Global Tool Radar

Security & Privacy / Application Security Testing Software

Invicti Platform Review, Pricing, Pros & Cons

Invicti Platform is a DAST-first application security testing and posture management platform that combines web and API testing, proof-based runtime validation, SAST, SCA, container and infrastructure-as-code scanning, secrets detection, ASPM, and developer workflow automation.

Research by Global Tool Radar Research SystemEvidence checked: Aug 10, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Visit product websiteChoose similar tools to compare

Buying snapshot

Quick buying snapshot

A compact view of who this tool fits, what it costs, and what to confirm before choosing it.

Best for
  • Runtime validation and DAST accuracy are the foundation of the AppSec program: Invicti centers proof-based DAST and uses runtime intelligence to validate and prioritize findings.
  • The organization needs web, API, code, supply-chain, and posture-management workflows in one platform: AppSec Core combines Web + API, SAST, SCA, container, IaC, secrets, ASPM, correlation, and reporting.
More buying conditions
  • A regulated or isolated deployment is required: AppSec Flex lists bring-any-cloud, on-premises, and air-gapped deployment alongside enterprise governance.
Not for
  • The buyer requires transparent public numeric pricing and self-service purchase: All three current core plans require a quote and publish no numeric amount, priced unit, minimum, or contract term.
  • The requirement is a lightweight SMB DAST scanner: Invicti positions Acunetix as the separate smaller-organization product and Invicti as enterprise-scale.
More buying conditions
  • The buyer assumes every platform capability, service, or legacy SKU is included in every plan: Current plan cards separate package coverage, while Agentic Pentest, professional services, premium support, and Guided Success are outside the core plan definitions.
Pricing
  • Three sales-quoted core plans with final scope determined through a quote; public numeric prices, priced units, minimums, payment timing, and contract commitments are not stated.
  • Web + API · Requires quote · custom quote
Free or trial access
  • No permanent free plan. Current product pages advertise a 7-day free trial, while the pricing FAQ offers proof-of-concept licenses for evaluation in the buyer's environment.

Product scope

Product functionality and purchase scope

The current Invicti AppSec Platform and its Web + API, AppSec Core, and AppSec Flex plans, with DAST-first runtime validation, API security, broader AST, ASPM, remediation, governance, and deployment capabilities bounded by current public evidence.

Product checked: Aug 10, 2026

Functionality reviewed
  • Web + API core plan
  • AppSec Core core plan
  • AppSec Flex core plan
  • Invicti Platform DAST, API discovery and testing, SAST, SCA, IAST, secrets, container, IaC, ASPM, and workflow capabilities where publicly verified
Non-target functionality excluded from scoring
  • Acunetix and its Essentials, Professional, and Ultimate plans
  • Legacy Invicti Enterprise and Invicti Desktop licensing pages or marketplace SKUs
  • Agentic Pentest as an optional platform capability rather than a core plan
  • Professional Services, Premium Support, Guided Success, and Advanced Guided Success as services or add-ons rather than core plans
  • Mend products purchased separately from the integrated Invicti Platform package
Purchase paths

Pricing checked: Aug 10, 2026

  • Invicti on AWS Marketplace: Invicti offers public and private AWS Marketplace procurement. The listing's public numeric dimensions are legacy Invicti Enterprise, Acunetix, support, or standalone ASPM entries rather than current Web + API, AppSec Core, or AppSec Flex offers, so none are repeated here.

Pricing plans

Invicti Platform pricing table

Pricing checked: Aug 10, 2026

Official factConfidence 99%3 linked sources

Web + API covers DAST-led web and API testing. AppSec Core adds code, supply-chain, and posture-management scope. AppSec Flex adds enterprise integrations, governance, and flexible deployment. Agentic Pentest, professional services, Premium Support, and Guided Success are not core plans.

