No more typing reviews! Try our Samantha, our new voice AI agent.

Defensics Protocol Fuzzing vs Invicti comparison

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Defensics Protocol Fuzzing
Average Rating
8.6
Number of Reviews
4
Ranking in other categories
Fuzz Testing Tools (4th)
Invicti
Average Rating
8.2
Reviews Sentiment
6.8
Number of Reviews
31
Ranking in other categories
Static Application Security Testing (SAST) (10th), Container Security (24th), Software Composition Analysis (SCA) (8th), API Security (9th), Dynamic Application Security Testing (DAST) (4th), Application Security Posture Management (ASPM) (5th)
 

Mindshare comparison

While both are Quality Assurance solutions, they serve different purposes. Defensics Protocol Fuzzing is designed for Fuzz Testing Tools and holds a mindshare of 16.0%, down 25.3% compared to last year.
Invicti, on the other hand, focuses on Dynamic Application Security Testing (DAST), holds 8.5% mindshare, up 6.9% since last year.
Fuzz Testing Tools Mindshare Distribution
ProductMindshare (%)
Defensics Protocol Fuzzing16.0%
PortSwigger Burp Suite Professional33.6%
GitLab29.2%
Other21.200000000000003%
Fuzz Testing Tools
Dynamic Application Security Testing (DAST) Mindshare Distribution
ProductMindshare (%)
Invicti8.5%
Veracode15.7%
Checkmarx One15.0%
Other60.8%
Dynamic Application Security Testing (DAST)
 

Featured Reviews

SK
Senior Technical Lead at HCL Technologies
Product security tests for switches and router sections
Codenomicon Defensics should be more advanced for the testing sector. It should be somewhat easy and flexible to install. What I see in the documentation isn't that. Even if something doesn't malfunction, sometimes it is hard to install and execute. The product needs video documentation. This would help a lot more.
Valavan Sivgalingam - PeerSpot reviewer
Senior Manager, Security Engineering at ESS
Dynamic testing regularly identifies web vulnerabilities and has strong false positive confirmations
It has good false positive confirmations, confirmed issues identification, and proof of exploit-related features as part of it. We use Invicti for these things in our portfolios. The solution includes Proof-Based Scanning technology. Invicti is part of our SSDLC portfolio, and DAST dynamic testing is very important for our web applications and portfolios. For both the API endpoints and web applications, we do regular testing on a monthly basis for all our releases. Invicti does a good job. The only concern is on the performance side, but other than that, we find it really helpful in identifying web vulnerabilities. A full scan takes more time based on your website and other factors, but for us, it takes more than two to three days. The scan performance can be improved upon. When we check with them, they discuss proof-based scanning and related aspects. However, there could be intermittent results that could help us.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Whatever the test suit they give, it is intelligent. It will understand the protocol and it will generate the test cases based on the protocol: protocol, message sequence, protocol, message structure... Because of that, we can eliminate a lot of unwanted test cases, so we can execute the tests and complete them very quickly."
"Simple and straightforward GUI."
"The stability of this product is great; we tested it under multiple constraints and even on cloud services it is absolutely stable."
"We have found multiple issues in our embedded system network protocols, related to buffer overflow. We have reduced some of these issues."
"The product is related to US usage with TLS contact fees, i.e. how more data center connections will help lower networking costs."
"ROI was 100%. Since there are no product suites available that provide the level of testing available with Codenomicon, the development, quality and security assurance departments know that the investment was correct."
"Whatever the test suit they give, it is intelligent; it will understand the protocol and it will generate the test cases based on the protocol: protocol, message sequence, protocol, message structure, and because of that, we can eliminate a lot of unwanted test cases so we can execute the tests and complete them very quickly."
"I am impressed by the whole technology that they are using in this solution. It is really fast. When using netscan, the confirmation that it gives on the vulnerabilities is pretty cool. It is really easy to configure a scan in Netsparker Web Application Security Scanner. It is also really easy to deploy."
"One of the features I like about this program is the low number of false positives and the support it offers."
"OWASP Zap is free and it has live updates, so that's a big plus."
"The platform is stable."
"We use simultaneous products, but I found this to be the best of the lot."
"When we try to manually exploit the vulnerabilities, it often takes time to realize what's going on and what needs to be done."
"Netsparker has done an awesome job with its crawler, as it has found all of the links (also thanks to its good DOM parser)."
"The most valuable feature of Invicti is getting baseline scanning and incremental scan."
 

