Invicti

No entries match these filters. Clear filters

1. Release 20261028 (2026-10-28) Oct 28, 2026 · issue 125

   Invicti adds client certificate secrets, sensitive-data labels in the API catalog, and a INVICTI_FAIL_FAST Scan CLI env var to stop DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans on first policy failure⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Store client certificate files as secrets and select them in a target's client certificate authentication settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • API catalog and API discovery now label each API and endpoint with the category of sensitive data it exposes — Secrets, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., or Financials — so risk is visible without opening each finding.
   • Filter the API catalog by newly discovered or recently updated APIs using the new Requires scanning filter to find endpoints that still need a DAST scan.
   • Receive bell notifications and emails when APIs are discovered or updated, with a direct link to the changed APIs in the API catalog; turn off email alerts in your profile notification settings.
   • Store client certificate files as secrets and select them in a target's client certificate authentication settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Receive bell notifications and emails when APIs are discovered or updated, with a direct link to the changed APIs in the API catalog; turn off email alerts in your profile notification settings.

   2 more in Everything

2. changelog Oct 17, 2026 · issue 111

   Invicti adds bulk vulnerability retest, API key auth for CI/CD Source Scan, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. support, and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. bulk user removal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Authenticate a CI/CD Source Scan with a long-lived API key instead of a short-lived token so repeated pipeline jobs stay reliable.
   📍In Invicti Platform, go to Profile › API key, generate an API key with an expiry date, then supply it as the authentication credential in your Source Scan CI/CD pipeline configuration.
   Fail a pipeline stage immediately when a scan runs without successful authentication, preventing false-clean results.
   📍In the scan policy or scan settings, enable the option to fail a scan on authentication issues so the scan reports failure instead of returning unauthenticated results.
   Confirm all fixes from a completed scan in one step rather than retesting vulnerabilities individually.
   📍On the scan summary page, open the Scan again dropdown and select Retest found vulnerabilities to queue a retest of every vulnerability the scan identified.
   • Adds a scan failure mode triggered by authentication problems, so scans that never ran authenticated are flagged rather than silently returning incomplete results.
   • Adds target name and URL display and filtering, plus per-source discovery icons and a discovery-source column, to the API catalog so each API's origin is immediately visible.
   • Adds gRPC compatibility by sending the trailers header and an empty gRPC frame for parameterless RPCs.
   • Adds a scan failure mode triggered by authentication problems, so scans that never ran authenticated are flagged rather than silently returning incomplete results.
   • Adds gRPC compatibility by sending the trailers header and an empty gRPC frame for parameterless RPCs.

   1 more in Everything

3. Release 20261015 (2026-10-15) Oct 15, 2026 · issue 110

   Invicti adds bulk vulnerability retesting, API key auth for Source Scan, scan-on-auth-failure, and HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. export from login recordings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   After deploying a fix, confirm all vulnerabilities from a scan are resolved without retesting each one individually.
   📍In the scan summary, open the Scan again dropdown and select Retest found vulnerabilities.
   Authenticate a long-running pipeline Source Scan with an API key rather than a short-lived token, and set an expiry date for the key.
   📍Navigate to Profile API key, generate an API key for Source Scan, set the desired expiry date, and configure your CI/CD pipeline to pass the key as the authentication credential.
   • Adds Retest found vulnerabilities option in the Scan again dropdown on the scan summary to retest every vulnerability from a scan in one action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds API key authentication for Source Scan in CI/CD pipelines, with expiry date support on the Profile API key page, so pipelines no longer depend on short-lived tokens.
   • Adds a setting to fail a scan when authentication problems occur, preventing unauthenticated results from being silently accepted.
   • Improves the API catalog by adding target name and URL display with filtering by those fields, and by showing how each API was discovered via a distinct icon per API source.
   • Adds HAR file export from login sequence recording sessions, with sensitive headers masked, to assist Support troubleshooting.

