Invicti

The product has solid features for DAST and API security, and it integrates well with other tools. However, the technical support is lacking. After contacting them, they try to understand the issue, but often they can't offer a real solution. It helps us by onboarding our internal websites and API endpoints, allowing us to test them for vulnerabilities.

We've made Invicti (formerly Netsparker) our go-to Dynamic Application Security Testing (DAST) tool, and it has never disappointed. As an Information Security Specialist, I need tools that are both accurate and efficient—Invicti hits the mark on both. The scanner excels at detecting real, exploitable vulnerabilities in our web apps with very few false positives. Its automation has streamlined our testing processes, and the CI/CD integration makes it easy to embed security throughout the development lifecycle. A standout feature is its proof-based scanning, which gives clear evidence of vulnerabilities, making prioritization and remediation easier. The reporting is thorough and customizable, aiding communication with both technical and non-technical audiences. Overall, Invicti is a cornerstone of our security stack. I'd recommend it to any team seeking a robust and scalable DAST solution. The initial configuration and settings can be a bit overwhelming, though. Some menus are nested awkwardly, making it harder to locate what you need, especially when adjusting scan profiles or integrations. A more streamlined settings interface would be beneficial. The proof-based scanning is the biggest advantage, providing actionable results with minimal noise. This saves time and ensures we address real risks. It also integrates smoothly with our CI/CD pipeline, helping us shift security left and catch issues earlier in development.

I value that Invicti (formerly Netsparker) generates clean, well-structured reports that are especially suitable for ISO certifications, making the process much easier. The dynamic application testing is crucial for our ISM certification, adding significant value to our work. I'm also satisfied with the competitive pricing, which gives us essential certification through an authorized dealer without overspending. The user-friendly setup is another plus; even a novice can get the security testing software up and running quickly, which is highly efficient and lets us start operations promptly. Overall, these features make Invicti an indispensable and effective tool for our security testing and certification needs. However, I think customer support could be better. Although they offer some screen sharing support, there's room for enhancement. More robust and interactive support options, like seamless screen sharing, would be beneficial in areas like chat support. I use Invicti for dynamic application testing to support our ISM certification. It provides easy-to-read, well-formatted reports that simplify ISO certification processes and ensure compliance efficiently. The setup is straightforward, allowing quick deployment of security testing.

The accuracy and integration capabilities are outstanding. Invicti has strong integration with DevOps and CI/CD tools like Jenkins, GitLab, and Jira. While it identifies vulnerabilities well, it falls short on providing detailed, actionable remediation steps like code examples or specific fix guidance. Invicti addresses a major challenge for us by enabling web application security scanning across complex environments. It allows both security and development teams to identify, verify, and fix vulnerabilities faster and with more confidence. Many DAST tools generate false positives that cause friction between teams, but Invicti verifies actual issues by safely exploiting them, eliminating almost all false positives.

I like how simple the platform is, especially when it comes to generating reports. These options are particularly useful when we need different types of reports for various situations. With Qualys scanning, the plugin for recording login sequences was easy to set up and use. I'd like to see something similar here. Additionally, integrations with Teams or email would be beneficial. As a company that complies with SOC 2 and ISO standards, we have strict web application security policies. Invicti enables us to run monthly web scans to detect vulnerabilities in our app. The report generation is also very effective. We get an executive summary with just the scan data and vulnerability details, as well as a developer summary that we usually pass along to our development team to address the issues.

Invicti is user-friendly and fast to configure, making it simple to run monthly website checks with minimal hassle since each target is stored in its own profile. Over time, Invicti has become integral to our routine, with me conducting scans every month. When I run into problems, their support team is quick to respond and always helpful in resolving issues. One limitation is that we have trouble with API scanning, so we can't use it for that purpose. Our approach to APIs differs from how Invicti handles them, so we could never get it working despite excellent support. Regular scans with Invicti help me stay on top of our websites' security by alerting me to new releases in the software packages we use. This provides peace of mind because the software is constantly updated to tackle the latest threats. Even for products no longer in development, we can still track how outdated the packages are and remain aware of potential vulnerabilities.

For our enterprise, Invicti has provided highly accurate dynamic scan results. The findings are validated and actionable, with very little irrelevant noise. We've encountered few problems with Invicti overall. It has identified issues that our human reviewers might have overlooked, especially given the increase in AI-generated code. The precise and actionable findings have minimized our threat surface, enabling us to prioritize fixes effectively.

In my work on deep security assessments, the standout benefit of Invicti is how it combines active vulnerability scanning with dependency oversight. Unlike many tools that only look at active threats, Invicti offers the Software Composition Analysis (SCA) depth required for our enterprise-level portfolio. We leverage it to handle the security implications of complex, nested packages, ensuring we keep track of dependencies in our Java and Spring Boot setups. Its integration with our CI/CD pipelines, like Jenkins, enables automated endpoint testing across the entire application surface. What really impresses me is how accurately it identifies available endpoints without much manual setup. Instead of spending hours defining test targets, the automated crawler generates a comprehensive report that sorts issues by severity. This allows immediate prioritization of fixes rather than sifting through noise. The main hurdle we've run into is performance overhead and scalability when deploying multiple scanning agents across many applications. Running concurrent scans on enterprise microservices can cause resource consumption that leads to longer scan durations, sometimes slowing down our rapid deployment process. Also, while the automation is strong, it can demand significant manual configuration for complex authentication flows, like custom headers or multi-step SSO. Without that fine-tuning, the scanner may lack context awareness, resulting in false positives that need manual review. For a security team dealing with many vulnerabilities, investigating these non-exploitable findings can be time-consuming, reducing the efficiency of automated reporting. Previously, our security was fragmented with data from multiple tools, making it hard to see a consolidated risk view across our portfolio. Invicti changed that by integrating DAST, SAST, and SCA into one automated workflow. This has been particularly valuable for our API security and microservices architecture, where manual endpoint discovery is often error-prone and slow. The major improvement has been moving to automated Application Security Posture Management (ASPM). Instead of manually triaging findings from various sources, we now have a centralized, detailed report that helps prioritize vulnerabilities based on actual impact. As a result, team productivity has improved by reducing the security bottleneck during deployment. With automated discovery of hidden endpoints and secrets scanning, we can focus remediation where it matters and control costs by catching vulnerabilities earlier in development.

Invicti (formerly Netsparker) does a great job automating external penetration tests on our public web apps and delivering the results. It organizes the findings effectively by priority, severity, exposure, and other factors, and presents them in a user-friendly manner. I'm also keen on the API security feature, which looks promising. So far, the automated testing has performed well. The ability to logically group our applications to view risk per app is handy, and the UI is easy to navigate. It properly prioritizes and categorizes everything, making it clear which issues are most critical. The visibility into requests and responses that hint at vulnerabilities is useful for confirming their authenticity and confidence. On the downside, configuring MFA for apps with that protection was a bit tricky, and that process wasn't smooth. There's still a lot of fine-tuning needed for those scans. Overall, Invicti handles automation of external pen tests, sorts findings by severity, and presents them well, aiding in confident vulnerability validation.

What stands out to me is how straightforward Invicti (previously Netsparker) is to operate. The interface is clean and intuitive, which simplifies the entire process. Its scanning capability delivers top-tier results, especially against other tools on the market. This cuts down significantly on the time and effort I'd otherwise spend on manual checks. Getting it up and running was also a breeze. One area for improvement would be adding an alert when automated login fails, since currently there's no notification for me as the user. I rely on Invicti to swiftly pinpoint issues in our applications, and it also offers clear remediation advice. It trims the manual workload and time, and the scan outputs are consistently high-quality.