Official pricing page
PlanPriceKey differencesBest for
Web + APIInvicti AppSec Platform Web + API
  • Requires quote · custom quote
  • Proof-based DAST and runtime validation: Industry-leading DAST, proof-based scanning, and runtime validation; Supported vulnerability classes and target configuration.
  • API discovery and stateful testing: Multilayer API discovery, stateful API security, and LLM security; Discovery method and API architecture affect coverage.
  • CI/CD automation and SSO: CI/CD automation and single sign-on; Integration-specific configuration required.
  • Cloud and on-premises deployment: Cloud hosting and on-premises deployment are listed; Exact architecture and quote terms are not publicly stated.
Teams prioritizing proof-based DAST, application and API discovery, stateful API testing, and CI/CD automation without the full code and supply-chain package.
AppSec CoreInvicti AppSec Platform AppSec Core
  • Requires quote · custom quote
  • Web and API package: Web and API capability is included; Exact target allowance is quote-dependent.
  • Code, secrets, and IaC testing: SAST, secrets detection, and IaC scanning; SAST is partner-supplied.
  • Supply-chain and container security: SCA, container security, and SBOM with VEX; Scanner and repository coverage is not publicly quantified.
  • ASPM and runtime correlation: ASPM, pentest import, DAST-SAST correlation, vulnerability management, and runtime prioritization; Correlation depth depends on available findings and integrations.
  • Compliance reporting: Compliance reporting; A report does not itself establish certification.
AppSec teams that need web and API testing plus code, dependency, container, IaC, secrets, ASPM, correlation, and compliance workflows.
AppSec FlexInvicti AppSec Platform AppSec Flex
  • Requires quote · custom quote
  • AppSec Core coverage: AppSec Core is included; Final configured scope is quote-dependent.
  • Extended risk-source integrations: CSPM, infrastructure vulnerability-management, and bug-bounty integrations; Requires compatible external systems.
  • Custom roles and CISO dashboard: Custom roles and CISO posture dashboard; Role and dashboard configuration required.
  • Agentic prioritization and AI-guided fixes: Agentic prioritization and AI-guided fixes; Not equivalent to the separate Agentic Pentest capability.
  • Flexible and isolated deployment: Cloud hosting, bring any cloud, on-premises, and air-gapped deployment; Architecture, residency, and infrastructure requirements require validation.
Large or regulated enterprises that need AppSec Core plus custom governance, additional risk integrations, and bring-your-own-cloud, on-premises, or air-gapped deployment.

Plan upgrade triggers

Verified plan boundaries that can change the required edition.

Web + API AppSec Core

Need SAST, static SCA, container security, IaC scanning, secrets detection, SBOM with VEX, ASPM, or DAST-SAST correlation.

Supporting pricing evidence
AppSec Core AppSec Flex

Need custom roles, CISO posture dashboards, CSPM or infrastructure VM integrations, bug-bounty integration, bring-any-cloud, on-premises, or air-gapped deployment.

Supporting pricing evidence
What is included, connected, or sold separately

Product scope

What is included, connected, or sold separately

Material capabilities are separated by their verified relationship to the target product.

ASPM and vulnerability correlation in AppSec Core and FlexRelationship not verified

The current core plan card includes ASPM; the AWS marketplace also exposes an independently priced legacy ASPM dimension that is not used as a core-plan offer.

Plan: Web + API: Not verified · AppSec Core: Not verified · AppSec Flex: Not verifiedInvicti ASPM
Official source
Legacy Invicti Enterprise product and licensing scopeRelationship not verified

The name remains in legacy licensing and marketplace dimensions but is not a current core plan name.

Invicti Enterprise
Official source
Multilayer API discovery and stateful API testingRelationship not verified

Discovery may be sensorless, specification-based, gateway-integrated, or NTA-based; API testing is a separate step applied to the resulting inventory.

Plan: Web + API: Not verified · AppSec Core: Not verified · AppSec Flex: Not verified
Official source
Optional Agentic Pentest capability outside core plan entitlementsRelationship not verified

Invicti calls Agentic Pentest part of the platform, while the pricing cards visually separate it from included capabilities and provide no plan-bound price.

