Acunetix review

Acunetix is now Invicti Web + API, a commercial dynamic application security testing (DAST) product. It scans running web applications and APIs for vulnerabilities, so it belongs in an application security workflow alongside development and security tooling—not as a library embedded in application code. The product is aimed at discovering assets, exercising application behavior and validating whether findings are exploitable.

The homepage describes discovery across code, traffic and runtime, authenticated testing of role-based flows, stateful API testing and automated retesting after fixes. It says the scanner covers REST, GraphQL and SOAP APIs, single-page applications and LLM-powered services. Invicti also advertises risk scoring based on 200+ signals and detection of 7,000+ issues, including business logic flaws. Those are vendor claims, not independent test results. The homepage does not establish whether the scanner runs as a hosted service, a self-hosted server or another deployment model. Confirm deployment, network access and data-handling requirements with Invicti before designing a rollout.

The product scans APIs; that is different from an API for controlling scans or retrieving results. The homepage names REST, GraphQL and SOAP as formats the scanner tests, and lists integrations with CI/CD, ticketing and security tools. It also describes DAST-to-SAST correlation that maps vulnerabilities to source code. These are useful integration points, but they do not establish a particular control-plane protocol or SDK.

Before building a pipeline, ask Invicti to confirm support for a REST control API, webhooks, CLI, plugins, SDKs and your required programming languages. Confirm which integrations are native, what authentication they use and whether scan creation, status, findings and retesting can be automated. The homepage does not name SDK languages or give API examples, so check the vendor’s docs for exact interfaces and supported versions. For application coverage, the scanner advertises authenticated role-based testing, multi-step workflows and stateful API analysis. Validate how those features fit your test environments and identity setup before making them a release gate.

The pricing page lists Web + API as quote-based and does not publish monthly or annual billing terms or a standard starting price. It lists multilayer API discovery, stateful API security, LLM security, CI/CD automation and SSO for that plan. There is no free plan or free trial listed.

The separate Agentic Pentest offer is priced per pentest, with a maximum of $500 per pentest. The listed package includes an audit-ready PDF report, delivery within 24 hours, and blackbox, whitebox or graybox testing. That cap is not a Web + API subscription price.

The vendor does not publish a metering model for Web + API. Before budgeting, ask how the quote changes with targets, applications, environments, scan frequency, users and integrations, and whether any limits or overages apply. Also ask whether support, onboarding or additional capabilities cost extra. Without those terms, teams cannot estimate the bill at production scale from the public price details alone.

Invicti presents Web + API as a commercial product, not an open-source package. The vendor does not publish an open-source licence or source-availability terms on the homepage. It also does not publish deployment options there, so do not assume the scanner can run on-premises or that it is hosted-only; ask Invicti about hosting, network placement and data residency.

The homepage describes pushing validated findings into connected tools and correlating DAST with SAST, but it does not establish export formats or a migration path. Before adopting it, ask how to export findings, scan configuration, asset inventories and audit records, and whether those exports remain usable without an active subscription. Migration effort will depend on those formats and on how much workflow logic is built around Invicti-specific integrations. Get licence, retention and exit terms in writing.

Invicti advertises 99.98% confirmation accuracy for exploitable vulnerabilities and automated validation of fixes; treat these as vendor claims and confirm how validation is reported. The homepage does not publish scan-rate limits, concurrency limits or production-safety controls. Ask about scan scheduling, throttling, exclusions, retries and how to pause a scan if an application becomes unstable. Test authenticated flows and multi-step paths in a controlled environment before using results as a release gate.

One Reddit user running Acunetix 360 reports a scan producing more than 60,000 HTTP 500 responses, application crashes and app-pool recycling, even after disabling some resource-intensive checks. That is an individual report about Acunetix 360, not evidence of typical behavior across current deployments, but it is a reason to agree on safeguards and monitor the target during initial scans. Also confirm SSO, RBAC, audit logging, data retention and incident support for your deployment; the homepage lists some enterprise controls for the broader Invicti platform, not detailed production limits.