No more typing reviews! Try our Samantha, our new voice AI agent.
Invicti Logo

Invicti Reviews

Vendor: Invicti
4.1 out of 5
Leave a review

What is Invicti?

Invicti offers advanced web application security testing focused on identifying vulnerabilities like SQL injection and cross-site scripting. Its Proof-Based Scanning minimizes false positives and integrates seamlessly with CI/CD pipelines, making it an effective tool for enterprise environments.

Get the Invicti Buyer's Guide and find out what your peers are saying about Invicti, SonarQube, Snyk and more!
Invicti is the #4 ranked solution in top Dynamic Application Security Testing (DAST) solutions, #5 ranked solution in top Application Security Posture Management (ASPM) solutions, #8 ranked solution in top Software Composition Analysis (SCA) solutions, #8 ranked solution in API Security Solutions, #10 ranked solution in AST tools, and #24 ranked solution in Container Security Solutions. PeerSpot users give Invicti an average rating of 8.2 out of 10. Invicti is most commonly compared to SonarQube: Invicti vs SonarQube. Invicti is popular among the large enterprise segment, accounting for 47% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 16% of all views.
Buyer's Guide
Invicti
April 2026
Get the report
Helped 892,287 peers since 2012

Featured Invicti reviews

Read more reviews

Invicti mindshare

Product category:
Dynamic Application Security Testing ...
As of April 2026, the mindshare of Invicti in the Dynamic Application Security Testing (DAST) category stands at 8.8%, up from 6.3% compared to the previous year, according to calculations based on PeerSpot user engagement data.
Dynamic Application Security Testing (DAST) Mindshare Distribution
ProductMindshare (%)
Invicti8.8%
Veracode16.6%
Checkmarx One15.3%
Other59.3%
Dynamic Application Security Testing (DAST)

PeerResearch reports based on Invicti reviews

TypeTitleDate
CategoryDynamic Application Security Testing (DAST)Apr 29, 2026Download
ProductReviews, tips, and advice from real usersApr 29, 2026Download
ComparisonInvicti vs VeracodeApr 29, 2026Download
ComparisonInvicti vs Checkmarx OneApr 29, 2026Download
ComparisonInvicti vs OpenText Dynamic Application Security TestingApr 29, 2026Download
Suggested products
TitleRatingMindshareRecommending
SonarQube4.0N/A84%136 interviewsAdd to research
Snyk4.1N/A100%51 interviewsAdd to research
 
 
Key learnings from peers

Valuable Features

Invicti's most valuable features include comprehensive scanning, proof-based scanning, and robust vulnerability detection. It efficiently integrates with security tools for seamless management. Its user-friendly interface aids in vulnerability analysis and reduces false positives. Invicti excels in confirming vulnerabilities like SQL injection and cross-site scripting. Scalable for enterprises, it supports larger assessments without performance issues. The API testing and flexible authentication enhance testing across various applications, offering thorough protection and supporting proactive DevOps integration.
  • "The solution generates reports automatically and quickly and it's a very user-friendly product."
  • "It is a very good tool."
  • "I would tell potential users that it's really one of the best products in the market for web application security or Dynamic Application Security Testing (DAST)."

Room for Improvement

Invicti users note slow scanning speed, particularly with large applications, impacting other program performance and increasing CPU usage. The interface is considered cluttered, and there are issues with proof of concept verification during scans. Authentication features, multi-factor integration, and license flexibility need enhancement. Users seek better reporting options, broader vulnerability detection, and support for DB2 databases. SSO integration is lacking, and improved support documentation is requested. Pricing is considered high compared to competitors.
  • "I find that the scannings are not sufficiently updated."
  • "Reporting should be improved. The reporting options should be made better for end-users."
  • "Netsparker is one of the costliest products in the market. The licensing is tied to the URL, and it's restricted."

Pricing

Invicti's pricing appeals to enterprise buyers seeking a flexible and competitive solution in the security market. While some report it as costly, especially for small to medium businesses, large enterprises find it aligns well with budget expectations. Offering per-user and per-year licensing models, the solution supports flexible options. Despite high costs for advanced features, Invicti remains competitive against alternatives like Acunetix and WebInspect. Setup and licensing generally fall within acceptable limits for most organizations.
  • "The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."
  • "Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."
  • "We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."