Invicti Agentic Pentest
Official source
Partner-supplied SAST in AppSec Core and FlexRelationship not verified

Invicti explicitly describes its SAST tool as partner-supplied.

Plan: Web + API: Not verified · AppSec Core: Not verified · AppSec Flex: Not verifiedMend SAST
Official source
Premium Support and Guided Success packagesRelationship not verified

Standard support is included with subscriptions; Premium Support and Guided Success are additional packages.

Plan: Web + API: Not verified · AppSec Core: Not verified · AppSec Flex: Not verifiedInvicti Support
Official source
Proof-based DAST and runtime validationRelationship not verified

The platform is DAST-first; proof is available for supported vulnerability classes rather than every possible finding.

Plan: Web + API: Not verified · AppSec Core: Not verified · AppSec Flex: Not verified
Official source
Sensor-based IAST runtime insight with unverified plan mappingRelationship not verified

IAST requires a runtime sensor. The current pricing page does not assign it to Web + API, AppSec Core, or AppSec Flex.

Invicti IAST
Official source
Separate Acunetix DAST product for smaller organizationsRelationship not verified

Acunetix has its own Essentials, Professional, and Ultimate plans and is not part of the Invicti Platform plan ladder.

Acunetix
Official source
Separately purchased professional servicesRelationship not verified

Professional services are a service purchase, not a software plan.

Invicti Professional Services
Official source
Static SCA, container security, and SBOM with VEX in AppSec Core and FlexRelationship not verified

Web + API includes runtime SCA in product messaging, but the current plan card does not establish the broader static SCA, container, and SBOM package.

Plan: Web + API: Not verified · AppSec Core: Not verified · AppSec Flex: Not verified
Official source
How the score is calculated

Scoring method

How the score is calculated

The score uses the category-specific buying dimensions below and their displayed weights.

This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.

Evidence confidence
76%
AI claim confidence
99%
Required-field evidence status
100%
Evidence freshness
54%
Field traceability
100%
Model agreement
94%
Why this confidence level
  • Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
  • Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
  • 8 of 8 weighted claims have evidence links.
  • 0 A1 documentary official sources and 10 A2 official product sources are linked.
  • 1 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
  • 4 weighted claims are past the review window.
  • No blocking evidence conflict was identified.
Accuracy and validation18%
88

Reduces false positives using proof-based dynamic testing and correlating runtime behaviors with static code findings.

Testing scope and depth18%
86

Spans web, API, code, and infrastructure artifacts, though IAST plan availability is unconfirmed and SAST requires a third-party partner engine.

Developer workflow15%
81

Pipeline orchestration and two-way remediation into issue trackers can keep developers inside existing tools, provided SSO, CI/CD connectors, and tracker links are implemented for each team.

Remediation quality14%
80

Two-way remediation workflows, issue tracking, and runtime prioritization support practical follow-through on findings. The score is moderated because the exact remediation workflow depth and any bundled services must be confirmed in the quoted edition.

Risk prioritization13%
84

Runtime prioritization, ASPM correlation, and vulnerability management supply risk context across findings, while Flex can add CSPM, infrastructure VM, and bug-bounty sources when those systems are connected.

Governance and integrations12%
78

AppSec Flex adds CSPM, infrastructure vulnerability-management, and bug-bounty integrations, which can extend governance input into AST operations. The score stays below the top range because those integrations require compatible external systems and are not part of the base core scope.

Support and total cost10%
58

All current plans require a quote, and the supplied facts do not state public prices, commitments, minimums, or payment timing, which makes support and total cost hard to model upfront. Premium Support, Guided Success, and professional services are not established as core-plan inclusions, so buyers need a sales check to compare full ownership cost.

Public review signals

Predecessor-line reviews favor accuracy, usability, reporting, and workflow integration

G2's current Invicti (formerly Netsparker) profile is favorable but narrower than the current Invicti Platform. Review themes support the mature DAST experience: proof-based accuracy, straightforward setup, scheduled scanning, CI/CD integrations, and readable reports. Recurring cautions concern scan speed, complex configuration, API edge cases, remediation detail, and support consistency.