   +3 more show less

   • Adds bulk removal of SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.-provisioned users from Invicti Platform in a single operation.
   • Scopes API specification update permission to asset update permissions, allowing the ability to be granted without full API Security access.
   • Adds specific failure messages when login sequence playback, session recovery, or automatic login fails, replacing generic errors.
   • Adds Retest found vulnerabilities option in the Scan again dropdown on the scan summary to retest every vulnerability from a scan in one action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds API key authentication for Source Scan in CI/CD pipelines, with expiry date support on the Profile API key page, so pipelines no longer depend on short-lived tokens.
   • Adds a setting to fail a scan when authentication problems occur, preventing unauthenticated results from being silently accepted.
   • Adds HAR file export from login sequence recording sessions, with sensitive headers masked, to assist Support troubleshooting.
   • Adds bulk removal of SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.-provisioned users from Invicti Platform in a single operation.

   3 more in Everything

4. docs update Oct 9, 2026 · issue 099

   Invicti adds shared saved filters, a Trend Matrix, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. retest from Core, credit ledger/summary, HTML/Markdown/JSON exports, log archive download, repo selection in pentest wizard, Vulnerability Chaining Agent, multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. doc imports, sitemap exclusions, auto false-positive marking, and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. in General Settings.

   • Adds shared saved filters so teams can work from the same views without recreating them.
   • Adds a Trend Matrix for Projects and Targets with filter support to track security posture over time.
   • Adds retest for DAST vulnerabilities directly from Core, scoped to the relevant DAST scan.
   • Adds a credit transaction ledger under AI Credit Usage in the Pentests nav, showing additions, deductions, pending reservations, and current balance.
   • Adds real-time credit usage display to the Summary tab; failed assessments consume no credits.

   +17 more show less

   • Adds HTML format as a downloadable assessment report option.
   • Adds a single compressed archive download for scanner logs and raw agent traces.
   • Adds repository selection in the pentest wizard source code step for repos already connected to AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Core.
   • Adds sitemap path-level coverage for scan-wide agent findings.
   • Adds agent columns to the CSV sitemap export.
   • Adds a Vulnerability Chaining Agent that correlates findings to execute multi-step vulnerability chains.
   • Adds Markdown (.md) and raw JSON report export formats.
   • Adds multimodal reference document imports (PDF, DOCX, MD) for the Recon agent.
   • Adds sitemap path and parameter exclusions in the Octo sitemap.
   • Adds DAST Engine as a distinct entry under Attack Agents.
   • Adds Agentic Pentest management from Invicti AppSec Core UI with unified findings pipeline.
   • Adds DAST technology fingerprinting sharing with Attack Agents.
   • Enables excluded paths enforcement for the Recon agent.
   • Enables Recon agent use of README files and architecture diagrams inside uploaded source code archives.
   • Adds automatic false positive marking for DAST findings confirmed by agentic analysis.
   • Adds VEX configuration to General Settings.
   • Adds Assessment Profile support for input caps and credit spend limits.

   22 details in Everything

   • New detection Ruby deserialization, JWT authentication bypass, path traversal blocklist bypass, and improved login field identification for credential brute-force
   └──▷ BREAKING ON UPGRADE

   • !Unused credits now expire at the end of the subscription term.
   • !Credit values are now whole numbers instead of decimal values.
5. docs update Oct 5, 2026 · issue 095

   Invicti on-premises now supports Linux installation.

   • New supported platform Install on Linux
6. changelog Oct 5, 2026 · issue 095

   Invicti adds a credit ledger, HTML and archive report downloads, agentic pentest platform management, scope enforcement, automatic false positive marking, and secret masking in recorders.

   • Adds AI Credit Usage section under the Pentests nav item to review every credit addition and deduction alongside current available balance, with pending credits reserved at assessment start.
   • Adds real-time credit usage display in the Summary tab for each assessment, reflecting consumed credits as the run progresses.
   • Enables HTML format download for assessment reports, ready to open in any browser or share with stakeholders.
   • Enables download of scanner logs and raw agent traces as a single compressed archive per assessment.
   • Configures how long internal agents retain scan logs and where they store scan data.