Popular Use Cases

Invicti is primarily utilized for automated web application security testing, focusing on identifying vulnerabilities such as SQL injection, XSS, and CSRF. It supports continuous penetration testing, vulnerability assessment, and compliance with regulations like PCI DSS and GDPR. Users leverage it to scan and secure web applications, APIs, and endpoints, generating detailed reports and improving security measures. It offers dynamic and static security testing and facilitates vulnerability remediation and prioritization.

Service and Support

Invicti's customer service and support receive high praise for professionalism and responsiveness, with ratings often reaching 8 or 9 out of 10. Technical support is detailed, offering demos and resolving issues efficiently. There are occasional language challenges but generally praised for swift issue resolution through multiple channels, including emails, social media, and active Google groups. Regional support varies, engaging local partners effectively, while direct technical support remains prompt and thorough in addressing queries.

Deployment

Invicti's initial setup is described as straightforward and user-friendly, with clear instructions minimizing guesswork. Many highlight the ease of installation across different environments, whether cloud-based or on-premises. Comprehensive documentation aids in configuration and integration with other tools, streamlining the process. Some note that enterprise environments or advanced features require additional steps but find these manageable with provided guides. Users emphasize the simplicity and quick configuration, making Invicti accessible for varied technical backgrounds.

Scalability

Invicti demonstrates strong scalability, handling large-scale web applications effectively. Multiple users highlight its ability to run concurrent instances and its adaptability to various platforms. Some note trade-offs between speed and accuracy, while deployment on larger networks shows promising scalability. Ratings commonly range from eight to 9.5 out of ten, affirming its ability to meet growing organizational needs without major issues. Occasional performance slowdowns during heavy operations are mentioned, but are not widespread concerns.

Stability

Invicti demonstrates strong stability, handling complex scanning with minimal downtime. Many praised its consistent performance, rating it highly, often 8 to 10 out of 10. Users noted it as stable, with rare crashes, no significant issues, and efficient resource management. Frequent updates and a robust architecture enhance functionality. However, some mentioned it could slow other processes, especially during resource-intensive operations, but it remains highly reliable for web application security tasks.
These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.
Download our Invicti Buyer's Guide for additional reliable information.

Review data by company size

By reviewers
Company SizeCount
Small Business11
Midsize Enterprise3
Large Enterprise12
By reviewers
By visitors reading reviews
Company SizeCount
Small Business135
Midsize Enterprise78
Large Enterprise191
By visitors reading reviews

Top industries

By visitors reading reviews
Financial Services Firm
16%
Manufacturing Company
9%
Computer Software Company
7%
Government
6%
Comms Service Provider
5%
Retailer
5%
Construction Company
4%
Transportation Company
4%
University
3%
Legal Firm
3%
Healthcare Company
3%
Outsourcing Company
3%
Educational Organization
3%
Real Estate/Law Firm
3%
Energy/Utilities Company
2%
Recreational Facilities/Services Company
2%
Performing Arts
2%
Insurance Company
2%
Marketing Services Firm
2%
Wholesaler/Distributor
2%
Media Company
2%
Non Tech Company
2%
Religious Institution
2%
Security Firm
1%
Consumer Goods Company
1%
Leisure / Travel Company
1%
Wellness & Fitness Company
1%
Non Profit
1%

Compare Invicti with alternative products

Go!

Learn more about Invicti

Invicti provides comprehensive scanning capabilities that include detecting and verifying critical vulnerabilities and security data consolidation. Its scalable scanning engine and robust API support allow for flexible testing across diverse environments, including web and API testing. Despite some drawbacks like limited single sign-on integration and slow scanning speeds for large applications, Invicti remains a popular choice for automating security assessments, ensuring compliance with standards like OWASP Top 10, PCI DSS, and GDPR.

What are the key features of Invicti?
  • Comprehensive Vulnerability Scanning: Detects vulnerabilities like SQL injection and XSS.
  • Proof-Based Scanning: Confirms exploitability and reduces false positives.
  • CI/CD Integration: Seamlessly integrates with development pipelines.
  • Security Data Consolidation: Centralizes data for better insights.
  • User-Friendly Interface: Facilitates easy analysis and reporting.
  • Scalable Scanning Engine: Supports testing in enterprise environments.
  • Robust API Support: Enhances flexibility in testing.
What benefits and ROI should users look for in reviews?
  • Proactive Security: Actively identifies and verifies vulnerabilities to prevent breaches.
  • Regulatory Compliance: Helps maintain compliance with standards like PCI DSS and GDPR.
  • Efficient Vulnerability Management: Aids in prioritizing remediation efforts.
  • Integration Capabilities: Streamlines processes with CI/CD pipeline compatibility.