Public review signals updated: Aug 10, 2026

Commonly reported strengths

  • Proof-based vulnerability accuracy and lower false-positive triage
  • Usable scheduled scanning and clear reports
  • CI/CD and issue-tracker integration

Commonly reported concerns

  • Slow scans or performance on some workloads
  • Configuration and API-scanning edge cases
  • Variable remediation detail and support response
G24.6/5
Review count
68 reviews
Source context
Invicti (formerly Netsparker) on G2Exact product
View sourceHistory baseline established: Aug 10, 2026

Marketplace app signals

Marketplace app signals

These source-reported ratings describe a specific marketplace listing, integration, mobile app, or add-on. They do not automatically represent the complete software product.

AWS Marketplace4.1/5
Rating count
121 ratings
Evaluated scope
Full product listing
Storefront
AWS Marketplace
View source
Score81
Pricing modelThree sales-quoted core plans with final scope determined through a quote; public numeric prices, priced units, minimums, payment timing, and contract commitments are not stated.
Use casediscover applications and APIs, test code and running software, validate exploitability, correlate risk, guide remediation, and govern application security across enterprise portfolios
Company sizeEnterprise, Mid-market
Structured tags

Invicti Platform tag profile

Company size
  • Enterprise
  • Mid-market
Key features

Invicti Platform core capabilities

  • Proof-based DAST with runtime validation
  • Multilayer API discovery and stateful API security testing
  • Partner-supplied SAST with DAST and IAST runtime correlation
  • Static and dynamic SCA, container security, IaC scanning, secrets detection, and SBOM with VEX
  • ASPM, vulnerability management, deduplication, prioritization, and compliance reporting
  • CI/CD orchestration, issue tracking, two-way remediation workflows, and REST API access
Detailed strengths and purchase cautions
Pros

Why it is worth considering

  • Proof-based DAST with runtime validation can reduce unverified findings before developers triage issues.
  • Multilayer API discovery plus stateful API testing supports coverage of modern web and API surfaces when discovery routes are configured.
  • AppSec Core consolidates SAST, SCA, container, IaC, secrets, SBOM with VEX, ASPM, and correlation for programs that want one posture view across code and runtime.
  • CI/CD orchestration, issue-tracker links, two-way remediation workflows, and REST API access can keep findings inside existing delivery pipelines.
Cons

What to confirm before buying

  • All core plans require a sales quote with no public numeric price, unit, minimum, payment timing, or commitment term, so budget approval depends on vendor scoping.
  • SAST is partner-supplied, so engine coverage and entitlement must be confirmed before treating code scanning as a fixed platform strength.
  • IAST is documented as a platform runtime capability but is not mapped to a named core plan on current pricing cards, so inclusion must be validated in the quote.
  • Agentic Pentest, professional services, Premium Support, and Guided Success are presented outside core plan features and are not established as included entitlements.
Cross-model buying perspectives

Multi-AI review

Cross-model buying perspectives

Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.

AI assessment updated: Sep 22, 2026

Score comparisonGeminiGPTxAIRange
Accuracy and validation9083907
Testing scope and depth8587852
Developer workflow8478806
Remediation quality8280784
Risk prioritization8682834
Governance and integrations8077773
Support and total cost70525218
appsec testing coverage depth8588844
appsec finding accuracy prioritization9084886
appsec developer workflow fit8579816
appsec policy release governance8076764
appsec program visibility8281793
Where models differ
  • Support and total cost: 52–70 (18-point range)
  • Accuracy and validation: 83–90 (7-point range)
  • appsec developer workflow fit: 79–85 (6-point range)
GeminiAI-assisted buyer perspective83

Invicti Platform is a DAST-first application security suite that focuses on automated, proof-based vulnerability validation, suited for DevSecOps programs requiring web and API scanning paired with multi-source risk correlation, provided buyers are prepared to navigate custom-quoted pricing.

