Invicti vs Acunetix in 2026: what changed and how to choose

Invicti and Acunetix are made by the same company, Invicti Security, and since 3 August 2026 Acunetix is no longer sold under its own name: it is called Invicti Web + API. So the 2026 answer to "Invicti vs Acunetix" is less "which scanner?" and more "which package of the Invicti platform?". Web + API is the dynamic-scanning package; the wider Invicti platform adds code, supply-chain and posture tooling on top.

Invicti vs Acunetix is the search for the difference between two dynamic application security testing (DAST) products from one vendor. A DAST product tests a running web application or API from the outside and reports the vulnerabilities it can confirm. This guide uses only what the vendor publishes on its own sites, docs and news pages, read on 7 October 2026. It names no prices (see the vendor's pricing page) and does not claim that either product beats anything else.

What is the difference between Invicti and Acunetix?

Historically, Invicti (formerly Netsparker) was the enterprise-oriented scanner and Acunetix the faster, simpler one for smaller teams. In 2026 the names no longer map to two separate products in the same way: Acunetix is now Invicti Web + API, and "Invicti" is the name of the platform that packages it.

The vendor's own older comparison page drew the old line plainly: Invicti was pitched at large estates that want deep integrations and heavy automation, while Acunetix was pitched at smaller teams that like to drive scans themselves. That page still carries the pre-rename names, so treat it as history. The vendor's comparison page is useful for the thinking behind each product, not for today's product names.

A short timeline from the vendor's own pages

The table below lists the dated events that matter for a buyer, each taken from a vendor announcement.

How are Invicti and Acunetix related, according to the vendor?

They sit under one parent. The vendor's comparison page calls them two different web application security products from Invicti Security. The August 2026 rename moves Acunetix into the Invicti platform's naming.

The rename announcement is careful about what it does and does not change. It says "The capabilities are the same. The team behind them is the same." For existing customers it says nothing changes on August 3, with "No disrupted workflows, no new logins, no reconfigured integrations." It describes Invicti Web + API as one of three packages within the wider platform. The announcement does not discuss deployment models or licensing, so ask the vendor about those directly.

The packages on the Invicti pricing page

The vendor's pricing page names four packages. We list them without figures, because that page is where figures live.

• Web + API is the runtime package: DAST, multilayer API discovery, stateful API security, proof-based scanning and CI/CD automation with cloud hosting. This is the former Acunetix.
• AppSec Core combines web and API testing with code and supply-chain security: SAST, IaC scanning, SCA, container security, SBOM and vulnerability management.
• AppSec Flex builds on AppSec Core with custom roles, CSPM integration and flexible deployment, including on-premises, air-gapped and multi-cloud options.
• Agentic Pentest is the AI-led option: the vendor scopes it to one application and its APIs and promises audit-ready reports.

The Invicti documentation site also lists Invicti Enterprise and Invicti Standard, with on-demand and on-premises variants, role-based access control, API security tooling and an interactive testing (IAST) feature called Invicti Shark. Those long-running product lines have their own documentation, separate from the newer platform docs. If you already run one of them, ask your account team how it maps to the packages above.

Invicti vs Acunetix: how do the features compare?

On the vendor's current pages, proof-based DAST for web applications and APIs is the shared core. The platform packages add code-side coverage, posture management and enterprise controls. Table 1 compares Invicti Web + API (formerly Acunetix) with the broader Invicti platform packages.

Table 1: Invicti Web + API versus the wider Invicti platform

Read the "not in this package" cells as packaging, not as shortcomings. The pricing page states what each package includes; it is the buyer's job to decide which parts of the pipeline need covering.

What the vendor says about accuracy

The vendor makes several performance claims on its pages. They are the vendor's claims, so test them yourself. The Invicti Web + API page cites "99.98% Confirmation accuracy for exploitable vulnerabilities", "8x Faster scanning compared to leading competitors" and "40% More vulnerabilities found compared to other leading DAST products".

The vendor also reports that, in the Miercom DAST Scanner Security Benchmark 2026, it "detected all 31 critical vulnerabilities" across 11 intentionally vulnerable applications. The write-up does not say who commissioned the benchmark. Treat the result as vendor-reported and run your own bake-off, as described in the how-to-choose section.

