Invicti review

Invicti is an application security platform that brings together scanning code, testing running web applications and APIs, and managing vulnerabilities. Its DAST scans target live applications, while SAST checks code. The platform also covers open-source dependencies, infrastructure-as-code (IaC) configurations, exposed secrets, and vulnerability management.

Invicti says it connects static findings with runtime vulnerabilities, code ownership, and remediation guidance. Its vulnerability management view is meant to deduplicate findings from security tools and map them to developers. The product description also says findings can be prioritized using runtime reachability, exploitability, and business context. That is the appeal of the broad platform: teams can work across code, runtime, and supply-chain risks without treating each finding as a separate tool’s problem. The actual subscription cost, however, is not published on the pricing page.

The main case for Invicti is breadth. The product description covers several parts of an AppSec program, rather than DAST alone:

• DAST tests running web applications and APIs, with proof-based scanning intended to validate findings.
• SAST links static findings to verified runtime vulnerabilities, code ownership, and remediation guidance.
• Open-source risk features include vulnerable dependency detection, SBOM generation, and risky-license flags.
• IaC scanning and secrets detection extend coverage to infrastructure misconfigurations and exposed credentials.
• Vulnerability management deduplicates findings from security tools and maps vulnerabilities to developers.

The listed plans reflect different deployment needs: Web + API covers DAST, while AppSec Core adds SAST, SCA, IaC scanning, container security, SBOM with VEX, and vulnerability management. AppSec Flex includes AppSec Core plus cloud and on-premises options, air-gapped deployment, custom roles, and CSPM integration, according to the pricing page. For a team evaluating a single application and API suite, Agentic Pentest has the clearest published price: a maximum of $500 per pentest, with delivery within 24 hours and audit-ready PDF reports.

Price is the clearest buying obstacle. The pricing page lists Web + API, AppSec Core, and AppSec Flex as monthly plans, but publishes no monthly or annual prices. Your AppSec is custom-priced. There is no published starting subscription price, and the published pricing details do not state usage caps or scan limits. Agentic Pentest is the exception: it is capped at a maximum of $500 per pentest. Trial availability is not published.

API coverage is another point to verify before switching. In one Reddit thread, users reported limited results on GraphQL APIs and said API discovery did not solve their need to identify owners. One commenter described relying on uploaded API definitions and struggling with outdated or missing specs; another said their API results were a problem. Other commenters pointed out that API definitions can be imported and mentioned newer API discovery, but one said they had not tested it. These are individual reports, not proof that every deployment will have the same issues. Still, teams with growing GraphQL estates, weak API documentation, or strict authenticated CI/CD requirements should validate those workflows before signing.

The pricing page does not publish monthly or annual subscription prices for Web + API, AppSec Core, AppSec Flex, or Your AppSec. That means there’s no verifiable price jump between tiers, and buyers should ask Invicti for a quote before comparing subscription costs. The only public figure in the published pricing details is Agentic Pentest: a maximum of $500 per pentest, with delivery within 24 hours and audit-ready PDF reports.

The tiers mark a clear scope increase, not a published price increase. Web + API covers DAST and runtime validation; AppSec Core adds SAST, SCA, IaC scanning, container security, SBOM with VEX, and vulnerability management. AppSec Flex includes Core plus cloud and on-premises deployment options. Your AppSec is tailored. The pricing details list no add-ons, but that does not confirm none are available. Also confirm how subscriptions are billed: the page lists them as per month but gives no rates or annual terms.

The published material does not describe a migration process, data-export formats, or what happens to historical findings when a customer leaves. We can’t put a reliable effort estimate on switching in or out, or confirm how much data is portable. Before signing, ask Invicti for an export sample and a written account of what can be exported, including findings, ownership, and remediation history.

Invicti’s stated coverage spans code, live applications, dependencies, infrastructure, secrets, and vulnerability management. If you’re consolidating tools, map each current scanner and workflow to the Invicti tier you’re considering, then confirm what migration support is included; the published pricing details don’t specify it. The brief flags reported API shortcomings, but provides no Reddit post details or specific switching complaints. We can’t responsibly attribute particular reasons for leaving to Reddit users from this material. Teams focused on GraphQL business logic or working with limited API documentation should validate those needs before committing.