No more typing reviews! Try our Samantha, our new voice AI agent.

OpenText Dynamic Application Security Testing vs StackHawk comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 29, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

OpenText Dynamic Applicatio...
Ranking in Dynamic Application Security Testing (DAST)
3rd
Average Rating
7.2
Reviews Sentiment
6.1
Number of Reviews
22
Ranking in other categories
DevSecOps (8th)
StackHawk
Ranking in Dynamic Application Security Testing (DAST)
10th
Average Rating
7.6
Reviews Sentiment
4.6
Number of Reviews
2
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of June 2026, in the Dynamic Application Security Testing (DAST) category, the mindshare of OpenText Dynamic Application Security Testing is 11.6%, up from 10.2% compared to the previous year. The mindshare of StackHawk is 1.7%, up from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Dynamic Application Security Testing (DAST) Mindshare Distribution
ProductMindshare (%)
OpenText Dynamic Application Security Testing11.6%
StackHawk1.7%
Other86.7%
Dynamic Application Security Testing (DAST)
 

Featured Reviews

AP
Cyber Security Consultant at a tech vendor with 10,001+ employees
Enhancements in manual testing align with reporting and integration features
WebInspect works efficiently with Java-based or .NET based applications. However, it struggles with Salesforce applications, where it requires approximately 20-24 hours to crawl and audit but produces minimal findings, necessitating manual verification. The solution offers customization features for crawling and vulnerability detection. It includes various security frameworks and allows selection of specific vulnerability types to audit, such as OWASP Top 10 or JavaScript-based vulnerabilities. When working with APIs, we can select OWASP API Top 10. The tool also supports custom audit features by combining different security frameworks. For on-premises deployment, the setup is complex, particularly regarding SQL server configuration. Unlike Burp Suite or OpenText Dynamic Application Security Testing, which have simpler setup processes, WebInspect requires SQL server setup to function.
Ney Roman - PeerSpot reviewer
DevOps Engineer at Deuna
Vulnerability visibility has improved across microservices but integration still needs refinement
StackHawk can be improved in the way that it is integrated, as at the very beginning, the idea was to, within the pipeline, mount the different resources that our microservices needed to start to run. For example, if we have a service that needed Redis, maybe Kafka, or a database to initialize, we did need to have a Docker Compose file, get up those services, and after that, do the analysis. It didn't have that; it wasn't reachable at the very beginning and it wasn't that good as we expected. But at some point, we decided to mount it as an agent in the Docker file, and it was waiting for new jobs. It was even better, and when we figured out how to integrate it within our EKS cluster, suddenly we started reaching to the services, knowing what was going on, and everything related to security. As long as we have a P2T to our QA site or cluster, we do not have garbage in our databases, but StackHawk does put a little information, a garbage information, doing their job. That's the main area I'm focusing on right now regarding needed improvements.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature is the performance."
"The solution is able to detect a wide range of vulnerabilities and is better at it than other products."
"The FPA and Audit Workbench are very helpful for me, and when we are integrating it with SSC, we're able to scan and trace and see all of the vulnerabilities, with very detailed examples for each vulnerability, so it is very good for users and beginners and doesn't take a lot of time to understand the tool."
"It is scalable and very easy to use."
"The most valuable feature of this solution is the ability to make our customers more secure."
"The user interface is ok and it is very simple to use."
"The transaction recorder within WebInspect is easy to use, which is valuable for our team."
"My experience with technical support has been good."
"StackHawk has positively impacted my organization by introducing an automated process that did not exist previously, and it helped the company achieve PCI certification."
"StackHawk has positively impacted my organization by giving us a new vision of how vulnerabilities were seen, as we now have more visibility in that matter."
 

Cons

"The solution is on the expensive side. It's something that clients comment on."
"I want to enhance automation. Currently, Fortify WebInspect can scan and find vulnerabilities, but users with specific skills need to interpret the results and understand how to address them."
"A localized version, for example, in Korean would be a big improvement to this solution."
"The scanner could be better."
"Fortify WebInspect's shortcoming stems from the fact that it is a very expensive product in Korea, which makes it difficult for its potential customers to introduce the product in their IT environment."
"My advice to others using Fortify WebInspect is not to use it, there are better solutions in the market."
"It requires improvement in terms of scanning. The application scan heavily utilizes the resources of an on-premise server. 32 GB RAM is very high for an enterprise web application."
"Not sufficiently compatible with some of our systems."
"On a scale of one to ten, I would rate StackHawk an eight, only because I wish the product was a little less expensive."
"StackHawk can be improved in the way that it is integrated, as at the very beginning, the idea was to, within the pipeline, mount the different resources that our microservices needed to start to run."
 

Pricing and Cost Advice

"Its price is almost similar to the price of AppScan. Both of them are very costly. Its price could be reduced because it can be very costly for unlimited IT scans, etc. I'm not sure, but it can go up to $40,000 to $50,000 or more than that."
"The price is okay."
"This solution is very expensive."
"Our licensing is such that you can only run one scan at a time, which is inconvenient."
"The pricing is not clear and while it is not high, it is difficult to understand."
"It’s a fair price for the solution."
"Fortify WebInspect is a very expensive product."
Information not available
report
Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.
900,644 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Government
12%
Manufacturing Company
7%
Computer Software Company
7%
No data available
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise1
Large Enterprise15
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Fortify WebInspect?
While I am not directly involved with licensing, I can share that our project's license for 1-9 applications costs between $15,000 to $19,000. In comparison, Burp Suite costs approximately $500 to ...
What needs improvement with Fortify WebInspect?
WebInspect works efficiently with Java-based or .NET based applications. However, it struggles with Salesforce applications, where it requires approximately 20-24 hours to crawl and audit but produ...
What is your primary use case for Fortify WebInspect?
I am currently working with several tools. For Fortify, I use SCA and WebInspect. Apart from that, I use Burp Suite from PortSwigger. For API testing, I use Postman with Burp Suite or WebInspect fo...
What needs improvement with StackHawk?
I cannot think of anything I would add to StackHawk, with the possible exception of adding any additional code bases that might be out there. I am thinking about a situation where a company might b...
What is your primary use case for StackHawk?
My main use case for StackHawk is primarily as a PCI requirement for DAST. As a quick specific example of how I use StackHawk for that PCI requirement, it is one of the controls that sits alongside...
What advice do you have for others considering StackHawk?
StackHawk is deployed in my organization in the public cloud using the configuration on their site. I use AWS as my cloud provider. I rate this product an eight out of ten.
 

Also Known As

Micro Focus WebInspect, WebInspect
No data available
 

Overview

 

Sample Customers

Aaron's
Information Not Available
Find out what your peers are saying about Veracode, Checkmarx, OpenText and others in Dynamic Application Security Testing (DAST). Updated: June 2026.
900,644 professionals have used our research since 2012.