   +10 more show less

   • Adds Agentic Pentests management directly from the platform UI, with findings flowing into the same pipeline as standard DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans for unified visibility and triage.
   • Adds agents column to the CSV sitemap export, listing which agents tested each endpoint.
   • Enables the Recon agent to use documentation and diagrams inside uploaded source code archives (such as README files and architecture diagrams) to discover more attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
   • Enforces scope boundaries via Octo blocking attack agent requests that fall outside target configuration and scope settings.
   • Adds automatic false positive marking for DAST findings when agentic analysis confirms they are false positives.
   • Surfaces sitemap coverage for scan-wide agents at the specific sitemap path tested rather than the root.
   • Prioritizes high-value inputs during agentic testing so the most promising attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. are covered within time and credit limits.
   • Accelerates agent start so attack agents launch immediately after the initial DAST scan finishes rather than after a fixed waiting period.
   • Blurs secret values when creating or editing login sequence recordings and business logic recordings, including in the address bar.
   • Adds clearer messaging about maximum file size limits for API source uploads.

   15 details in Everything

   • New detection Ruby deserialization, JWT authentication bypass, and path traversal blocklist bypass detection
   └──▷ BREAKING ON UPGRADE

   • !Unused credits now expire at the end of your subscription term.
   • !Credit values are now whole numbers instead of decimal values, which may affect any integrations or displays that expected decimal credit balances.
7. changelog Oct 4, 2026 · issue 094

   Invicti adds agentic pentest management, credit ledger, HTML/archive report downloads, and scan log retention controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Track how many AI credits each agentic pentest is consuming in real time — useful during a live assessment to stay within budget.
   📍In the Invicti platform, go to Pentests › AI Credit Usage to review the full credit transaction ledger, then open an active assessment and select the Summary tab to see per-assessment credit consumption updating live.
   Download scanner logs and agent traces after an agentic pentest to investigate a finding in depth or escalate to Invicti Support.
   📍In the Invicti platform, open the completed assessment, then select the option to download scanner logs and agent traces as a single compressed archive.
   Share a self-contained assessment report with a stakeholder who does not have platform access.
   📍In the Invicti platform, open the assessment and choose the HTML report download option to produce a file openable in any browser.
   • Octo now confirms time-based findings over multiple rounds with varied delay values to reduce false positives from network latency or server load.
   • Assessment confirmation dialog now references the AI Services Addendum.

   2 more in Everything

8. docs update Oct 4, 2026 · issue 094

   Agentic Pentesting gains a credit ledger UI, HTML/MD/JSON report exports, agent trace downloads, repo source selection, a Vulnerability Chaining Agent, and scope enforcement.

   • Adds AI Credit Usage section under the Pentests nav item showing every credit addition, deduction, pending reservation, and current available balance.
   • Adds real-time credit consumption display in the Summary tab per assessment, with zero credits charged for failed assessments and partial charges for canceled ones.
   • Adds HTML, Markdown (.md), and raw JSON assessment report export formats.
   • Adds the ability to download scanner logs and raw agent traces as a single compressed archive per assessment.
   • Adds repository selection in the pentest wizard source code step, allowing use of a repo already connected to Invicti AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Core.

   +10 more show less

   • Adds a Vulnerability Chaining Agent to the assessment engine that correlates individual findings to execute multi-step vulnerability chains.
   • Adds multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. reference document imports for the Recon agent, supporting PDF, DOCX, and MD files.
   • Enables Agentic Pentests management directly from the Invicti AppSec Core UI, with findings flowing into the same pipeline as standard DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans.
   • Adds sitemap path-level and input-level agent coverage visualization.
   • Adds sitemap path and parameter exclusions in the Octo sitemap.
   • Adds scope enforcement so Octo blocks attack agent requests that fall outside the target's configuration and scope settings.
   • Adds automatic false positive marking for DAST findings when agentic analysis confirms they are false positives.
   • Adds Assessment Profiles support for input caps and credit spend limits.
   • Unused credits now expire at the end of the subscription term.
   • Credit values are now whole numbers instead of decimals.

   15 details in Everything

   • New detection Ruby deserialization, JWT authentication bypass, and path traversal blocklist bypass detection
   └──▷ BREAKING ON UPGRADE

   • !Unused credits now expire at the end of the subscription term — balances that previously carried over will be forfeited.
   • !Credit values are now whole numbers instead of decimals — any system or report relying on decimal credit figures will need to be updated.
   • !Assessment Profiles: execution quotas have transitioned to credit spend limits — existing quota-based configurations will need to be reviewed and migrated.
9. docs update Oct 2, 2026 · issue 092

   Invicti adds a credit ledger, HTML report export, agent trace archive download, unified Agentic Pentest UI management, configurable internal agent log retention, and scope enforcement for agent requests.

