PAGES
← all tools
◆ Web Application Security

Acunetix 360

changelog-20261023-217daab0 commercial

Acunetix 360 scans web applications and APIs to identify security vulnerabilities through automated testing.

Summary

Acunetix 360 is a commercial web application vulnerability scanner run as a hosted service, aimed at application developers and security teams responsible for finding and fixing flaws before release. It validates credentials before a full scan starts and supports interactive MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. logins, so authenticated scanning works against targets that would otherwise block automated tools, and it retains sitemap and scan data for up to 730 days for ongoing analysis rather than one-off snapshots. It sits in the web-app-security category, alongside other scanners that developer and AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. teams use to test running applications rather than source code. Its agents and Auth Verifier Service run on .NET 10 for long-term support, and its API now accepts partial updates to scan profiles and policies without resubmitting full configurations. Launched in 2018 and still shipping regularly, with its most recent release 24 days ago.

Acunetix 360 scans web applications and APIs to identify security vulnerabilities through automated testing.

How Acunetix 360 helps

Which vulnerabilities exist in this web application before it ships?

crawls and tests the running application and its APIs against a battery of automated attack checks, reporting each flaw found so it can be fixed before release

Why is a scan failing to authenticate against this target?

validates the supplied credentials, including interactive multi-factor logins, before the full scan starts, so a login problem surfaces immediately instead of showing up as an empty or incomplete result

How did this application's exposure change since last quarter's scan?

keeps sitemap and scan data for up to 730 days, so past crawls and findings stay available to compare against a new run rather than being discarded after each scan

Where exactly did an authentication check go wrong for a particular login flow?

can capture the full request and response exchange during the authentication check into a HAR file, opt-in, for inspecting what the login sequence actually sent and received

Can I update a scan profile's settings without resubmitting its whole configuration?

accepts partial updates to scan profiles and policies through its API, changing only the fields supplied and leaving the rest of the configuration untouched

all 7 features, with the evidence for each →

Languages

Not documented

Features

7 capabilities

Built from Acunetix 360's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • Acunetix 360 covers 2 of the 8 vulnerability assessment methods capabilities we track.

What Acunetix 360 offers you

  • Multi-factor authentication1
  • Role-based access control1
  • REST API
All capabilities 7 capabilities
Authenticated scanning shipped Supports scanning targets that require login, including pre-scan credential validation, multi-factor authentication, and OAuth2 login flows. 6 releases · 3 other sources · first seen Jun 2026

Shared capability: Credentialed vulnerability scanning

Also counts toward: Multi-factor authentication

release

  • Adds ability to use secrets within custom authentication scripts for web application scans. v26.9.1 – 24 Sep 2026 (2026-09-24) · Sep 2026 · source · release history
  • Adds support for secrets in custom authentication scripts, enabling secure credential handling during authenticated scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ v26.9.1 – 24 Sep 2026 (2026-09-24) · Sep 2026 · source · release history
  • Adds opt-in HAR file generation for auth verification v26.8.1 – 27 August 2026 (2026-08-27) · Aug 2026 · source · release history
  • Extends scan data retention configuration to up to 730 days (two years), providing longer access to historical scan results. changelog · Aug 2026 · source · release history
  • New pre-scan authentication validation checks that credentials are working before a full scan begins. v26.6.1 – 16 June 2026 (2026-06-16) · Jun 2026 · source · release history
  • New interactive MFA login support enables authenticated scanning of targets protected by multi-factor authentication. v26.6.1 – 16 June 2026 (2026-06-16) · Jun 2026 · source · release history

docs

  • The latest release adds opt-in HAR file generation for auth verification, fixes DB transactions, login paste, and scan agent failover. Generate HAR files option for authentication verification: Added an opt-in Generate HAR files option for authentication verification. changelog · Sep 2026 · source
  • The latest release includes OAuth2 and interactive login fixes, security updates, PDF report improvements, and scheduled scan profile corrections. changelog · Jul 2026 · source

