (11th), Container Security (25th), API Security (10th), Dynamic Application Security Testing (DAST) (4th), Application Security Posture Management (ASPM) (9th)

Mindshare comparison

As of August 2026, in the Software Composition Analysis (SCA) category, the mindshare of Checkmarx Software Composition Analysis is 2.5%, down from 2.5% compared to the previous year. The mindshare of Invicti is 1.8%, up from 0.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Software Composition Analysis (SCA) Mindshare Distribution
Product	Mindshare (%)
Invicti	1.8%
Checkmarx Software Composition Analysis	2.5%
Other	95.7%

Software Composition Analysis (SCA)

Featured Reviews

Tharindu Malwenna

Senior Application Security Engineer at a newspaper with 5,001-10,000 employees

Efficient library identification and upgrade suggestions improve application security

We have many third-party libraries in our organization. I used Checkmarx Software Composition Analysis to identify all the libraries we use and determine whether they are used or unused within the application Checkmarx Software Composition Analysis provides identification of libraries and…

Read full review

Valavan Sivgalingam

Senior Manager, Security Engineering at ESS

Dynamic testing regularly identifies web vulnerabilities and has strong false positive confirmations

It has good false positive confirmations, confirmed issues identification, and proof of exploit-related features as part of it. We use Invicti for these things in our portfolios. The solution includes Proof-Based Scanning technology. Invicti is part of our SSDLC portfolio, and DAST dynamic testing is very important for our web applications and portfolios. For both the API endpoints and web applications, we do regular testing on a monthly basis for all our releases. Invicti does a good job. The only concern is on the performance side, but other than that, we find it really helpful in identifying web vulnerabilities. A full scan takes more time based on your website and other factors, but for us, it takes more than two to three days. The scan performance can be improved upon. When we check with them, they discuss proof-based scanning and related aspects. However, there could be intermittent results that could help us.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It has improved identification capabilities, scalability, and integration with AI, such as the AI-powered suggestions."

"The customer service and support were good."

"It is a stable solution...It is a scalable solution."

"The tool's visual scan analysis shows me all the libraries' vulnerabilities and license types. It helps identify the most complex issues with licenses. It provides good visibility. SCA shows me all libraries that are vulnerable and the extent of their vulnerability."

"We were able to reduce the number of vulnerable libraries by 50%, leading to significant operational improvement."

"What's most valuable in Checkmarx Software Composition Analysis is that it provides security from the start. In the traditional approach, an enterprise or company validates the solution before launching to a production environment, but in the modern approach, security must be checked and provided from the beginning and from the design, and this is where Checkmarx Software Composition Analysis comes in. The solution helps you make sure that every open-source application that you use is secure, and that there's no vulnerability inside that open-source application."

"What's most valuable in Checkmarx Software Composition Analysis is its ability to identify vulnerabilities in open-source components, especially if some critical issues exist."

"Checkmarx Software Composition Analysis is one of the most important products in the IT security market."

More Checkmarx Software Composition Analysis pros

"I would rate the stability as ten out of ten."

"Invicti's best feature is the ability to identify vulnerabilities and manually verify them."

"High level of accuracy and quick scanning."

"Netsparker has done an awesome job with its crawler, as it has found all of the links (also thanks to its good DOM parser)."

"The dashboard is really cool, and the features are really good. It tells you about the software version you're using in your web application. It gives you the entire technology stack, and that really helps. Both web and desktop apps are good in terms of application scanning. It has a lot of security checks that are easily customizable as per your requirements. It also has good customer support."

"I'd recommend Netsparker for anyone who wants to make a security assessment for web applications."

"Netsparker provides a more interactive interface that is more appealing."

"It correctly parses DOM and JS and has really good support for URL Rewrite rules, which is important for today's websites."

More Invicti pros

Cons

"Instant updates for end users to identify vulnerabilities as soon as possible will make Checkmarx Software Composition Analysis better. The UI of the solution could also be improved."

"The quality of technical support has decreased over time, and it is not as good as it used to be."

"I would rate the scalability a seven out of ten."

"The solution could improve by determining the success factor of an upgrade, which is currently lacking."

"Its pricing can be improved. It is a little bit high priced. It would be better if it was a little less expensive. It is a good tool, and we're still figuring out how to fully leverage it. There are some questions regarding whether it can scan the MuleSoft code. We don't know if this is a gap in the tool or something else. This is one thing that we're just working through right now, and I am not ready to conclude that there is a weakness there. MuleSoft is kind of its own beast, and we're trying to see how we get it to work with Checkmarx."