What do the docs say about logins, integrations and reports?

The documentation is where the products differ in detail, and it is the best place to check your own stack before a trial. The points below come from the vendor's Acunetix documentation, which is now presented under the Invicti Web + API name, and from the Invicti documentation site.

Scan authentication

The Acunetix documentation lists form authentication with a recorded login sequence, plus HTTP Basic, Digest, NTLM and Kerberos, OAuth2 and client certificates. Two-factor authentication is covered for user accounts. For scan sessions, the question is not whether a method is listed but whether your own login flow survives a full scan, so test the exact flow you use in production.

The Invicti platform page also covers a different login: your staff signing in to the platform itself, through identity providers such as Okta, Azure Active Directory and PingFederate, or through SAML single sign-on. That decides who may use the tool, not how the tool signs in to your application. Keep the two questions apart when you read a feature list.

Integrations and reports

The Acunetix documentation lists issue trackers (Jira, Azure DevOps, GitHub, GitLab, Bugzilla, ServiceNow), CI/CD systems (Jenkins, GitLab CI/CD, Azure Pipelines, CircleCI), chat tools (Slack, Microsoft Teams) and DefectDojo for vulnerability management. It also lists pre-built reports for OWASP Top 10, PCI DSS, HIPAA, ISO 27001 and NIST SP 800-53. Invicti's pages describe integrations with CI/CD tools such as Jenkins, GitHub Actions, GitLab and Azure Pipelines, and with Jira, ServiceNow, Slack and Microsoft Teams. The sets overlap heavily, so the deciding factor is usually one specific tool in your pipeline.

A report that maps findings to a standard helps an audit conversation, but it is not proof of compliance. If you buy for audit evidence, read our notes on PCI DSS and SOC 2 expectations and ask what your auditor will accept.

Who should choose Invicti, and who should choose Invicti Web + API (Acunetix)?

Choose by the size of the programme around the scanner, not by the logo. If the job is "scan our web apps and APIs and send confirmed findings to developers", Web + API is the package named for it. If the job also covers code, dependencies, containers and one view of risk, the wider platform packages are the fit.

When Invicti Web + API (formerly Acunetix) fits

A small team that wants runtime testing without extra modules

Historically the pitch was simplicity for teams with no dedicated security group, and the vendor still describes the product as built for "accurate, fast DAST". Web + API covers authenticated testing, API scanning, CI/CD hooks and reporting.

A team that wants source-aware scanning on a few stacks

AcuSensor is the product's instrumentation option. The vendor documents installation for PHP, .NET, Java and Node.js. If your apps run on one of those stacks, include an instrumented scan in the trial. It can add detail that a purely outside-in scan cannot.

When the wider Invicti platform fits

A team with many apps and a central security function

AppSec Flex is where the vendor places custom roles, flexible deployment and CSPM integration. If you must run on-premises or air-gapped, the pricing page names that package. Those controls matter more once several teams share one instance.

A team that wants runtime and code findings together

AppSec Core adds SAST, software composition analysis, IaC, secrets and container scanning. The vendor also announced DAST-to-SAST correlation, which links a confirmed runtime finding to the code behind it. If your backlog is mostly "which of these 4,000 static alerts is real?", that correlation is the feature to test.

A team that wants AI-led testing beside the scanner

Agentic Pentest is a separate package. The vendor describes autonomous reconnaissance, parallel AI agents across classes such as SQL injection, SSRF and deserialisation, and validated findings with proof. The launch post also lists scope enforcement and rate limiting. Compare it against other options in our best AI pentesting tools guide.

Is Acunetix discontinued, and what should existing customers do?

No. The vendor's wording is a rename, not a retirement: capabilities and team are "the same", and nothing changes for customers on 3 August. The acunetix.com home page now opens with "Acunetix is now Invicti Web + API" and uses "formerly Acunetix" beside the new name.

