ImmuniWeb vs Wapiti

ImmuniWeb is a cybersecurity platform for testing and protecting web and mobile applications, APIs, microservices, and cloud and network infrastructure. Discovery covers attack-surface management, ongoing security monitoring, third-party risk, dark-web monitoring, and cyber-threat intelligence. Neuron scans web applications and APIs, including authenticated and patch-verification scans and OWASP vulnerability checks. On-Demand provides web application and API penetration testing with compliance-oriented reports and remediation assistance; MobileSuite tests mobile apps and their backend services. A no-cost Community Edition offers online checks for SSL, email and website security, privacy, mobile app security, and dark-web and threat exposure. Discovery packages include dashboard and API access, PDF and XLS exports, JSON via REST API, and 24/7 expert assistance. The company says Discovery can help address monitoring requirements under frameworks including GDPR, DORA, NIS 2, HIPAA, ISO 27001, SOC 2, and PCI DSS. ImmuniWeb was founded in 2014 and is headquartered in Geneva. Listed Neuron subscriptions start at €395 a month; other listed plans include Discovery subscriptions from €1,495 a month and penetration tests from €5,995, paid once.

Wapiti is a Python scanner that audits deployed websites and web applications for vulnerabilities. It crawls the application and sends payloads to links, forms, and scripts rather than inspecting source code. Listed checks cover SQL and XPath injection, cross-site scripting, file disclosure, command execution, XXE, SSRF, and open redirects. It can scan REST APIs using an OpenAPI (Swagger) file and supports authenticated scans through Basic, Digest, or NTLM authentication, login forms, imported browser cookies, or custom Python code. Users can configure scope, crawler limits, HTTP headers, and HTTP, HTTPS, or SOCKS5 proxies. Scans can be suspended and resumed using SQLite-backed sessions. Reports are available in HTML, XML, JSON, TXT, CSV, and Markdown. Wapiti is free and released under GNU GPL version 2; installation is offered with pip. The project lists Python 3.12, 3.13, or 3.14 as requirements and says Windows use can be done through WSL. Its README warns scans may disrupt targets or cause data loss and says the target owner's consent is required.