"In terms of time and quality of support, Checkmarx SCA needs improvement."

"Personally, I currently use it as a standalone tool without integrating it with other systems, and it meets my needs adequately. As a suggestion, I request on considering to add a "what if" feature to the application. Currently, when the tool identifies issues and suggests updates, if I want to explore different scenarios, I need to prepare another file, turn it into a ZIP, and run the analysis again. It would be more convenient if there was a "what if" option in the GUI. This feature could simulate a run, allowing me to quickly check the impact of changing one or more files or versions without the need for a full rerun."

"In terms of areas for improvement, what could be improved in Checkmarx Software Composition Analysis is pricing because customers always compare the pricing among secure DevOps solutions in the market. Checkmarx Software Composition Analysis has a lot of competitors yet its features aren't much different. Pricing is the first thing customers consider, and from a partner perspective, if you can offer affordable pricing to your customers, it's more likely you'll have a winning deal. The performance of Checkmarx Software Composition Analysis also needs improvement because sometimes, it's slow, and in particular, scanning could take several hours."

More Checkmarx Software Composition Analysis cons

"Invicti's reporting capabilities need enhancement. We need enterprise-level information instead of repo-level details. Unlike Appiro, Invicti does not provide portfolio-level insights into vulnerability remediation over time."

"Maybe the ability to make a good reporting format is needed."

"Invicti's reporting capabilities need enhancement."

"The solution's false positive analysis and vulnerability analysis libraries could be improved."

"The licensing model should be improved to be more cost-effective. There are URL restrictions that consume our license. Compared to other DAST solutions and task tools like WebInspect and Burp Enterprise, Invicti is very expensive. The solution’s scanning time is also very long compared to other DAST tools. It might be due to proof-based scanning."

"They need to improve their support in the documentation. Their support mechanism is missing. Their responsiveness, technical staff, and these types of things need to be improved, and comprehensive documentation is required. They should have good self-service portal enhancement"

"Invicti takes too long with big applications, and there are issues with the login portal."

"It would be better for listing and attacking Java-based web applications to exploit vulnerabilities."

More Invicti cons

Pricing and Cost Advice

"My customers need to pay for the licensing part, and they need to opt for an annual subscription."

"We don't have a license. The usage is limited to one, two, three, five, or ten people. It is currently used for all projects, and there are plans to increase its usage."

"The license model is somewhat perplexing as it comprises multiple aspects that can be confusing for customers. The model is determined by the number of registered users and the number of projects being scanned, along with a third component that adds to the complexity."

"Pricing for Checkmarx Software Composition Analysis needs to be competitive."

"It is a little bit high priced. It would be better if it was a little less expensive."

"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."

"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."

"OWASP Zap is free and it has live updates, so that's a big plus."

"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."

"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."

"We never had any issues with the licensing; the price was within our assigned limits."

"It is competitive in the security market."

"The price should be 20% lower"

More Invicti pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

908,800 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

20%

Construction Company

Manufacturing Company

Insurance Company

Financial Services Firm

14%

Manufacturing Company

Construction Company

Computer Software Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	7
Large Enterprise	8

By reviewers
Company Size	Count
Small Business	14
Midsize Enterprise	4
Large Enterprise	13

Questions from the Community

What is your experience regarding pricing and costs for Checkmarx Software Composition Analysis?

Pricing is complex and high for small organizations but offers great benefits for larger organizations. It is notably different compared to competitors like GitHub Advanced Security.

What needs improvement with Checkmarx Software Composition Analysis?

The solution could improve by determining the success factor of an upgrade, which is currently lacking.

What is your primary use case for Checkmarx Software Composition Analysis?

What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?

The setup cost is pretty competitive. For example, if you want to talk about the SAST license, it comes to about $150 or sometimes less than $100, depending on the conversion or the number of licen...

What needs improvement with Invicti?

At this time, there is nothing that comes to mind. However, most of the products in the market are pretty much neck-to-neck competitors. Speaking about it, there are a couple of factors which they ...

What is your primary use case for Invicti?

I have worked on a couple of products, specifically in web application security. I have worked on Invicti, and with respect to PAM, I have worked with BeyondTrust. I have not worked specifically fo...