Three practical steps follow. First, check your contract and invoices for the new name so procurement records match. Second, ask your account team how the product maps to the four named packages. Third, confirm your deployment model in writing, because the rename post does not address it. Anyone comparing quotes should also read our Acunetix alternatives guide, which covers other vendors.

What does any DAST package still leave for your team?

A DAST package finds what it can test and confirm from outside. It does not know your business rules, who should see which record, or whether the fix you shipped really closed the hole. These gaps apply to every scanner, not only the two in this guide.

The stakes explain why teams keep layering tools. The Verizon 2026 Data Breach Investigations Report says 31% of breaches now start with software vulnerabilities, "beating stolen passwords as the top way attackers get in". The CISA Known Exploited Vulnerabilities catalog showed 1,734 entries when we read it on 7 October 2026, and each is a flaw that has been exploited in the wild. The IBM Cost of a Data Breach Report 2026 calls the global average cost a record high, up 12% on the previous year.

Access control is the example that matters most

The OWASP Top 10:2021 ranks broken access control first. OWASP reports that "94% of applications were tested for some form of broken access control", with 34 CWEs mapped to the category. Whether account A may read account B's invoice is a rule only your team can state, so a scanner needs your input to check it. Both product lines touch on it: Invicti names BOLA and BFLA detection, and Acunetix lists role-based user flows. The open question for you is how much set-up it takes on your apps.

Four gaps to plan for with any scanner

• Your rules. Pricing, limits, approvals and business-logic flaws need test cases written against how your product should behave.
• Cross-account access. Checking what one signed-in account can reach that it should not takes at least two accounts per role and a clear plan. See why your scanner has one login.
• Proof you can read. Ask for the request, the response and, ideally, the line of code. See how to read a finding.
• A verified fix. A fresh scan shows the issue is gone from that scan. Re-running the exact exploit shows the same hole is closed; see closed-loop retest.

Where does Cyberlop fit next to Invicti and Acunetix?

Cyberlop is a different kind of tool, so it is better seen as an option beside a scanner than a replacement for one. Cyberlop finds vulnerabilities in web apps and their APIs with black-box, grey-box and white-box pentesting.

In white-box mode it reads your code while testing the running app, so a finding can point to the file and line. It reports what it actually exploited: each finding carries the request, the response, a screenshot where a person can see it, and the line of code. Severity and confidence are kept apart, and findings carry CWE and OWASP references.

It checks business-logic flaws and cross-account access, and it proves a fix by re-running the exact exploit against the new code. It can run inside your own network (private scanning), on a schedule or in CI/CD with a build gate, and agencies can run it under their own brand. See how it works and a real finding. Many teams will keep a DAST package for broad, repeatable coverage and add a proof-led pentest for the flaws a scanner cannot know to look for.

How do you choose between Invicti and Acunetix?

Choose in two steps. First fix the scope you need covered. Then trial each option on one real application against the same checklist. The questions below turn that into criteria you can score.

Table 2: Six decision criteria

A four-week trial, step by step

1. Pick one staging app. Use test data and a backup, because scanners send state-changing requests.
2. Seed known issues. Write down flaws you already know, so you can measure what each tool finds and misses.
3. Set up logins. Time how long authentication takes and whether the session survives the whole scan.
4. Import your API definitions. Count the endpoints each tool actually exercises, not the ones it lists.
5. Run it in CI. Record scan time and check you can fail a build on a threshold.
6. Triage the output. For each finding, ask for the request and response, and note how many a developer could fix without a meeting.
7. Score and decide. Weight the six criteria in Table 2 and pick the option that wins on the ones you care about.

What a good trial result looks like

A good result is not the longest list. It is a short list where each item reproduces, has a clear owner and survives a retest. Our guide to the best DAST tools sets out how to compare more vendors, and DAST vs SAST vs IAST explains how the testing types fit together. If a result sounds certain but cannot be reproduced, treat it as a false positive until proven otherwise; exploited, not suspected explains why that matters.

The naming map in one view

Because the names changed, keep this map beside your notes when you read older reviews and forum threads.

Older reviews that say "Invicti vs Acunetix" were written before the rename. Read them as comparing Invicti Enterprise or Standard (formerly Netsparker) with the product now called Invicti Web + API.