Invariant
Invariant checks network configurations against connectivity and security rules, helping network and security operators find reachability problems and securi…
What Invariant is
Invariant checks network configurations against connectivity and security rules, helping network and security operators find reachability problems and security gaps. It creates a cross-vendor network model from configuration files, without requiring direct router or switch access. Users can write policies in YAML and check network snapshots, including proposed configuration changes before deployment; results can identify policy violations and failures affecting critical flows. Scheduled scans can generate incident alerts with virtual traceroutes and virtual route-table differences. The platform offers web access, an API, a CLI and SDK, and supports a hybrid deployment. Listed protocols include BGP, OSPF, IPSec, NAT, policy-based routing, VPN, ACL and VLAN. Invariant lists Cisco, Juniper, Palo Alto and AWS among supported vendors, plus integrations such as Jenkins, GitHub Actions, LibreNMS, IPAM and SIEM workflows. The Basic account is free with effectively no usage limits. Higher tiers add SSO, support for larger device counts and early access to preview features.
Good
- Builds a network model from configuration files.
- Checks proposed changes before deployment.
- Supports scheduled scans and incident alerts.
- Basic account is free with effectively no usage limits.
- Offers CLI, SDK and API automation.
Watch out
- Fully on-premise data retention requires contacting Invariant.
- SSO is reserved for higher-tier accounts.
- Some integrations are listed as options, not included guarantees.
Who it suits
Invariant suits network and security operators who need to assess network security or evaluate changes before deployment. It may also fit teams automating validation through its CLI, SDK or API.
Verdict
Invariant combines configuration-based network analysis, policy checks and scheduled monitoring in a hybrid service. The free Basic account has effectively no usage limits, while higher tiers add SSO and larger-device-count support.
Plans and prices
From Invariant's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Basic | Free | effectively no usage limits · Basic accounts are free; the page gives no numeric price. |
The facts
Each one read from Invariant's own pages, with the date it was checked.
What it does
- Analysis
- Invariant builds its network model from configuration files and does not require direct access to routers or switches.checked 4 Oct 2026
- Automation tools
- Invariant provides a CLI, SDK, and API for automating network management and validation tasks.checked 4 Oct 2026
- Data access
- The maker says staff cannot view customer data except through special disaster-recovery accounts secured with physical tokens.checked 4 Oct 2026
- Higher tiers
- Higher-tier accounts unlock SSO, support for the highest device counts described as up to hundreds or thousands of devices, and early access to preview features.checked 4 Oct 2026
- Hosting option
- The maker says customers requiring fully on-premise data retention should contact Invariant.checked 4 Oct 2026
- Integrations
- The maker lists Jenkins, GitHub Actions, LibreNMS, Netmiko, Aerleon, Capirca, IPAM, and SIEM workflows as integration options.checked 4 Oct 2026
- Intended users
- Invariant describes its users as network and security operators who need to assess network security and safely make network changes.checked 4 Oct 2026
- Monitoring
- Invariant can receive scheduled network scans and generate incident alerts with virtual traceroutes and virtual route-table differences.checked 4 Oct 2026
- Network vendors
- The maker lists Cisco, Juniper, Palo Alto, and AWS among supported vendors.checked 4 Oct 2026
- Policy rules
- Users can define connectivity and security policies in YAML and evaluate them against network snapshots.checked 4 Oct 2026
- Pre-change checks
- Invariant can evaluate proposed configuration changes before deployment and report policy violations and critical-flow failures.checked 4 Oct 2026
- Purpose
- Invariant validates network configurations against user-provided rules in a cross-vendor digital twin to identify connectivity problems and unwanted security gaps.checked 4 Oct 2026
- Security
- Invariant says its client removes passwords and secrets from configuration files before upload, and its cloud service uses encryption and environment isolation.checked 4 Oct 2026
- Support
- The contact page lists [email protected] for technical support and says Slack is the most immediate way to reach the company.checked 4 Oct 2026
Alternatives to Invariant
- 1
PingPlotter
Free planiOSWebAPILinux8.2From $6.99 a month - 2
iPerf2
Free planOpen sourceAndroidiOSLinuxmacOS7.8Free plan - 3
GitHub CodeQL
Free planWebExtensionLinuxmacOS7.5From $30 a month - 4
Avidemux
Free planOpen sourceWebLinuxmacOSWindows7.3Free plan - 5
EVE-NG
Free planWebLinuxmacOSSelf-hosted7.0Free plan - 6
Netpicker
Free planWebAPILinuxSelf-hosted6.8From $7,500 a year