Invicti
Invicti: Proof-based DAST for enterprises testing authenticated web applications and APIs. Ranked #7 of 26 in Dynamic Application Security Testing Software by our editors (8.8/10); pricing: Pricing on request; best for enterprises needing proof-based web and API DAST.
At a glance
- Editor score8.8 / 10
- PricingPricing on request
- Best forEnterprises needing proof-based web and API DAST
- Free planNo
- Paid from$500/unit usage-based
- Authenticated scanningYes
- Facts checked22 Sep 2026
Where it wins
- Proof-based validation helps confirm exploitable vulnerabilities
- Authenticated browser scanning covers protected application areas
- Supports REST, SOAP, GraphQL, CI/CD, and issue-tracking workflows
Where it doesn't
- Quote-based pricing requires contacting sales
- No permanent free plan is available
- Some deployment options vary by product package
Our verdict on Invicti
Invicti is an application security platform for security and development teams that need dynamic testing across live websites, web applications, and APIs. It combines authenticated scanning, browser-based crawling for JavaScript-heavy applications, API discovery, vulnerability validation, centralized dashboards, reporting, and automatic retesting. Its focus suits enterprises that need evidence around exploitable findings rather than a broad standalone developer tool for general software quality.
The published packages separate core DAST capabilities from broader application security and deployment flexibility. Web + API includes DAST, API discovery and security, proof-based scanning, CI/CD automation, and cloud hosting. AppSec Core adds web and API security with DAST, SAST, SCA, IaC scanning, and vulnerability management. AppSec Flex focuses on flexible deployment, including cloud, on-premises, air-gapped deployment, and custom roles. Pricing is quote-based, and the product offers a 7-day free trial rather than a permanent free plan.
Invicti fits environments with established delivery pipelines and issue-management processes. Integrations include Azure DevOps, Azure Pipelines, Bamboo, CircleCI, GitHub Actions, GitLab CI/CD, Jenkins, TeamCity, Travis CI, Jira, and ServiceNow, with CyberArk Vault and HashiCorp Vault also supported. A REST API allows custom integrations, while dashboards and automated retesting support ongoing remediation. Organizations seeking authenticated web and API coverage, proof-based findings, and deployment choices should consider Invicti. Teams wanting transparent public pricing, a permanent free tier, or a narrowly focused scanner may prefer a simpler alternative.
Your product? Our editors can test Invicti in depth and publish a review, labelled as paid · from $149/mo →
Invicti pricing
All 4 Invicti plans and prices →
Invicti fact sheet
| Free plan | No |
|---|---|
| Paid from | $500/unit usage-based |
| Authenticated scanning | Yes |
| API testing | Yes |
| Browser-based scanning | Yes |
| CI/CD integration | Yes |
| Deployment model | Hybrid |
| Included scan targets | Not verified |
| Deployment | Cloud, Self-hosted |
| Platforms | Web |
| Compliance & security | SOC 2, ISO 27001 |
| Built for | Mid-market, Enterprise (editorial estimate) |
| Integrations | 110+ integrations: CI/CD platforms, issue trackers, collaboration tools, REST API See all → |
| Pricing | Pricing on request (source) |
| Website | invicti.com |
| Facts checked | 22 Sep 2026 |
Invicti integrations
Invicti lists 110+ integrations on its own site — the 4 named here are the ones its pages call out.
- CI/CD platforms
- issue trackers
- collaboration tools
- REST API
See all Invicti integrations →
Alternatives to Invicti
- Safeguard DASTBroad authenticated web and API scanning with paid plans starting at $9/month.9.4
- OWASP ZAPA capable free DAST tool with broad web, API, browser, and automation coverage.9.3
- apPosture DASTEvidence-backed DAST for developers who need deep web and API testing.9.2
See all Invicti alternatives →
Invicti vs the competition
- Invicti vs Safeguard DAST
- Invicti vs OWASP ZAP
- Invicti vs apPosture DAST
- Invicti vs Astra DAST Scanner
- Invicti vs Beagle Security
- Invicti vs Burp Suite DAST
Compare Invicti with any tool side by side →
Also Ranked In
Invicti is ranked in 9 of our directories; the 6 strongest besides Dynamic Application Security Testing Software.
- #12Interactive Application Security Testing Software15 tools ranked
- #11Application Security Testing30 tools ranked
- #11Vulnerability Scanner Software29 tools ranked
- #13Web Application Security Scanners29 tools ranked
- #15Application Security Posture Management Software17 tools ranked
- #16Application Security Orchestration Platforms23 tools ranked
Used Invicti? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Invicti for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Invicti is listed in our Dynamic Application Security Testing Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/invicti/"><img src="https://www.itechguides.com/best/badge/invicti.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update