Acunetix (now Invicti Web + API) - Automated Web Application & API Security Scanner
Acunetix, now marketed by Invicti as Invicti Web + API, is a DAST solution that automatically scans web applications and APIs for over 7,000 vulnerabilities - including SQL injection, XSS, and business logic flaws. Invicti states 99.98% confirmation accuracy for exploitable vulnerabilities.
Built for Security Teams That Demand Results
SecOpsTool partners directly with Invicti to provide Invicti Web + API (formerly Acunetix) licences, professional onboarding, integration support, and ongoing expert guidance - ensuring you get the maximum return from your security investment.
Request 14-Day Free Trial →Use Cases
- Web application audits
- API security testing
- Continuous compliance scanning
- Pre-release security gates
- E-commerce security
- SaaS application testing
Compliance & Standards
Everything You Need from Acunetix
Comprehensive features designed to accelerate your security programme and reduce risk across the entire development lifecycle.
DeepScan Technology
DeepScan is a DOM parser built on an improved Chromium engine that crawls JavaScript-heavy SPAs and discovers Angular, React and Vue applications, executing JavaScript as a real browser would.
7,000+ Vulnerability Checks
Tests for SQLi, XSS, SSRF, XXE, open redirects, insecure deserialization, and many more - with constantly updated checks.
Authenticated Scanning
Scans authenticated application areas using recorded login sequences and session tokens, so testing covers the real app and not just the login page.
REST & SOAP API Testing
Imports OpenAPI/Swagger specs and WSDL files for comprehensive API-specific vulnerability testing.
AcuSensor (IAST)
Optional AcuSensor component provides internal application data to the scanner for applications built in Node.js, PHP, Java (including Spring), and ASP.NET, turning the scanner into a grey-box IAST solution without requiring source code changes.
CI/CD & Issue Tracker Integration
Integrates with Jenkins, GitLab, Jira, GitHub Issues, and Azure DevOps for automated scanning and vulnerability ticket creation.
Is Acunetix (now Invicti Web + API) Right for Your Team?
Invicti describes the product formerly known as Acunetix, now sold as Invicti Web + API, as used by companies including Cisco, NASA and Visa. It names CTOs, CISOs, engineering managers, security engineers and DevSecOps teams across IT and telecom, government, financial services, education and healthcare as its users.
Who uses Acunetix (now Invicti Web + API): Invicti Security names Fluidra, ISACA, LeoVegas Mobile Gaming Group, Channel 4 Television, Wellcome Trust Sanger Institute, Park 'N Fly, Inc., ING Bank and Oakland University among its customers on its own website.
Acunetix (now Invicti Web + API) Is a Good Fit For
- Security engineers and DevSecOps teams who need proof-based confirmation of exploitable vulnerabilities before findings reach developers
- CTOs and CISOs in IT and telecom, government, financial services, education and healthcare who need audit-ready compliance reports
- Teams testing modern JavaScript-heavy applications, including single-page apps built with Angular, Vue or React
- Teams that need to discover and test REST, SOAP and GraphQL APIs, including undocumented endpoints, alongside their web applications
Why Teams Choose Acunetix (now Invicti Web + API)
- Cut through false positives with proof-based scanning that confirms exploitable vulnerabilities instead of only flagging them
- Test running applications and APIs from the outside in, the way an attacker would, including authenticated areas
- Add IAST-level accuracy with the optional AcuSensor component, without changing your source code
- Generate report templates mapped to OWASP Top 10, PCI DSS, ISO 27001, HIPAA and NIST SP 800-53 directly from scan results
What You Gain with Acunetix (now Invicti Web + API)
Proof-based validation
Invicti's proof-based scanning finds validated vulnerabilities with proof of exploit, which the vendor states gives 99.98% confirmation accuracy for exploitable vulnerabilities.
DeepScan crawling for modern web apps
DeepScan is a DOM parser built on an improved Chromium engine that crawls HTML5 sites and single-page applications, executes JavaScript like a real browser and discovers Angular, Vue and React frameworks.
AcuSensor for IAST-level accuracy
The optional AcuSensor component turns the scanner into a grey-box IAST solution for applications built in Node.js, PHP, Java (including Spring) and ASP.NET, without requiring source code changes.