Review confidence
83/100
Model details
Strengths
  • Proof-based DAST and runtime validation automatically confirm vulnerabilities, which helps security teams minimize manual triage.
  • Multilayer API discovery and stateful testing inventory endpoints through crawling, specification files, gateways, or network traffic routes.
  • Flexible deployment configurations support SaaS, bring-your-own-cloud, on-premises, and air-gapped environments on the AppSec Flex plan.
Cautions
  • Complete pricing opacity with no public numeric prices, minimum seat counts, or contract commitments, requiring custom sales quotes for all plans.
  • Static Application Security Testing (SAST) capabilities are partner-supplied rather than natively developed, requiring buyers to verify engine coverage and licensing terms.
  • Interactive Application Security Testing (IAST) runtime mapping remains unconfirmed on the core pricing tiers, necessitating direct clarification during sales conversations.
GPTAI-assisted buyer perspective79

Invicti Platform fits enterprise AppSec teams that want a quote-based DAST-led platform and can validate plan scope through sales, especially when the buying need includes web and API testing plus broader code, supply-chain, governance, or deployment options by edition.

Review confidence
79/100
Model details
Strengths
  • The platform combines proof-based DAST, API testing, and runtime validation in the Web + API edition, which supports teams that want testing evidence tied to detected vulnerabilities.
  • AppSec Core extends the platform into SAST, secrets, IaC, container security, SBOM with VEX, ASPM, and compliance reporting, which supports consolidation of multiple AppSec workflows.
  • AppSec Flex adds governance controls, external risk integrations, and flexible deployment options including cloud, bring-any-cloud, on-premises, and air-gapped deployment, which supports regulated deployment and operating-model requirements.
Cautions
  • All current core plans are quote-based, and the supplied facts do not state public numeric prices, minimums, commitment terms, or payment timing, so commercial comparison requires a sales check.
  • IAST is documented at platform level but is not mapped to a named current core plan, so buyers need to confirm whether it is included in the quoted scope they receive.
  • SAST is partner-supplied, so buyers should confirm the exact engine coverage and entitlement they will receive in the chosen edition.
xAIAI-assisted buyer perspective79

Invicti Platform fits enterprise AppSec programs that need proof-based DAST and API testing as the core workflow, with optional expansion into code, supply-chain, ASPM, and flexible deployment, provided the buyer can complete a custom quote and confirm plan-scoped entitlements.

Review confidence
79/100
Model details
Strengths
  • Proof-based DAST with runtime validation can reduce unverified findings before developers triage issues.
  • Multilayer API discovery plus stateful API testing supports coverage of modern web and API surfaces when discovery routes are configured.
  • AppSec Core consolidates SAST, SCA, container, IaC, secrets, SBOM with VEX, ASPM, and correlation for programs that want one posture view across code and runtime.
  • CI/CD orchestration, issue-tracker links, two-way remediation workflows, and REST API access can keep findings inside existing delivery pipelines.
Cautions
  • All core plans require a sales quote with no public numeric price, unit, minimum, payment timing, or commitment term, so budget approval depends on vendor scoping.
  • SAST is partner-supplied, so engine coverage and entitlement must be confirmed before treating code scanning as a fixed platform strength.
  • IAST is documented as a platform runtime capability but is not mapped to a named core plan on current pricing cards, so inclusion must be validated in the quote.
  • Agentic Pentest, professional services, Premium Support, and Guided Success are presented outside core plan features and are not established as included entitlements.

Research transparency

How this page was researched

A compact record of the evidence used, what was not tested, and which conclusions still need verification.

Official sources
10
Broad product review sources
1
Marketplace and app-store sources
1
Editorial sources
0
Latest evidence check
Aug 10, 2026
Research basis

Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.

Conflict handling

No unresolved evidence conflict is currently recorded.

