Rapid7 InsightAppSec vs StackHawk comparison

Rapid7 and StackHawk are both solutions in the Dynamic Application Security Testing (DAST) category. Rapid7 is ranked #5 with an average rating of 7.8, while StackHawk is ranked #8 with an average rating of 8.0. Rapid7 holds a 6.2% mindshare in DAST, compared to StackHawk’s 1.2% mindshare. Additionally, 94% of Rapid7 users are willing to recommend the solution, compared to 100% of StackHawk users who would recommend it.

Rapid7 InsightAppSec

Read 20 Rapid7 InsightAppSec reviews

1,939 Views
698 Comparison Views

94% willing to recommend

StackHawk

Read 1 StackHawk review

179 Views
179 Comparison Views

100% willing to recommend

Rapid7 InsightAppSec

StackHawk

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Rapid7 InsightAppSec and StackHawk based on real PeerSpot user reviews.

Find out what your peers are saying about Veracode, Checkmarx, OpenText and others in Dynamic Application Security Testing (DAST).

To learn more, read our detailed Dynamic Application Security Testing (DAST) Report (Updated: February 2026).

Buyer's Guide

Dynamic Application Security Testing (DAST)

February 2026

Download the complete report

Helped 884,873 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Rapid7 InsightAppSec

Ranking in Dynamic Application Security Testing (DAST)

5th

Average Rating

8.2

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

AI Observability (11th)

StackHawk

Ranking in Dynamic Application Security Testing (DAST)

8th

Average Rating

8.0

Reviews Sentiment

2.2

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of March 2026, in the Dynamic Application Security Testing (DAST) category, the mindshare of Rapid7 InsightAppSec is 6.2%, up from 4.2% compared to the previous year. The mindshare of StackHawk is 1.2%, up from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Dynamic Application Security Testing (DAST) Mindshare Distribution
Product	Mindshare (%)
Rapid7 InsightAppSec	6.2%
StackHawk	1.2%
Other	92.6%

Dynamic Application Security Testing (DAST)

Featured Reviews

Shritam Bhowmick

Vulnerability Management Lead at garrett

Provides reliable applications security but needs better integration options

There are areas for improvements regarding false positives. Integration capabilities are lacking, as options for integrations with other tools such as SNOW, Jira, or other integration tools are not sufficient in Rapid7 InsightAppSec. The user interface sometimes has glitches, which may prevent appropriate results during navigation, and even when we get appropriate results, it can be impossible to export them to CSV records or download files. Regarding scalability, Rapid7 InsightAppSec is not a scalable solution for our industry due to limited integration capabilities. Rapid7 relies on another tool called InsightConnect, which requires additional investment, detracting from scalability. Another area that needs improvement is the integration of AI capabilities into the platform. Both Rapid7 InsightAppSec and InsightVM need to advance in that area. In terms of behavioral and pattern recognition, identifying complex attacks such as SQL, blind SQL, JSON, and LDAP injections often results in 94% false positives. This necessitates improvement in their behavioral-based analytics feature.

Read full review

reviewer2795271

Manager Sec Ops at a real estate/law firm with 501-1,000 employees

Automated security checks have transformed PCI compliance and provide unified vulnerability insights

I cannot think of anything I would add to StackHawk, with the possible exception of adding any additional code bases that might be out there. I am thinking about a situation where a company might be in mergers and acquisitions mode and they onboard a company that has developed an application in a code base that is not covered by StackHawk, which would introduce some inefficiency and possible compliance difficulties. It would be great if StackHawk were continuously adding more and more languages and integrations. On a scale of one to ten, I would rate StackHawk an eight, only because I wish the product was a little less expensive. It also is running into direct competition with Snyk, as they did an acquisition of another DAST company, and they should be sensitive to that and possibly offer a discount for current users because it would be under consideration to move to Snyk and reduce complexity even if it was by a little bit.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"We have seen measurable decrease in the mean time to respond to threats by 20 percent."

"It is very convenient to get reports from the tool, which offers high-level environmental statistics."

"Dynamic application security scanning provides predefined templates and supports customization. The ability to scan external and internal applications, including on-premises ones, is precious. Additionally, it is a cloud platform, so we don't need to deploy servers or resources. This makes it time-efficient and cost-effective."

"Relatively speaking, InsightAppSec is good compared to Insight VM."

"It's very easy to use and user-friendly. It does the job."

"Customers use the product for scanning purposes and do not want to be restricted with respect to the number of scans they perform."

"The solution is stable."

"The templates feature is very easy. You just choose the kind of attack you want on your web application, and you run it against that template and receive a report. It's great."

More Rapid7 InsightAppSec pros

"StackHawk has positively impacted my organization by introducing an automated process that did not exist previously, and it helped the company achieve PCI certification."

Cons

"We get a lot of false positives during the tests."

"Currently, InsightAppSec lacks similar functionality. Customers must wait for remediation during the developers' preparation of a new version."

"I would like more details of what the product can do."

