Invicti Web + API (Acunetix)
18 Reviews and Ratings
What is Invicti Web + API (Acunetix)?
Invicti Web + API is an automated Dynamic Application Security Testing (DAST) platform designed to crawl, parse, and scan web applications, custom microservices, and APIs to detect, verify, and prioritize exploitable security weaknesses in production and staging environments.
Key Capabilities
- Proof-Based Scanning Automation: Automatically verifies detected vulnerabilities by generating safe proof-of-exploit payloads (such as executing print() or reading database version strings), reducing false positive rates and eliminating manual verification cycles.
- Combined DAST + IAST Engine: Deploys lightweight IAST server agents (AcuSensor / Invicti IAST) alongside the dynamic crawler to inspect backend source code execution, file system access, and database queries during dynamic scanning.
- Comprehensive API & Single-Page Application Crawling: Parses modern JavaScript execution frameworks (such as React, Angular, and Vue.js) alongside OpenAPI (Swagger), Postman collections, WSDL, and GraphQL schemas to scan unindexed API endpoints.
- CI/CD Pipeline & Issue Tracker Automation: Connects directly to build and deployment tools (GitHub Actions, GitLab CI, Jenkins, Azure DevOps) to fail non-compliant builds and automatically log verified defects in tracking systems like Jira or ServiceNow.
- Continuous Asset Discovery: Discovers unmapped web assets, subdomains, and forgotten endpoints across organization-owned IP ranges to maintain an accurate application attack surface inventory.
- Regulatory Compliance Reporting: Generates automated compliance reports mapped against security standards including OWASP Top 10, PCI-DSS, HIPAA, ISO 27001, and NIST SP 800-53.
Audience & Use Cases
- Audience: Application Security (AppSec) Engineers, Penetration Testers, Security Operations (SecOps) Teams, Software Development Managers, and Chief Information Security Officers (CISOs).
- Use Case: Automating pre-production vulnerability scanning within DevSecOps pipelines, continuously monitoring live web applications and APIs for zero-day vulnerabilities, verifying remediation fixes, and generating compliance documentation.
Technical Specifications
- Deployment Models: Cloud-based Software as a Service (SaaS) and self-hosted on-premises deployment (Windows / Linux / Docker).
- Scan Engine Capabilities: Custom Chrome-based headless crawler, IAST runtime instrumentation, Proof-Based verification engine.
- API Standards Supported: OpenAPI (v2/v3), RAML, GraphQL, WSDL, Postman Collections, JSON/XML web services.
- Integrations: Jira, ServiceNow, GitHub, GitLab, Azure DevOps, Jenkins, Bamboo, Bitbucket, Splunk, Sumo Logic.
Product Lineage & Brand Evolution
Invicti Web + API represents the core dynamic application scanning technology originally developed under the name Acunetix, a web vulnerability scanner founded in 2005. In 2018, private equity firm TVI (backed by Morningside) acquired Acunetix and subsequently merged it with fellow DAST vendor Netsparker. Following a major growth investment from TA Associates and Summit Partners in 2021, the parent company rebranded as Invicti Security. Under the unified Invicti corporate umbrella, the flagship product was rebranded as Invicti Web + API (incorporating features from both the legacy Acunetix and Netsparker scanner engines) to align under a consolidated enterprise application security suite.
Categories & Use Cases
Videos
Screenshots
1 / 3
Screenshot of Dashboard
Technical Details
| Deployment Types | On-Premise |
|---|---|
| Operating Systems | Windows, Linux |
| Mobile Application | No |
| Supported Countries | All |
| Supported Languages | English |
Downloads
FAQs
What is Invicti Web + API (Acunetix)?
Invicti Web + API (formerly Acunetix) is a cloud-based and on-premises Dynamic Application Security Testing (DAST) and API Security platform engineered to automatically scan running web applications and web services for security vulnerabilities. Positioned as an enterprise application security testing alternative to platforms such as Veracode, Checkmarx, and Rapid7 InsightAppSec, the software combines black-box dynamic scanning with Interactive Application Security Testing (IAST) agents to identify vulnerabilities across complex single-page applications (SPAs), JavaScript frameworks, and Representational State Transfer (REST), GraphQL, and SOAP web services. Invicti Web + API utilizes Proof-Based Scanning technology, which automatically executes safe exploitation attacks against detected vulnerabilities—such as Cross-Site Scripting (XSS) and SQL Injection (SQLi)—to extract non-sensitive proof data and confirm exploitability without manual penetration testing. The platform integrates into Continuous Integration/Continuous Deployment (CI/CD) pipelines, ticketing platforms like Jira, and Vulnerability Management software to automate issue assignment, re-testing, and remediation tracking across software development lifecycles.
What are Invicti Web + API (Acunetix)'s top competitors?
Rapid7 AppSpider and Invicti are common alternatives for Invicti Web + API (Acunetix).