PAGES
← all tools
◆ Web Application Security

ImmuniWeb

commercial

Summary

ImmuniWeb is a commercial AI platform for web-app-security that performs application security testing, attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. management, and dark web monitoring. It is available as a SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. service and is designed for practitioners needing attack-surface-management capabilities. Its documentation positions it alongside tools for compliance and DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces.. The platform has released 12 versions within the tracked window.

How ImmuniWeb helps

Which parts of my external attack surface am I not aware of?

continuously discovers internet-facing assets tied to the organization and lists domains, subdomains, and hosts the practitioner did not already have inventoried

Which of my web applications have exploitable vulnerabilities?

runs application security testing against the app and reports findings mapped to the vulnerable endpoint, ready for a compliance or DAST review

Is any of our data already circulating on the dark web?

monitors dark web sources for mentions of company assets, credentials, or data and reports matches back to the practitioner

Does our security posture meet the compliance standards we're audited against?

checks findings from the testing and asset-discovery work against named compliance frameworks and reports where the posture falls short

Which exposed assets are actually reachable and worth prioritizing first?

combines the attack-surface inventory with the vulnerability findings so a practitioner can see which discovered hosts carry confirmed weaknesses rather than triaging the whole list blind

all 8 features, with the evidence for each →

Languages

Not documented

Features

8 capabilities

Built from ImmuniWeb's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date.

Compare with peers →

  • ImmuniWeb covers 1 of the 8 vulnerability assessment methods capabilities we track.
All capabilities 8 capabilities
AI infrastructure and misconfiguration exposure detection shipped Detects exposed AI infrastructure and searches for AI-related misconfigurations or leaked tokens across the attack surface. 2 releases · first seen Oct 2026

release

  • Adds enhanced detection of exposed AI infrastructure in ImmuniWeb® Discovery. announced · Oct 2026 · source · release history
  • Adds advanced search for AI-related misconfigurations or leaked tokens in ImmuniWeb® Neuron. announced · Oct 2026 · source · release history
Cyber Threat Intelligence (CTI) monitoring and alerting shipped Monitors for cyber threats and delivers customizable alerts and an advanced searchable history of past alerts on a dedicated CTI dashboard. 2 releases · first seen Oct 2026

release

  • Adds customizable alerts for the Cyber Threat Intelligence (CTI) dashboard in ImmuniWeb® Discovery. announced · Oct 2026 · source · release history
  • Adds advanced search of past alerts on a dedicated dashboard in ImmuniWeb® Discovery. announced · Oct 2026 · source · release history
AI training data leak monitoring shipped Monitors AI training data sets for data that has been leaked or unlawfully scraped. 1 release · first seen Oct 2026

release

  • Adds monitoring of AI training data sets for leaked or unlawfully scraped data in ImmuniWeb® Discovery. announced · Oct 2026 · source · release history
AI-assisted penetration testing shipped Uses in-house AI models to simulate chained attacks, perform advanced business logic testing, assist penetration testers in real time, accelerate single-page application analysis, and reverse-engineer API schemas. 1 release · first seen Oct 2026

Shared capability: Web vulnerability scanning

release

  • Adds new in-house AI models in ImmuniWeb® Neuron for simulation of chained attacks, advanced business logic testing, real-time assistance to penetration testers, faster analysis of single-page applications, and reverse engineering of API schemas. announced · Oct 2026 · source · release history
Attack surface and IT asset discovery shipped Discovers and attributes IT assets across an organization's attack surface, using in-house AI models to determine asset ownership. 1 release · first seen Oct 2026

release

  • Adds new in-house AI models to better attribute IT asset ownership in ImmuniWeb® Discovery. announced · Oct 2026 · source · release history
Dark web and stolen data monitoring shipped Monitors for stolen credentials, credit cards, and other leaked data associated with the organization. 1 release · first seen Oct 2026

release

  • Adds a new dedicated incident type for stolen credit cards in ImmuniWeb® Discovery. announced · Oct 2026 · source · release history
SSO and DevSecOps integrations shipped Integrates with SSO providers and DevSecOps toolchains, including support for Ping Identity. 1 release · first seen Oct 2026

release

  • Adds Ping Identity SSO to the existing DevSecOps and other integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ announced · Oct 2026 · source · release history
Third-Party Risk Management (TPRM) shipped Provides a dedicated dashboard for assessing and managing cyber risk across third-party vendors and suppliers. 1 release · first seen Oct 2026

release

  • Adds a new dedicated Third-Party Risk Management (TPRM) dashboard in ImmuniWeb® Discovery. announced · Oct 2026 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for ImmuniWeb, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail ImmuniWeb puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Website history

immuniweb.com, every change

ImmuniWeb's 44 pages as they looked each month from October 2026 to October 2026: 44 renders, 0 changes of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

1 entry

  1. October 20261

    1 entry

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →