Invicti
DAST with proof-based scanning that confirms a vulnerability is real before reporting it.
What it is
Invicti (which includes Acunetix) performs dynamic scanning and then safely exploits confirmed findings to prove they are genuine, marking them as verified so the security team can skip triage. That proof-based approach is the product's central claim and the reason enterprises adopt it over free scanners.
Best for
Where it is strong
- Proof-based scanning eliminates most false-positive triage, which is the main cost of DAST.
- Handles authenticated scanning of modern JavaScript applications well.
- Good asset discovery for organisations that do not know all their own sites.
Where it falls short
- Expensive relative to free DAST alternatives.
- Scans take time and are not suited to per-commit feedback.
- Dynamic testing alone cannot find everything a code review would.
Pricing
Quote on request
Quote onlyFree tier: Demo and trial on request.
What drives the bill: Enterprise licensing by number of target sites or applications.
Check current pricing on Invicti Security’s siteFigures are indicative and were last reviewed August 2026. Vendors change pricing often; confirm before you commit.
Works with
What people who use Invicti say
No reviews of Invicti yet. If you have used it in anger, yours would be the first.
Alternatives to Invicti
If Invicti is not the right fit, these solve the same problem differently.
Burp Suite
Security Testing
The professional web security tester's tool of choice, plus an enterprise scanner.
OWASP ZAP
Security Testing
The free, open-source DAST scanner that attacks your running application.
Checkmarx One
Security Testing
Enterprise application security platform: SAST, SCA, DAST, IaC and API security.