example

  • Enable HAR file capture during authentication verification to inspect auth flows and diagnose credential or session issues. In the scan or authentication settings, locate 'Generate HAR files' under authentication verification and toggle it on. changelog · Sep 2026 · source
Scan data retention period shipped Allows configuration of the historical scan results storage duration, extending support up to two years (730 days). 5 releases · 1 other source · first seen Aug 2026

release

  • Extends the configurable retention period for scan data stored in Acunetix 360. v26.9.1 – 24 Sep 2026 (2026-09-24) · Sep 2026 · source · release history
  • Extends scan data retention, allowing scan results to be stored for longer periods. v26.9.1 – 24 Sep 2026 (2026-09-24) · Sep 2026 · source · release history
  • Extends scan data retention configuration to up to 730 days (two years), providing longer access to historical scan results. changelog · Aug 2026 · source · release history
  • Adds 730-day scan data retention to store historical scan results for longer periods. v26.8.0 – 13 August 2026 (2026-08-13) · Aug 2026 · source · release history
  • Extends scan data retention to 730 days. v26.8.0 – 13 August 2026 (2026-08-13) · Aug 2026 · source · release history

example

  • Verify that historical scan data is now retained for up to two years by checking the storage duration setting. Inspect the scan configuration or storage settings in the Acunetix dashboard to confirm the `730-day` retention period is applied. v26.8.0 – 13 August 2026 (2026-08-13) · Aug 2026 · source
PolyShell vulnerability detection shipped Adds a security check to detect Polyglot XSS vulnerabilities within scan profiles. 1 release · 1 other source · first seen Sep 2026

Shared capability: Web vulnerability scanning

release

  • Adds a new PolyShell security check to detect Polyglot XSS vulnerabilities. v26.9.1 – 24 Sep 2026 (2026-09-24) · Sep 2026 · source · release history

example

  • Access the new PolyShell check definition in the UI to verify it is enabled for a specific scan profile. In the Acunetix 360 console, go to Scan Profiles > Advanced Settings and locate the 'PolyShell' check under security checks. v26.9.1 – 24 Sep 2026 (2026-09-24) · Sep 2026 · source
Scan notification routing shipped Allows custom roles to send scan notifications to external recipients without requiring full access to all organisational notifications. 1 release · first seen Oct 2026

Also counts toward: Role-based access control

release

  • Enables custom roles to send scan notifications to external recipients without granting full access to all organizational notifications. changelog · Oct 2026 · source · release history
Scan profile cloning shipped suggested Allows scan profiles to be cloned to different targets so that scan configuration can be reused across multiple websites without manual setup. 1 release · first seen Oct 2026

Suggested capability: Web vulnerability scanning. This is our guess, not confirmed.

release

  • Adds the ability to clone scan profiles to different targets, enabling configuration reuse across multiple websites without manual setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ changelog · Oct 2026 · source · release history
Vulnerability database update monitoring shipped Alerts users on the Agents page when vulnerability database updates fail due to connectivity issues, and provides remediation guidance. 1 release · first seen Jul 2026

release

  • Adds a notification on the Agents page that alerts when vulnerability database updates fail due to connection issues, with remediation guidance. changelog · Jul 2026 · source · release history
Sitemap discovery and retention shipped Discovers and preserves sitemap information across scans for ongoing analysis. 1 release · first seen Jun 2026

release

  • New sitemap data retention preserves discovered sitemap information across scans for ongoing analysis. v26.6.1 – 16 June 2026 (2026-06-16) · Jun 2026 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for Acunetix 360, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail Acunetix 360 puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Commercials

pricing & packaging history · Acunetix (Invicti) vendor page

17 readings of Acunetix (Invicti)'s pricing page since Oct 2021, with 2 relaunches of its plan lineup and 2 changes to what its plans include — each one dated, compared with the reading before it, and explained for someone buying the tool.

Pricing and packaging history is included with Researcher and Business. See how every vendor we track sells, and how that has changed over time, using data we don't publish anywhere else.

See plans →

Website history

acunetix.com, every change

Acunetix (Invicti)'s home, pricing and product pages and 21 more pages as they looked each month from September 2021 to October 2026: 38 renders, 6 changes of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

9 entries

  1. October 20261
  2. September 20263
  3. August 20263
  4. July 20261
  5. June 20261

    9 entries

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →