No more typing reviews! Try our Samantha, our new voice AI agent.

FortiDevSec vs Invicti Web + API comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 6, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Qualys TotalCloud
Sponsored
Ranking in Vulnerability Management
10th
Average Rating
8.6
Reviews Sentiment
7.1
Number of Reviews
53
Ranking in other categories
Container Security (11th), Cloud Workload Protection Platforms (CWPP) (9th), Cloud Security Posture Management (CSPM) (8th), SaaS Security Posture Management (SSPM) (2nd), Cloud-Native Application Protection Platforms (CNAPP) (7th)
FortiDevSec
Ranking in Vulnerability Management
70th
Average Rating
9.0
Reviews Sentiment
7.5
Number of Reviews
1
Ranking in other categories
Static Application Security Testing (SAST) (46th)
Invicti Web + API
Ranking in Vulnerability Management
30th
Average Rating
7.8
Reviews Sentiment
6.7
Number of Reviews
36
Ranking in other categories
Application Security Tools (16th), Static Application Security Testing (SAST) (11th), DevSecOps (7th)
 

Featured Reviews

reviewer2859021 - PeerSpot reviewer
Sr Security Engineer at a tech vendor with 5,001-10,000 employees
Risk-based triage has transformed container security and now prioritizes high-impact threats
The best features Qualys TotalCloud offers currently include managing cloud infrastructure and container security while facing major challenges such as alert fatigue. Traditional vulnerability scanners flag hundreds of CVEs on short-lived Kubernetes containers, some of which have no internet exposure or are gone before we can even triage them. I leverage Qualys TotalCloud to move beyond static CVSS. I use it to implement runtime exposure, correlation risk reprioritization, and shift-left integration. This notifies developers to fix a base image upstream rather than patching live ephemeral instances. In my work with cloud and container security, the biggest operational hurdle was alert fatigue. I use Qualys to shift left from static CVSS severity to context-aware risk prioritization. I correlated raw vulnerability data with real-time risk factors such as public network exposure, active runtime execution, or overly permissive IAM roles. This allows us to immediately drop the priority of isolated containers and escalate lower-severity CVEs that sit on an exposed, high-risk path. We can map these findings directly back to our CI/CD pipelines so developers can patch the root base images upstream. We have drastically cut down the signal-to-noise ratio, saved a lot of manual hours doing triage work, and ensured engineering effort goes directly towards high-impact risk reduction.
MohammedJaffir - PeerSpot reviewer
Founder at Cipheroot Cybersecurity Solutions
Scans codes in CI/CD pipelines and identifies vulnerabilities
In a customer environment, developers integrate their code with CI/CD pipelines. Most developers use cloud platforms like AWS or Azure and project management tools. FortiDevSec integrates with these CI/CD pipelines using agents such as YAML files. Once integrated, FortiDevSec scans the source code using our product or within the IDE. The most valuable feature is the ability to identify known vulnerabilities in applications by generating reports easily. This development gamification is very useful for developers. Compared to TechSmart and Fortify, FortiDevSec has similar features, but it is much easier to use because of its simple setup. SysTrack, for example, is not very simple. For the CI/CD pipeline, we only need to integrate a YAML file into the security process. Compared to other products, the tool requires fewer steps. We must integrate one file with the CI/CD pipeline, automatically pulling the code report to the repository. Using our API and username, it is easy to scan the environment. The tool's integration is also easy.
Rahul Kumar - PeerSpot reviewer
Senior Engineer - Penetration Tester at a government with 10,001+ employees
Identifies vulnerabilities across bulk web applications but needs better support and cleaner reports
The best feature Acunetix offers is the centralized dashboard and the quality of reports it generates, which includes various options for selecting reports and developer options for directly sharing the reports with developers. The centralized dashboard of Acunetix gives visibility into the security aspects of mass applications; for instance, with more than 200 applications, it provides a valuable overview of findings and necessary fixes, along with a high-level summary that helps us achieve compliance through monthly and sometimes weekly scanning. In terms of reporting, Acunetix is excellent because it can generate different types of reports, such as an executive summary report, detailed reports, and developer reports that can be shared directly with developers. Acunetix positively impacts my organization by helping identify outdated libraries and applications, including legacy applications vulnerable to old attacks based on OWASP Top 10, thus aiding in compliance checks for PCI DSS and OWASP. Acunetix provides a centralized report with compliance-related aspects and a vulnerability timeline, effectively helping reduce vulnerabilities and save time.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Qualys TotalCloud has significantly reduced our workload in terms of managing risks, helping us to be more efficient and save substantial resources."
"Generally, Qualys is very good at detections, whether on cloud or on-prem, and the agent allows deployment on both infrastructures, providing continuous monitoring of your assets, which is a key selling point for us."
"Qualys TotalCloud's most valuable feature is its agent versatility."
"TotalCloud's best feature is the integration of cloud accounts. It helps with the risk and security posture management of our cloud infrastructure."
"Qualys TotalCloud's most valuable features are its cloud security posture management, Kubernetes, and container security capabilities."
"If I had to say something positive about the product that brings me the biggest benefit, I would say it has accurate reports, gets new update CVEs, zero-day attack detection, and is easy to manage with its GUI."
"The most valuable feature is extensibility."
"Qualys TotalCloud has positively impacted my organization by providing visibility into the environment."
"In a customer environment, developers integrate their code with CI/CD pipelines. Most developers use cloud platforms like AWS or Azure and project management tools. FortiDevSec integrates with these CI/CD pipelines using agents such as YAML files. Once integrated, FortiDevSec scans the source code using our product or within the IDE."
"The most valuable feature of the solution is the speed at which it can scan multiple domains in just a few hours."
"The solution is paying for itself, as our applications are more secure."
"If an organization has 100 plus applications and wants to use an automated scanner, they should definitely go ahead with Acunetix because it is very cost-effective and will save time compared to focusing on other solutions and performing manual security assessments."
"By integrating with CI/CD tools, it enables a shift-left approach in the development process."
"It has been able to find some vulnerabilities, and we've been able to remediate our websites and vulnerabilities, thanks to Acunetix."
"Our developers can run the attacks directly from their environments, desktops."
"The solution is excellent at detecting SQL injection and cross-site scripting vulnerabilities."
"Acunetix helps reduce the man-days and effort needed for scanning bulk applications through automated assessments, allowing good dashboard visualization that can be reported easily to management, providing complete visibility on vulnerability metrics."
 