View research methodology
Verified findingsNo permanent free plan. Current product pages advertise a 7-day free trial, while the pricing FAQ offers proof-of-concept licenses for evaluation in the buyer's environment.
  • Three sales-quoted core plans with final scope determined through a quote; public numeric prices, priced units, minimums, payment timing, and contract commitments are not stated.
  • Proof-based DAST with runtime validation Multilayer API discovery and stateful API security testing Partner-supplied SAST with DAST and IAST runtime correlation Static and dynamic SCA, container security, IaC scanning, secrets detection, and SBOM with VEX ASPM, vulnerability management, deduplication, prioritization, and compliance reporting CI/CD orchestration, issue tracking, two-way remediation workflows, and REST API access Cloud, bring-any-cloud, on-premises, and air-gapped deployment choices by plan
  • Requires quote
  • Web + API covers DAST-led web and API testing. AppSec Core adds code, supply-chain, and posture-management scope. AppSec Flex adds enterprise integrations, governance, and flexible deployment. Agentic Pentest, professional services, Premium Support, and Guided Success are not core plans.
Verification notes and unresolved itemsThe live 2026 pricing page establishes three visible core plans: Web + API, AppSec Core, and AppSec Flex.
  • Its page markup also contains an unpublished hidden AppSec Core experiment
  • that hidden variation was not treated as a fourth plan or as commercial evidence.
  • No public numeric amount, priced unit, minimum, payment timing, commitment, renewal term, implementation fee, or usage charge is available for the current core plans.
  • Acunetix remains a separate product with its own plans.
Sources checked

Sources checked

Invicti Platform source links

Compliance | InvictiInvictiLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
World Class SupportInvictiLevel A2Linked to 5 scored claimsChecked Aug 10, 2026
AWS Marketplace: InvictiAmazon Web ServicesLevel A2Linked to 5 scored claimsChecked Aug 10, 2026
Acunetix vs. InvictiInvictiLevel A2Linked to 1 scored claimChecked Aug 10, 2026
Add True IAST to DAST to Scale Your SecurityInvictiLevel A2Linked to 1 scored claimChecked Aug 10, 2026
Integrated SAST | Invicti AppSec PlatformInvictiLevel A2Linked to 1 scored claimChecked Aug 10, 2026
API Security | Testing, Solutions, ToolsInvictiLevel A2Linked to 1 scored claimChecked Aug 10, 2026
Invicti Application Security PlatformInvictiLevel A2Linked to 1 scored claimChecked Aug 10, 2026

FAQ

Invicti Platform FAQ

What are the current Invicti Platform plans?

The current public ladder has Web + API, AppSec Core, and AppSec Flex. All require a quote.

Is Acunetix an Invicti Platform plan?

No. Invicti states that Acunetix and Invicti are separate DAST solutions; Acunetix has its own plans and is aimed at smaller organizations.

Is Invicti Enterprise a current core plan?

No current Invicti Platform pricing card is named Invicti Enterprise. Legacy documentation and AWS dimensions retain that product name, but the current core ladder uses Web + API, AppSec Core, and AppSec Flex.

Does Invicti include IAST?

Invicti documents sensor-based IAST as a platform runtime capability, but the current pricing page does not map IAST to a named core plan, so plan availability must be confirmed in the quote.

How do API discovery and API testing differ?

Discovery inventories APIs through sensorless crawling, specification discovery, gateway integrations, or Network Traffic Analyzer deployment. API testing then applies stateful, proof-based security checks to provided or discovered endpoints.

Is Agentic Pentest included in the core plan price?

It is part of the Invicti platform but is displayed separately from included plan features on the pricing cards; no public plan-bound price or entitlement is stated.

Can buyers try Invicti?

Yes. Current product pages advertise a 7-day free trial, and the pricing FAQ offers proof-of-concept licenses. Neither is a permanent free plan.

Popular comparisons

Common Invicti Platform comparisons

Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.

VS #1
Invicti PlatformvsMend AppSec
81Gap 081

Enterprise / Mid-market

VS #2
Invicti PlatformvsVeracode Application Risk Management Platform
81Gap 180

Enterprise / Mid-market

VS #3
Invicti PlatformvsBlack Duck Polaris Platform
81Gap 279

Enterprise / Mid-market