Wide vulnerability coverage
Invicti states the scanner can identify 7,000+ issues, including OWASP Top 10, OWASP API Top 10 and business logic flaws.
REST, SOAP and GraphQL API testing
The scanner imports Swagger/OpenAPI, WSDL, WADL, Postman and GraphQL definitions and can discover hidden or undocumented API endpoints while it scans.
Built-in compliance reporting
Documented report types map findings to PCI DSS, OWASP Top 10, ISO 27001, HIPAA, NIST SP 800-53, DISA STIG and the CWE Top 25, alongside developer and executive summary reports.
Acunetix (now Invicti Web + API): Supported Languages and Integrations
Scan Targets & Technologies
This list combines what Invicti names for DeepScan crawling, CMS testing and the optional AcuSensor IAST component (Node.js, PHP, Java with Spring, and ASP.NET). As a DAST tool it tests running applications rather than source code, so coverage is not limited to a fixed language list.
Integrations
Issue trackers
CI/CD
Web Application Firewalls
API and cloud
Lists follow the vendor's published documentation as checked in September 2026. Support varies by version and edition, so ask us to confirm your exact stack.
Acunetix (now Invicti Web + API) Price, Licence Cost and Free Trial in India
Invicti does not publish list prices for Web + API (formerly Acunetix); it states that customers should pay based on their security needs rather than a fixed price list. SecOpsTool supplies licences in India and prepares a quotation for your team.
How Acunetix (now Invicti Web + API) Licensing Works
- Invicti does not publish prices for Web + API: pricing is by quotation
- Invicti does not publish prices for Invicti Web + API (formerly Acunetix): pricing is by quotation
- Invicti offers the product as Cloud Hosting today; its own pricing page lists on-premises deployment as coming soon
- Invicti's own trial route is a Proof of Concept licence or a demo request, rather than an instant self-service download
Get an Acunetix (now Invicti Web + API) Quotation or Trial
- Written price quotation for your team size, usually within 24 hours
- 14-day Acunetix / Invicti Web + API trial licence arranged for your team
- Help with download, installation and your first scan
- Licences, renewals and support from one partner in India
Acunetix (now Invicti Web + API): Pricing, Trial and Product Questions
Invicti does not publish prices for Web + API (formerly Acunetix), so there is no list price to quote. Tell us your team size, the applications and APIs you need to scan, and whether you need on-premises or cloud hosting, and SecOpsTool provides a written quotation, usually within 24 hours.
Use the form on this page and choose Price quotation. Tell us your team size and the modules or licence type you need, and SecOpsTool sends a written Acunetix (now Invicti Web + API) quotation, usually within 24 hours.
Invicti's own site offers a Proof of Concept licence or a demo request rather than an open trial download. SecOpsTool arranges a 14-day trial licence for teams in India, together with help setting up your first scan.
The vendor now markets it as Invicti Web + API. Invicti's site states that Acunetix is now Invicti Web + API, built on the earlier Acunetix legacy, so we refer to it by both names to keep it easy to find.
It is a DAST scanner that tests running web applications and APIs, including single-page apps built with Angular, Vue or React, REST, SOAP and GraphQL APIs, and CMS platforms such as WordPress, Joomla and Drupal.
Invicti states its proof-based scanning gives 99.98% confirmation accuracy for exploitable vulnerabilities, and the optional AcuSensor component adds IAST-level accuracy for Node.js, PHP, Java (Spring) and ASP.NET applications.
Invicti's documented report types include PCI DSS, OWASP Top 10, ISO 27001, HIPAA, NIST SP 800-53, DISA STIG, the CWE Top 25 and the Sarbanes-Oxley Act, alongside developer and executive summary reports.
Get an Acunetix (now Invicti Web + API) Price Quote or 14-Day Free Trial
Evaluate Acunetix on your own code for 14 days, with our engineers on hand. Our security engineers will onboard you and ensure you get maximum value from day one.
- 14-day trial licence arranged for your team
- Dedicated onboarding by certified security experts
- Integration support for your existing CI/CD pipeline
- Post-trial assessment report included
Request a Quote or Free Trial
Tell us what you need. We reply within 24 hours with your quotation or trial licence.