Invicti review
Proof-based DAST for enterprises testing authenticated web applications and APIs.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Invicti is an application security platform for security and development teams that need dynamic testing across live websites, web applications, and APIs. It combines authenticated scanning, browser-based crawling for JavaScript-heavy applications, API discovery, vulnerability validation, centralized dashboards, reporting, and automatic retesting. Its focus suits enterprises that need evidence around exploitable findings rather than a broad standalone developer tool for general software quality.
The published packages separate core DAST capabilities from broader application security and deployment flexibility. Web + API includes DAST, API discovery and security, proof-based scanning, CI/CD automation, and cloud hosting. AppSec Core adds web and API security with DAST, SAST, SCA, IaC scanning, and vulnerability management. AppSec Flex focuses on flexible deployment, including cloud, on-premises, air-gapped deployment, and custom roles. Pricing is quote-based, and the product offers a 7-day free trial rather than a permanent free plan.
Invicti fits environments with established delivery pipelines and issue-management processes. Integrations include Azure DevOps, Azure Pipelines, Bamboo, CircleCI, GitHub Actions, GitLab CI/CD, Jenkins, TeamCity, Travis CI, Jira, and ServiceNow, with CyberArk Vault and HashiCorp Vault also supported. A REST API allows custom integrations, while dashboards and automated retesting support ongoing remediation. Organizations seeking authenticated web and API coverage, proof-based findings, and deployment choices should consider Invicti. Teams wanting transparent public pricing, a permanent free tier, or a narrowly focused scanner may prefer a simpler alternative.
Invicti pros and cons
- Where it wins
- Proof-based validation helps confirm exploitable vulnerabilities
- Authenticated browser scanning covers protected application areas
- Supports REST, SOAP, GraphQL, CI/CD, and issue-tracking workflows
- Where it doesn't
- Quote-based pricing requires contacting sales
- No permanent free plan is available
- Some deployment options vary by product package
Invicti fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update