"Customers sometimes experience issues with performance."

"The number of web applications we can scan is limited."

"There is room for improvement in the response time of customer service and support levels."

"In terms of behavioral and pattern recognition, identifying complex attacks such as SQL, blind SQL, JSON, and LDAP injections often results in 94% false positives."

"The interface should be a little bit easier to manage. Sometimes, the logic that they use is kind of strange. They need to work a little bit more on their interface to make it more understandable. The interface is the only problem. I'm using Rapid7, which is very intuitive. There are other applications available in the market with a better interface. They can include more techniques or options to test different types of security because the templates are limited. It would be great to see them follow the MITRE ATT&CK framework or what is there in tools like Veracode and Synopsys."

More Rapid7 InsightAppSec cons

"On a scale of one to ten, I would rate StackHawk an eight, only because I wish the product was a little less expensive."

Pricing and Cost Advice

"Rapid7 InsightAppSec is cheap."

"Its price is competitive. It is not expensive."

"The price of this product is very cheap."

"I rate Rapid7 InsightAppSec’s pricing an eight out of ten."

"They offer a good price, but I don't remember its cost. It is fair as compared to the competition. We have opted for project-based licensing, not user-based. We can add any number of users. That doesn't matter. It is worth the money."

"I'm not sure how much it costs exactly, but I know it's expensive."

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.

See recommendations

884,873 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

13%

Financial Services Firm

12%

Government

11%

Computer Software Company

10%

No data available

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	12
Midsize Enterprise	2
Large Enterprise	5

No data available

Questions from the Community

What do you like most about Rapid7 InsightAppSec?

In Rapid7 InsightAppSec, a distinctive feature is the provision of a CDM for integrating web servers and web applications. To establish the connection between these applications, you only need to p...

See all answers

What needs improvement with Rapid7 InsightAppSec?

Customers sometimes experience issues with performance. One thing that I recall is that most customers often want to have reporting as per their customized dashboard. This needs to be improved beca...

See all answers

What is your primary use case for Rapid7 InsightAppSec?

I usually recommend this solution for financial institutions. Banks and financial institutions need this solution mostly because they have to follow stringent compliance advisory requirements, so t...

See all answers

What needs improvement with StackHawk?

See all answers

What is your primary use case for StackHawk?

My main use case for StackHawk is primarily as a PCI requirement for DAST. As a quick specific example of how I use StackHawk for that PCI requirement, it is one of the controls that sits alongside...

See all answers

What advice do you have for others considering StackHawk?

StackHawk is deployed in my organization in the public cloud using the configuration on their site. I use AWS as my cloud provider. I rate this product an eight out of ten.

See all answers

Comparisons

Invicti vs Rapid7 InsightAppSec

Compared 13% of the time

Rapid7 AppSpider vs Rapid7 InsightAppSec

Compared 11% of the time

PortSwigger Burp Suite Enterprise Edition vs Rapid7 InsightAppSec

Compared 10% of the time

AppCheck vs Rapid7 InsightAppSec

Compared 9% of the time

Qualys Web Application Scanning vs Rapid7 InsightAppSec

Compared 3% of the time

More Rapid7 InsightAppSec Competitors

OpenText Dynamic Application Security Testing vs StackHawk

Compared 54% of the time

More StackHawk Competitors

Product Reports

Buyer's Guide

Rapid7 InsightAppSec

March 2026

Download Rapid7 InsightAppSec product report

Buyer's Guide

Dynamic Application Security Testing (DAST)

February 2026

Download StackHawk product report

Also Known As

InsightAppSec

No data available

Overview

Your web applications may be complex, but your application security testing tool doesn’t need to be. InsightAppSec brings Rapid7’s proven Dynamic Application Security Testing (DAST) technology to the Insight platform, combining powerful application crawling and attack capabilities, flexibility in scan scope and scheduling, and accuracy in results with a modern UI, intuitive workflows, and sensible data organization. This enables you to identify XSS, SQL injection, CSRF, and other vulnerabilities with unparalleled ease. The best part? All of these capabilities are delivered via the cloud so that you’re up and running in minutes to identify the critical security risks that exist in your applications.

Rapid7

Rolling out DevSecOps within an organization requires security tools that fit into existing engineering workflows. From scan kickoffs to findings alerts to backlog prioritization, your DAST tooling should tie in with your engineering stack. StackHawk is built for modern delivery teams and their tools.

StackHawk

Sample Customers

CenterPoint Energy, CPA Australia, Hypertherm, First American Financial Corporation, Rackspace

Information Not Available

Buyer's Guide

Dynamic Application Security Testing (DAST)

February 2026

Download Free Report

Find out what your peers are saying about Veracode, Checkmarx, OpenText and others in Dynamic Application Security Testing (DAST). Updated: February 2026.

DOWNLOAD NOW

884,873 professionals have used our research since 2012.

See our list of best Dynamic Application Security Testing (DAST) vendors.

We monitor all Dynamic Application Security Testing (DAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.