Cons

"Enhancing clarity regarding its compliance capabilities would be beneficial, as the current scope is limited in geographic coverage."
"The improvement needed in Qualys TotalCloud is mainly in the artificial intelligence automation agents, where we can customize and create what meets our needs, not necessarily having to use those provided in the tool."
"I didn't give it a ten because I would like to see simpler configuration, more customizable dashboards, and better automation and integration options."
"It is already perfect, but they can bring some newer dashboards and customization options for the dashboard. It would be great to be able to include on-prem assets on the dashboard."
"There should be improvement from a dashboard perspective when collecting and showcasing data to lead management."
"A feature improvement could be the inclusion of Windows OS support for container security, as it is currently only supported for Linux."
"Qualys TotalCloud needs to enhance its scanning capabilities in the IP domain, as it currently lacks the functionality to resolve IPs to their corresponding domain names."
"One of the things that could be improved is the alerts. Qualys is a fantastic tool, especially with the TruRisk feature, but one challenge that most leaders face involves alert fatigue."
"The only drawback I see with FortiDevSec is the lack of extensions."
"The costs for the licensing have changed and it's not in our favor which is why we're now looking at other options."
"It should be easier to recreate something manually, with the manual tool, because Acunetix is an automatic tool. If it finds something, it should be easier to manually replicate it. Sometimes you don't get the raw data from the input and output, so that could be improved."
"It is difficult to create a proxy connection."
"I rate its stability six out of ten."
"The solution can be improved by adding the ability to scan subdomains automatically, and by providing reports that can be exported to external databases to share with other solutions."
"Acunetix needs to be dynamic with JavaScript code, unlike Netsparker which can scan complex agents."
"There are quite a few false positives that come out. It's mostly based upon finding XSS vulnerabilities, even though we know that XSS vulnerabilities do not exist within some of the web applications because of some frameworks we're using."
"We want to see how much bandwidth usage it consumes. When we monitor traffic we have issues with the consumption and throttling of the traffic."
 

