Invicti
Application security platform built around proof-based DAST, formerly Netsparker.
Technical Architecture & Overview
Invicti, which absorbed the Netsparker brand in 2022, scans web applications and APIs and uses proof-based scanning to confirm many findings and reduce false positives. The platform now adds SAST, SCA, and API discovery. Cloud hosting is standard, and on-premises, bring-your-own-cloud, and air-gapped deployments come with the AppSec Flex package. Acunetix is now sold as Invicti Web + API, the DAST and API security package.
Targeted Technical Use Cases
Organizations that want DAST findings trustworthy enough to route into developer tickets automatically.
Evaluation & Trade-offs
Core Strengths
- +Proof-based scanning confirms which findings are exploitable.
- +Attack surface management identifies exposed apps and endpoints.
- +Integrates into CI/CD workflows across environments.
Trade-Offs & Limitations
- -Pricing is quote-based with no published rates.
- -Authentication-heavy apps need scanner configuration effort.
Defensive Security Application
Continuous dynamic scanning of web estates with verified, actionable findings.
Frequently Asked Questions
What is Invicti?→
Invicti, which absorbed the Netsparker brand in 2022, scans web applications and APIs and uses proof-based scanning to confirm many findings and reduce false positives. The platform now adds SAST, SCA, and API discovery. Cloud hosting is standard, and on-premises, bring-your-own-cloud, and air-gapped deployments come with the AppSec Flex package. Acunetix is now sold as Invicti Web + API, the DAST and API security package.
What is Invicti used for?→
Organizations that want DAST findings trustworthy enough to route into developer tickets automatically.
What are the strengths of Invicti?→
- +Proof-based scanning confirms which findings are exploitable.
- +Attack surface management identifies exposed apps and endpoints.
- +Integrates into CI/CD workflows across environments.
What are the limitations of Invicti?→
- +Pricing is quote-based with no published rates.
- +Authentication-heavy apps need scanner configuration effort.
How is Invicti used defensively?→
Continuous dynamic scanning of web estates with verified, actionable findings.