Acunetix
Acunetix, now Invicti Web + API, scans running web applications and APIs for exploitable vulnerabilities.
What Acunetix is
Acunetix, now Invicti Web + API, scans running web applications and APIs for exploitable vulnerabilities. Proof-based scanning can validate findings safely and provide evidence of exploitability, helping teams assess false positives. The product says it identifies more than 7,000 issues, including OWASP Top 10 and OWASP API Top 10 risks and business logic flaws. It supports single-page and JavaScript-heavy applications, REST, GraphQL and SOAP APIs, including authenticated user flows. Its AI-driven risk scoring uses more than 200 signals to predict risk before scanning begins. Listed integrations include Jira, Microsoft TFS (Azure DevOps), GitHub, GitLab, Bugzilla and Mantis; Acunetix Premium also integrates with Jenkins. The company describes the product as built to help small and mid-size organizations manage web security. Web + API pricing is available by quote, and the pricing page offers Proof of Concept licenses to try the complete solution in an organization's environment. The Agentic Pentest plan costs $500, paid once and covers a single application and its API suite, with audit-ready PDF reports and delivery within 24 hours.
Good
- Scans web applications and APIs for vulnerabilities.
- Validates findings with evidence of exploitability.
- Supports REST, GraphQL and SOAP APIs.
- Includes authenticated user-flow scanning.
- Integrates with listed issue trackers.
Watch out
- No free plan is listed.
- Web + API pricing requires a quote.
- FIPS certification or verification is not provided.
- Targets count subdomains and ports separately.
Who it suits
Acunetix suits small and mid-size organizations managing web security across applications and APIs. Its support for authenticated flows and listed issue-tracker integrations may fit teams incorporating vulnerability scanning into their workflows.
Verdict
Acunetix covers a broad set of web application and API testing scenarios, with proof-based validation and integrations for issue tracking. Pricing for Web + API is by quote; the separately listed Agentic Pentest option costs $500, paid once.
Plans and prices
From Acunetix's own pricing page, checked 29 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Agentic Pentest | $500, paid once | $500 max per pentest · single application and its API suite · audit-ready PDF reports · delivery within 24 hours |
| Web + API | Priced on request | Unlimited coverage · cloud hosting · on-premises marked “coming soon” · Start a quote |
The facts
Each one read from Acunetix's own pages, with the date it was checked.
Where it runs
- Application coverage
- It supports scanning single page applications, JavaScript heavy applications, REST, GraphQL, and SOAP APIs, including authenticated user flows.checked 29 Sep 2026
- Desktop platforms
- The installation guide supports Microsoft Windows and several Linux distributions, including Ubuntu, SUSE, Kali, CentOS, Red Hat, and Oracle Linux.checked 29 Sep 2026
What it does
- FIPS limitation
- Acunetix says it is compatible with systems using FIPS policy but does not have FIPS certification or verification.checked 29 Sep 2026
- Integrations
- Listed issue tracker integrations include Jira, Microsoft TFS (Azure DevOps), GitHub, GitLab, Bugzilla, and Mantis; Acunetix Premium also has Jenkins integration.checked 29 Sep 2026
- Product identity
- Acunetix is now Invicti Web + API, a dynamic application security testing product for web applications and APIs.checked 29 Sep 2026
- Proof based validation
- Proof based scanning can safely validate vulnerabilities and provide evidence of exploitability to help reduce false positives.checked 29 Sep 2026
- Risk scoring
- Its AI driven risk scoring uses more than 200 signals to predict risk before scanning begins.checked 29 Sep 2026
- Security
- Acunetix 360 On-Demand says data transfers, stored data, and backups use TLS 1.2, SSL certificates, and 256-bit AES encryption.checked 29 Sep 2026
- Support
- The pricing page says all subscriptions include standard support with rapid response times.checked 29 Sep 2026
- Target limits
- A target is defined as a fully qualified domain name, and subdomains and ports count as different targets.checked 29 Sep 2026
- Vulnerability coverage
- The product says it identifies more than 7,000 issues, including OWASP Top 10, OWASP API Top 10, and business logic flaws.checked 29 Sep 2026
- What it does
- The product scans running web applications and APIs to identify exploitable vulnerabilities.checked 29 Sep 2026
- Who it is for
- The company describes its application security testing tool as built to help small and mid-size organizations manage web security.checked 29 Sep 2026
The company
- Founded
- 2005checked 28 Sep 2026
- Headquarters
- Austin, Texas, United Stateschecked 28 Sep 2026
Money
- Trial access
- The pricing page offers no-risk Proof of Concept licenses to try the complete solution in an organization's environment before commitment.checked 29 Sep 2026
Alternatives to Acunetix
- 1
Cloudbric
Free planAndroidiOSWebAPI8.2From $2.08 a month - 2
Virusdie
Free planWebAPI7.0From $15 a month - 3
Detectify Surface Monitoring
Free planWebAPI6.9From €2,500 a year - 4
MalCare
Free planWebSelf-hosted6.9From $99 a year - 5
Astra Security
WebAPI6.5From $699 a year - 6
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month