Pricing and Cost Advice

"I am not sure about the pricing. From what I understand, it is a bit on the higher side, but I do not have the exact numbers."
"The pricing is comparable. It is built into our other product, so I cannot piecemeal it. It is a part of our subscription."
"While Qualys TotalCloud's pricing is currently acceptable, it is becoming increasingly expensive and may soon be considered overpriced."
"Although Qualys TotalCloud is relatively expensive due to its unique automation features, its cost-effectiveness is rated an eight out of ten, with ten being the most costly."
"Its price seems higher compared to other tools, but it is worth it. If they could adjust the pricing and make it comparable with other tools, that would be great."
"Qualys TotalCloud offers cost-effective licensing flexibility."
"As a middle management member, I do not have direct pricing knowledge, but based on the knowledge from our meetings, its pricing is competitive."
"It isn't cheap, but it's reasonable. It helps us to manage things with very few resources."
Information not available
"When we looked at all other vendors and what they were asking for, to provide a third of what Acunetix was capable of doing, it was an easy decision... But now that it's coming to a cost where it's line with market value, it becomes more of a competition... Acunetix is raising the cost of licensing. It's 3.5 times what we were initially quoted."
"The pricing and licensing are reasonable to a point. In order to run multiple scans at a time, we are going to have to purchase a 100 count license, which is an overkill. Though, compared to what we were paying for, the cost seems reasonable."
"When compared with other products, the pricing is a little bit high. But it gives value for the price. It serves the purpose and is worthwhile for the price we pay."
"Implementing Acunetix needs a medium or larger business agency, because you need some money to get Acunetix. It is costly, but if you care about your agency's security, then maybe it's a cost that might help you in the future."
"The price is exceptionally high."
"Acunetix was around the same price as all the other vendors we looked at, nothing special."
"The cost is based on two types of licenses, ConsultLite, and ConsultPlus, as well as the number of domains that are scanned."
"I would say that Acunetix is expensive because there are products on the market with similar features that are equally or better-priced."
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
917,433 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
18%
Outsourcing Company
12%
Manufacturing Company
11%
Financial Services Firm
10%
Construction Company
23%
Comms Service Provider
12%
Manufacturing Company
8%
Outsourcing Company
8%
Manufacturing Company
12%
Financial Services Firm
11%
Comms Service Provider
11%
Computer Software Company
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise10
Large Enterprise38
No data available
By reviewers
Company SizeCount
Small Business18
Midsize Enterprise7
Large Enterprise19
 

Questions from the Community

What is your experience regarding pricing and costs for Qualys TotalCloud?
I was not involved in pricing, setup cost, and licensing, but I can say that the setup was fast, within a quarter, an...
What needs improvement with Qualys TotalCloud?
In terms of improvements, the features we are using in Qualys TotalCloud are working in the best optimal way, and I d...
What is your primary use case for Qualys TotalCloud?
I have been using Qualys TotalCloud for the last eight months to scan the hardware and the virtual devices in our inf...
Ask a question
Earn 20 points
What is your primary use case for Acunetix Vulnerability Scanner?
In a typical enterprise environment, Acunetix is mainly used for visibility, detection, and investigation across netw...
What advice do you have for others considering Acunetix Vulnerability Scanner?
I advise that Acunetix is the best option. Invest time in proper initial configuration and scope definitions. The too...
What is your experience regarding pricing and costs for Acunetix?
Everything is perfect and good, including the pricing and all related aspects.
 

Also Known As

Qualys TotalCloud with FlexScan
No data available
AcuSensor
 

Overview

 

Sample Customers

Information Not Available
Information Not Available
Joomla!, Digicure, Team Random, Credit Suisse, Samsung, Air New Zealand
Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Static Application Security Testing (SAST). Updated: October 2026.
917,433 professionals have used our research since 2012.