Acunetix review

Acunetix is a dynamic application security testing (DAST) product for web applications and APIs. It is now Invicti Web + API, according to the published product information. Its job is to scan running apps and APIs for vulnerabilities, validate findings, and help teams decide what to fix first.

The feature set covers web app scans for OWASP Top 10 issues and business logic flaws, plus REST, GraphQL, and SOAP API testing. Acunetix also lists asset discovery across code, traffic, and runtime, including shadow assets. For authenticated testing, it supports role-based flows and complex authentication scenarios. Its risk prioritization uses runtime reachability, exploitability, business context, and more than 200 signals. The product also provides remediation guidance and automatically retests fixes.

That is a broad DAST pitch, not a published promise that every deployment will find every issue. The published details do not specify scan-volume limits or which plan includes each capability.

The useful part of Acunetix’s feature set is its coverage beyond a basic vulnerability scan. It is aimed at teams that need to test web apps and APIs, including authenticated flows, and want findings tied to business context rather than a severity score alone.

• API coverage: The product lists REST, GraphQL, and SOAP testing, with context across requests. It also lists multilayer API discovery under Web + API pricing.
• Authenticated testing: Role-based user flows and complex authentication scenarios are specifically included in the feature description—important for apps where unauthenticated scans miss protected paths.
• Prioritization and follow-up: Risk assessment uses runtime reachability, exploitability, business context, and 200+ signals. Remediation guidance and automatic retesting are also listed, so the workflow is intended to continue past finding a vulnerability.
• Asset discovery and automation: Discovery across code, traffic, and runtime is meant to surface web apps, APIs, and shadow assets. The Web + API plan lists CI/CD automation and SSO.

Those are relevant capabilities for teams managing more than one app or API. But the feature list does not establish how accurately the product identifies assets or prioritizes findings in a specific environment.

The biggest buying drawback is price opacity. The pricing page lists quote-based pricing for Web + API, but publishes no monthly or annual rate or billing terms. It also does not publish a free plan or free-trial terms. That makes it hard to compare the scanner with alternatives before speaking to sales.

There is one clearer price point: Agentic Pentest is listed at a maximum of $500 per pentest, for teams testing one application and API suite. It includes audit-ready PDF reports, delivery within 24 hours, and blackbox, whitebox, or graybox testing. That is a separate per-pentest offer, not a published subscription price for Web + API. The listed Web + API plan is priced per quote and includes proof-based scanning, multilayer API discovery, CI/CD automation, and SSO. Target, scan-volume, and seat caps are not published on the vendor's site.

There is also a reported operational risk, though it is only one user’s account. In a Reddit thread, an Acunetix 360 user said a scan produced more than 60,000 HTTP 500 responses and coincided with an application crash and app-pool recycling. The user said disabling resource-intensive checks and following the optimization wizard did not resolve it. That is not evidence of a typical outcome, but teams should account for scan impact on production systems.

Acunetix does not publish a subscription price. Its pricing page offers quotes, with no monthly or annual billing terms listed, so you’ll need a quote to compare the Web + API plan with other scanners.

The listed Agentic Pentest option is priced per pentest, with a maximum of $500 per pentest. It’s aimed at teams testing one application and API suite and includes audit-ready PDF reports, delivery within 24 hours, and blackbox, whitebox, or graybox testing. Web + API is priced per quote and lists proof-based scanning, multilayer API discovery, CI/CD automation, and SSO.

There’s no published price jump to calculate: these are different buying units, and the Web + API price is not public. The pricing information lists no add-ons. It also lists no free plan; trial terms are not published. Before committing, ask for the quote, billing period, renewal terms, and any costs tied to scan volume or additional applications. Those details aren’t published in the published pricing information.

Acunetix is now Invicti Web + API, so check how the current product name, account, and contract will appear in any migration plan. The product description covers authenticated testing, API analysis, CI/CD automation, and fix validation; replacing it means checking which of those workflows your team relies on and configuring their equivalents in the next tool.

Before switching, inventory application and API targets, authentication flows, scan schedules, CI/CD connections, and open findings. The published material does not say whether Acunetix can export findings, scan settings, or history, or import them into another product. Get written answers and test a sample export before ending a contract. It also doesn’t describe contract lock-in or cancellation terms.

We can’t cite Reddit reasons for leaving: no Reddit posts or comments were included in the published material. The documented buying concern is opaque pricing; the verdict also flags one user report of scan disruption, without details to assess how common it is.