ArcherySec vs Fluid Attacks

ArcherySec is a free, open-source vulnerability assessment and management tool for developers, penetration testers, and DevOps teams. It scans web applications and networks through supported tools, then brings scan findings together for review. Features include authenticated web scans, Selenium-based web application scanning, severity-based prioritization, false-positive tracking, finding deduplication, and remediation workflows. The product lists more than 80 commercial and open-source tool integrations; documented connectors include OWASP ZAP, Burp, Arachni, OpenVAS, Jira, and email. Its CLI can run in CI/CD pipelines and return pass or fail exit codes according to configured scan policies. REST APIs cover scanning and vulnerability management. The tool supports periodic and concurrent scans. Deployment documentation covers Linux, Docker, and Vagrant with Ansible, and the project provides Windows setup and run scripts. ArcherySec is self-hosted and distributed under the GPL-3.0 license. Users need to run supported scanners and provide their endpoints. The project advises against public exposure and recommends restricting the signup page in production.

Fluid Attacks is an application security platform for finding, reporting, managing and remediating vulnerabilities through the software development lifecycle. Essential includes continuous automated SAST, SCA, DAST, MAST, CSPM and secret scanning. Advanced adds expert PTaaS, secure code review and reverse engineering. Teams can prioritize vulnerabilities with customizable risk scoring, set temporary or permanent risk acceptance, and configure build-breaking thresholds. Autofix and Custom Fix provide GenAI-assisted remediation in the platform and IDE extensions. Listed connections include Jira Cloud, GitLab, Azure DevOps, IDE extensions, CI Gate, a GraphQL platform API and webhooks; plugins or extensions are listed for Visual Studio Code, Cursor and IntelliJ IDEA. The platform targets source code and supports 14 languages, pull request scans and CI/CD integration. Fluid Attacks describes it for security, development and fraud teams seeking visibility into software risk and remediation. Pricing is on request, with no free plan. The 21-day Essential trial requires a Git repository and a corporate Google, Azure or Bitbucket account; existing client organizations cannot create trial accounts.