What it does
Invicti Web + API is a dynamic application security testing product for web applications and APIs. The official product site identifies it as the current name for the former Acunetix product, while its documentation covers target discovery, API security, scans, vulnerability reports, and integrations. This entry covers that web and API scanner, not Invicti's broader AppSec platform with separate static analysis, software composition, secrets, and infrastructure-as-code capabilities.
Define targets before launching a scan
The official quick-start documentation describes adding web targets, launching scans, reviewing results, connecting issue-tracking tools, and creating reports. A security team can begin with a staging application or an API it is authorized to test, choose a scan configuration and scope, then review the findings and decide what needs remediation. Protected routes require suitable access or authentication configuration; the documentation separates target setup, API security, and scan settings rather than treating a URL as a complete test plan.
Invicti's product pages emphasize proof-based scanning and API coverage. The documentation also distinguishes Invicti Enterprise on-demand, Enterprise on-premises, and Invicti Standard, so teams should choose the edition that matches their deployment and workflow. The product's pricing page invites buyers to request a quote and describes a proof-of-concept license; it does not provide a fixed public price or establish the proof-of-concept duration.
A DAST scanner tests the behavior it can reach at runtime. It does not replace unit or integration tests, and a scan's useful coverage depends on configured targets, scope, and authentication.
Strengths
- The product is designed to scan web applications and APIs and prioritize findings with runtime evidence.
- The official documentation covers target discovery, API security, scan configuration, reports, and integrations.
- Enterprise on-demand, Enterprise on-premises, and Standard workflows are separately documented.
Watch out for
- Coverage depends on the targets, scan scope, and authentication configured for the application; unreachable routes are outside the scan.
Best for
- Application-security teams checking live web applications and APIs for exploitable vulnerabilities
- Security engineers who need scan findings, reports, and issue-tracking workflows
- Organizations selecting between on-demand and on-premises DAST deployment
Sources
- Invicti Web + API | Web Application Security Scanner (Oct 26, 2026)
- Invicti Enterprise and Standard (Oct 26, 2026)
- Quick start | Invicti Enterprise and Standard (Oct 26, 2026)
- Invicti Pricing | Invicti (Oct 26, 2026)
- Invicti | Web Application and API Security for Enterprise (Oct 26, 2026)