In industries like finance, healthcare, and e-commerce, Invicti is implemented to bolster security through automated vulnerability assessments. Its ability to provide insightful reports and remediation suggestions assists companies in efficiently managing security risks and achieving compliance with critical regulatory standards.

Invicti was previously known as Netsparker.

Invicti customers

Samsung, The Walt Disney Company, T-Systems, ING Bank

Related questions

  • 32
When evaluating Dynamic Application Security Testing (DAST), what aspect do you think is the most important to look for?
  • 38
Why is Dynamic Application Security Testing (DAST) important for companies?

Product Categories

Product Categories
Dynamic Application Security Testing (DAST)
Static Application Security Testing (SAST)
Container Security
Software Composition Analysis (SCA)
API Security
Application Security Posture Management (ASPM)

Popular Comparisons

Popular Comparisons
SonarQube vs Invicti Logo
SonarQube vs Invicti
Snyk vs Invicti Logo
Snyk vs Invicti
Checkmarx One vs Invicti Logo
Checkmarx One vs Invicti
GitLab vs Invicti Logo
GitLab vs Invicti
Veracode vs Invicti Logo
Veracode vs Invicti
Imperva Application Security Platform vs Invicti Logo
Imperva Application Security Platform vs Invicti
CrowdStrike Falcon Cloud Security vs Invicti Logo
CrowdStrike Falcon Cloud Security vs Invicti
Orca Security vs Invicti Logo
Orca Security vs Invicti
TrendAI Vision One – Cloud Security vs Invicti Logo
TrendAI Vision One – Cloud Security vs Invicti
Coverity Static vs Invicti Logo
Coverity Static vs Invicti
Acunetix vs Invicti Logo
Acunetix vs Invicti
Mend.io vs Invicti Logo
Mend.io vs Invicti
OpenText Core Application Security vs Invicti Logo
OpenText Core Application Security vs Invicti
PortSwigger Burp Suite Professional vs Invicti Logo
PortSwigger Burp Suite Professional vs Invicti
OWASP Zap vs Invicti Logo
OWASP Zap vs Invicti
See all alternatives
 
Invicti Reviews Summary
Author infoRatingReview Summary
Senior Manager, Security Engineering at ESS4.0I've used Invicti for over three years for web and API testing; it's reliable in identifying vulnerabilities, though scan performance needs improvement. Setup is easy, support is good, and it's well-suited to our SSDLC and technology stack.
Solution Architect at a tech services company with 51-200 employees4.0I've used Invicti for three years to secure web applications; it’s easy to deploy, scalable, and offers effective SAST and DAST scanning, with solid vulnerability detection and good support, especially for SMBs in hybrid environments.
Capability Center Leader, ETRM Platforms at Shell4.0I use Invicti for code scans to identify vulnerabilities and secrets, aiding our development teams in prioritizing tasks. Its proactive scanning is valuable, though its reporting needs improvement for enterprise-level insights. Invicti was my first such tool.
Cyber Security Engineer at Spartec5.0I primarily use Netsparker for website scanning, appreciating its interactive interface and scalability for securing large-scale applications. Previously, I used Tenable.io but found Netsparker more engaging. There's currently nothing I wish to improve about it.
CEO at Xcelliti3.5We use Invicti for vulnerability testing, especially in fintech. It excels in proof-based scanning with minimal false positives, integrates well with CI/CD pipelines, and offers good scalability. However, improvements are needed in user interface, documentation, and support.
Senior Manager, Security Engineering at ESS4.0I use Invicti primarily for web application and API testing. I find its API testing and false positive checks valuable, though improvements in scanning time and authentication features are needed. I also use Burp Suite and HCL AppScan for specific tasks.
Senior Information Security Analyst at EastNets Holding Ltd.4.5We use Invicti to initialize applications before client release, deploying and scanning for specific server issues, language, and vulnerabilities. Its strengths are confirming access and SSL injection vulnerabilities and connecting with other security tools. However, report specificity needs improvement.
Presales Consultant at Cyberwise4.0We use Invicti to detect vulnerabilities and ensure compliance with regulations like PCI DSS and GDPR. Its proof-based scanning reduces false positives and saves time. However, the costly licensing, lengthy scan times, and need for more integrations are drawbacks.