Fluid Attacks Alternatives

Our overall experience with Veracode has been very positive. The platform helps us strengthen application security across multiple stages of development by identifying vulnerabilities early in the SDLC. Integration with CI/CD pipelines makes security testing more efficient and reduces manual efforts for developers. The dashboard and reporting features provide good visibility into security posture and remediation progress. Overall, it has been a reliable and valuable solution for improving secure development practices.

Checkmarx SAST is an old but gold solutions: it does it job very good i.e. SAST security scanning, but the user experience of the Web interface is far from being perfect. The scanning results are OK, in line with the expectation, not too many false positive and very rare false negatives, which is the most important feature of this scanner.

We have engaged AppKnox for our app vulnerability assessment and VAPT requirements, and the overall experience has been structured and professional. Their team has been responsive from onboarding through report delivery and retesting. AppKnox's automated vulnerability assessment (SAST/DAST/API) combined with manual penetration testing produced detailed, actionable reports that helped our engineering team prioritize and remediate issues efficiently. Revalidation after fixes was handled promptly.

They were really good as a person. They contacted with us in an informative and helpful way. Their tool is also encapsulates sast-dast-sca. Which is enough for our whole team. It offers a comprehensive, all in one appsec suite with good ci cd pipeline integration anad good compliance reporting. However platform feels clunky and resource heavy. Which suffers steep learning curve and too much complex setup process. Their developer education interface is great enough. Any developer can learn their vulnerabilities and how to fix by themselves without asking us.

We use GitLab mainly for source code management, CI/CD pipelines, and collaboration between development teams. Having repository management, pipelines, and issue tracking in one platform helps simplify the development workflow and reduces the need for multiple separate tools. The CI/CD integration works well and is flexible enough for different deployment scenarios. Merge request and branch management features also help improve collaboration during development. Initial setup was relatively straightforward, although optimizing runners and pipelines required some tuning depending on the environment. One challenge is that some advanced features have a learning curve, especially for teams that are new to DevOps practices. Pipeline troubleshooting can also become difficult when configurations grow more complex.

After moving some of our toolsets around, we had a gap related to web app scanning. We slide Invicti into place and it has been an awesome product, with no major issues. It was straightward to set up, and it's easily been a "fire and forget" kind of tool, as we automate pulling the reports.

The project manager and technical resource dedicated to our account is amazing. They anticipate our needs, assist us with implementation, answer every question asked, and are extremely professional.

Good quality software and very good communication with the support team to address issues.