Black Duck SCA vs Checkmarx Software Composition Analysis

Comparisons

Compared 25% of the time

JFrog Xray vs Checkmarx Software Composition Analysis

Compared 13% of the time

CAST SBOM Manager vs Checkmarx Software Composition Analysis

Compared 12% of the time

Veracode vs Checkmarx Software Composition Analysis

Compared 10% of the time

Kodem's Dynamic SCA vs Checkmarx Software Composition Analysis

Compared 2% of the time

More Checkmarx Software Composition Analysis Competitors

Veracode vs Invicti

Compared 8% of the time

Acunetix vs Invicti

Compared 6% of the time

OpenText Dynamic Application Security Testing vs Invicti

Compared 5% of the time

Snyk vs Invicti

Compared 5% of the time

Checkmarx One vs Invicti

Compared 5% of the time

More Invicti Competitors

Product Reports

Checkmarx Software Composition Analysis

August 2026

Checkmarx Software Composition Analysis report

Download Checkmarx Software Composition Analysis product report

Download Invicti product report

July 2026

Also Known As

CxSCA

Netsparker

Overview

Checkmarx Software Composition Analysis offers robust features for identifying vulnerabilities in open source components. It integrates seamlessly into development processes, ensuring security from the start with its user-friendly interface and AI-enhanced suggestions. Ideal for .NET and Java applications.

Checkmarx Software Composition Analysis is an essential tool for developers looking to manage and secure open-source components. Known for its ease of integration and user-friendly design, it excels in providing comprehensive security by detecting vulnerabilities and offering actionable solutions. Developers gain from its configurability and visibility into library vulnerabilities. It further supports development with version upgrade suggestions and detailed insights, ensuring secure open-source component integration. Enhancing its effectiveness, AI-powered suggestions minimize false positives and improve scalability. While optimization of speed, performance, and pricing are anticipated, its strong integration capabilities within CI/CD pipelines make it a preferred choice for secure software development.

What are the key features of Checkmarx Software Composition Analysis?

User-Friendly Interface: Simplifies navigation and enhances usability for developers.
Incremental Scan Capability: Allows efficient continuous security assessments.
Vulnerability Detection: Provides detailed insights and solutions for identified issues.
AI-powered Suggestions: Minimizes false positives and enhances efficiency.
License Management: Assists in handling and managing license issues effectively.

What benefits can users expect from Checkmarx Software Composition Analysis?

Enhanced Security: Maintains robust protection against vulnerabilities in open source components.
Compliance Assurance: Ensures adherence to industry standards and regulations.
Visibility and Insight: Offers detailed insights into potential risks within libraries.
Scalability: Supports large-scale integration without compromising on performance.

In industries like banking and insurance, Checkmarx Software Composition Analysis proves instrumental. Utilizing static code analysis, it assists these sectors by identifying security weaknesses in software. Its integration capability with CI/CD pipelines ensures that applications adhere to strict industry compliance and security standards.

Checkmarx

Invicti offers advanced web application security testing focused on identifying vulnerabilities like SQL injection and cross-site scripting. Its Proof-Based Scanning minimizes false positives and integrates seamlessly with CI/CD pipelines, making it an effective tool for enterprise environments.

Invicti provides comprehensive scanning capabilities that include detecting and verifying critical vulnerabilities and security data consolidation. Its scalable scanning engine and robust API support allow for flexible testing across diverse environments, including web and API testing. Despite some drawbacks like limited single sign-on integration and slow scanning speeds for large applications, Invicti remains a popular choice for automating security assessments, ensuring compliance with standards like OWASP Top 10, PCI DSS, and GDPR.

What are the key features of Invicti?

Comprehensive Vulnerability Scanning: Detects vulnerabilities like SQL injection and XSS.
Proof-Based Scanning: Confirms exploitability and reduces false positives.
CI/CD Integration: Seamlessly integrates with development pipelines.
Security Data Consolidation: Centralizes data for better insights.
User-Friendly Interface: Facilitates easy analysis and reporting.
Scalable Scanning Engine: Supports testing in enterprise environments.
Robust API Support: Enhances flexibility in testing.

What benefits and ROI should users look for in reviews?

Proactive Security: Actively identifies and verifies vulnerabilities to prevent breaches.
Regulatory Compliance: Helps maintain compliance with standards like PCI DSS and GDPR.
Efficient Vulnerability Management: Aids in prioritizing remediation efforts.
Integration Capabilities: Streamlines processes with CI/CD pipeline compatibility.

In industries like finance, healthcare, and e-commerce, Invicti is implemented to bolster security through automated vulnerability assessments. Its ability to provide insightful reports and remediation suggestions assists companies in efficiently managing security risks and achieving compliance with critical regulatory standards.

Sample Customers

AXA, Liveperson, Aaron's, Playtech, Morningstar

Samsung, The Walt Disney Company, T-Systems, ING Bank