HP WebInspect Competitive Card
What Does HP WebInspect Do?
1.http://www8.hp.com/us/en/soft
ware-solutions/webinspect-
dynamic-analysis-dast/
2. Automated dynamic testing and
static analysis tool for finding and
prioritizing weaknesses.
3. Part of $8.8B Micro Focus –HPE
Spin-off
4. Less focus on DAST – more
focus on SAST
Pricing Thoughts
1. Named User - $29.5K
2. Concurrent User- $36.9K
3. Express - $15K (10 apps max)
HP WebInspect Strengths
1. Magic Quadrant Leader (#1)
2. Large Enterprise Customers
3. DAST, SAST, IAST, RASP offerings
4. Flexible deployments in-house,
managed service, or hybrid
Rapid7 Strengths
1. Ease of use
2. Higher percentage of
Modern Application support
3. Interactive, “Live” Reports
4. Attack Replay built-in reports
Trap questions for Prospects
1. Why didn’t HPE keep their
software business intact if it only
required “a few tweaks to grow its
profits”?
2. How does the spin-off of most
of their software operations to
Micro Focus affect relative future
and the overall health of the Web
Application Security space?
Customer Stories
Please contact Rapid7 for
customer reference info
 IBM AppScan Competitive Card
What Does IBM AppScan Do?
1.http://www.ibm.com/software/pr
oducts/en/appscan
2. DAST (WatchFire); SAST
(OunceLabs); MSSP (ISS)
3. Touts self as leader in the ability
to execute
4. Cognitive Security through Watson
(via IBM QRadar)
Pricing Thoughts
1. Standard (single user/single
install) - $11K
2. Floating user - $8.9K
3. Perpetual - $12.5K
4. IBM offers an expensive DAST-as-
a-Service as an add-on to other
services
IBM AppScan Strengths
1. IBM Global Services
2. Gartner MQ Leader (#3)
3. DAST & SAST offering
4. IBM AppScan “Glassbox” (IAST
concept) for JAVA and .NET only
Rapid7 Strengths
1. More sophistication on Modern
Applications (REACTJS, JSON,
ANGULARJS, SPA)
2. Requires less upfront training and
configuration of the scanner
3. Superior DAST solution
4. Checkmarx Partnership for SAST
Trap questions for Prospects
1. With IBM having less focus on
App Security Testing, why is
AppScan used as a bargaining
chip; many times given away at
zero cost? IBM’s strength is
QRadar and Rational
2. Is Mobile app and API
scanning with DAST important?
IBM only supports this w/SAST.
3. According to Gartner, which
DAST solution has been
replaced the most? IBM’s!
Customer Stories
Please contact Rapid7 for
customer reference info
 Acunetix Competitive Card
What Does Acunetix Do?
1.http://www.acunetix.com/vulne
rability-scanner
2. Acunetix Web Vulnerability
Scanner (WVS) run on-premises
3. Acunetix Online Vulnerability
(OVS) from its console in the cloud
(built on AWS)
4. More traditional crawl & audit
name/value pair analysis
Pricing Thoughts
1. Cheaper
2. Standard (2 concur)- $2.5K
3. Pro (5 concur) - $3.5K
4. Enterprise (10 concur/3 user) -
$7K
Acunetix Strengths
1. A “good enough” solution
2. Scanning traditional apps and
producing similar AS results
3. Approx 20% of install base utilizes
Acunetix integrated IAST capability -
AcuSensor
4. Now delivering Manual Pen Testing
Tools (HTTP editor, fuzzer and sniffer
tools) at no cost.
Rapid7 Strengths
1. Enterprise deployments -
Acunetix doesn’t really have an
Enterprise offering
2. Complex Apps – at times Acunetix
struggle crawling Modern apps
Trap questions for Prospects
1. Do you have a need to scan API’s
because Acunetix makes this a very
difficult task? It does a fair job at
scanning SOAP (.wsdl) and some of
REST (.wadl – who is using this?)
but is unable to handle
.JSON files.
2. Is price more important to your
organization than the high rate of
false positives?
3. Do you prefer an automated
way or more of a manual way to
test Swagger REST API?
Competitive Stories
Please contact Rapid7 for
further competitive info
Whitehat Competitive Card
What Does Whitehat Do?
1. Provider of DAST-as-a-Service
2. SAST-as-a-Service using an on-
premise appliance to keep scanning
local
3. Services-based Only delivery
model
4. No On-Premise solution
Pricing Thoughts
1. Costly expense offerings –
increasing YOY offerings
2. Single app - $24K/yr
3. WhiteHat Security allows the
customers to modify some 10%
of their apps per quarter.
Whitehat Strengths
1. SAST and DAST services are scalable
2. Broad WAF integration
3. Live chat with security engineer
4. Heavy on the Consultative, light on
the Technology – not sure if this is a
strength.
5. 2FA as part of MSSP
Rapid7 Strengths
1. Strong service and support
capabilities
2. Universal Translator provides
coverage across new and complex web
apps
3. Ease of use
4. Interactive Reporting
5. Superior Product technology
Trap questions for Prospects
1. Does Whitehat have cost
effective DAST services for lower
end of market?
2. Why was Whitehat ranked near
the bottom in services and support
capabilities?
3. Does Whitehat offer a path to an
on-premise solution?
4. What is the turn-around time for
both Automated Scanning and
Manual analysis and verification
after you have provided URLs? 3-5
days for Rapid7
Customer Stories
Please contact Rapid7 for
customer reference info