Cons

"Sometimes, when we are testing embedded devices, when we trigger the test cases, the target will crash immediately. It is very difficult for us to identify the root cause of the crash because they do not provide sophisticated tools on the target side. They cover only the client-side application... They do not have diagnostic tools for the target side. Rather, they have them but they are very minimal and not very helpful."
"Sometimes, when we are testing embedded devices, when we trigger the test cases, the target will crash immediately. It is very difficult for us to identify the root cause of the crash because they do not provide sophisticated tools on the target side."
"It requires understanding the Defensics protocol."
"Codenomicon Defensics should be more advanced for the testing sector. It should be somewhat easy and flexible to install."
"Codenomicon Defensics should be more advanced for the testing sector. It should be somewhat easy and flexible to install."
"You can't implement proprietary ciphering algorithms, nor can you modify protocol models if you need to test customized public protocols."
"It does not support the complete protocol stack. There are some IoT protocols that are not supported and new protocols that are not supported."
"The scanner itself should be improved because it is a little bit slow."
"The custom attack preparation screen might be improved."
"The proxy review, the use report views, the current use tool and the subset requests need some improvement. It was hard to understand how to use them."
"Sometimes, it is slow; when we are running this application and browsing other applications concurrently, it makes other applications work slow."
"Perhaps the custom attack preparation screen might be improved."
"The license could be better. It would help if they could allow us to scan multiple URLs on the same license. It's a major hindrance that we are facing while scanning applications, and we have to be sure that the URLs are the same and not different so that we do not end up consuming another license for it. Netsparker is one of the costliest products in the market. The licensing is tied to the URL, and it's restricted. If you have a URL that you scanned once, like a website, you cannot retry that same license. If you are scanning the same website but in a different domain or different URL, you might end up paying for a second license. It would also be better if they provided proper support for multi-factor authentications. In the next release, I would like them to include good multi-factor authentication support."
"They could enhance the support for data swap testing for the platform."
"Netsparker doesn't provide the source code of the static application security testing."
 

Pricing and Cost Advice

"Licensing is a bit expensive."
"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."
"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."
"The price should be 20% lower"
"OWASP Zap is free and it has live updates, so that's a big plus."
"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."
"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."
"We never had any issues with the licensing; the price was within our assigned limits."
"It is competitive in the security market."
report
Use our free recommendation engine to learn which Fuzz Testing Tools solutions are best for your needs.
893,244 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Manufacturing Company
11%
Financial Services Firm
9%
Retailer
6%
Financial Services Firm
16%
Manufacturing Company
9%
Computer Software Company
7%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business14
Midsize Enterprise4
Large Enterprise13
 

Questions from the Community

Ask a question
Earn 20 points
What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?
The setup cost is pretty competitive. For example, if you want to talk about the SAST license, it comes to about $150 or sometimes less than $100, depending on the conversion or the number of licen...
What needs improvement with Invicti?
At this time, there is nothing that comes to mind. However, most of the products in the market are pretty much neck-to-neck competitors. Speaking about it, there are a couple of factors which they ...
What is your primary use case for Invicti?
I have worked on a couple of products, specifically in web application security. I have worked on Invicti, and with respect to PAM, I have worked with BeyondTrust. I have not worked specifically fo...
 

Also Known As

Codenomicon Defensics
Netsparker
 

Overview

 

Sample Customers

Coriant, CERT-FI, Next Generation Networks
Samsung, The Walt Disney Company, T-Systems, ING Bank