   • Adds AI Credit Usage section under the Pentests nav item showing every credit addition, deduction, pending reservation, and current available balance.
   • Adds credit usage display to the Summary tab, updating in real time during an assessment, with zero credits charged for failed assessments and partial charges for canceled ones.
   • Adds HTML format download for Agentic Pentest assessment reports.
   • Adds download of scanner logs and raw agent traces as a single compressed archive per assessment.
   • Included Agents field now shows configured agents immediately when an assessment starts, instead of appearing empty.

   +13 more show less

   • Adds management of Agentic Pentests directly from the platform UI, with findings flowing into the same pipeline as standard DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans.
   • Adds Agents column to the CSV sitemap export, listing which agents tested each endpoint.
   • Adds configurable retention duration and storage location for internal agent scan logs.
   • Recon agent now uses documentation and diagrams inside uploaded source code archives (such as README files and architecture diagrams) to expand attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. discovery.
   • Sitemap now attributes findings from scan-wide agents to the specific path covered rather than the root.
   • Scope enforcement added so Octo blocks attack agent requests that fall outside the target's configuration and scope settings.
   • Automatic false positive marking added: Octo marks DAST findings as false positives when agentic analysis confirms them, reducing manual triage.
   • Recon agent now respects excluded paths, preventing discovery or probing of excluded paths during reconnaissance.
   • Secret values are now blurred in the login sequence recorder and business logic recorder, including in the address bar.
   • Time-based vulnerability confirmation now runs over multiple rounds with varied delay values, with timing results included in finding evidence.
   • Attack agents now prioritize the most relevant inputs first within assessment time and credit limits.
   • Attack agents now start as soon as the initial DAST scan finishes rather than after a fixed waiting period.
   • Adds clearer messaging about maximum file size limits for API source uploads.

   18 details in Everything

   • New detection Ruby deserialization vulnerability detection
   └──▷ BREAKING ON UPGRADE

   • !Unused credits now expire at the end of your subscription term.
   • !Credit values are now whole numbers; decimal credit values are no longer used.
10. Release 20261001 (2026-10-01) Oct 1, 2026 · issue 092

    Invicti adds AI credit ledger, HTML/log-archive downloads, and expanded agentic vuln detection in Release 20261001.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Review pending and committed AI credits before starting a new agentic pentest to ensure sufficient balance.
    📍In the Invicti Platform, go to Pentests › AI Credit Usage to view the full transaction ledger, including pending reservations for in-progress assessments and your current available balance.
    Download raw scanner logs and agent traces after an assessment to investigate a finding or share diagnostics with Invicti Support.
    📍In the Invicti Platform, open the completed assessment, then select the option to download the scanner logs and agent traces as a single compressed archive.
    Download an HTML assessment report to share agentic pentest results with stakeholders who need a portable, browser-ready document.
    📍In the Invicti Platform, open the completed assessment and choose the HTML format option to download the report, then open it in any browser or attach it to a stakeholder communication.
    • Adds an AI Credit Usage section under the Pentests nav item showing every credit addition, deduction, pending reservation, and current available balance in a transaction ledger.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds real-time credit consumption to the Summary tab, showing credits used per assessment, with zero credit charge for failed assessments and pro-rated charges for canceled ones.
    • Enables downloading assessment reports in HTML format for browser viewing or stakeholder sharing.
    • Enables downloading scanner logs and raw agent traces as a single compressed archive per assessment.
    • Adds configurable retention period and storage location for internal agent scan logs.

    +13 more show less

    • Adds agent columns to the CSV sitemap export, listing which agents tested each endpoint.
    • Expands agentic detection coverage to include Ruby deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. vulnerabilities, additional JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. authentication bypass techniques, and path-traversal bypasses against simple blocklist filters, plus more accurate login-field identification in the credential brute-force agent.
    • Scan CLI now distinguishes a rejected API token as a credential error, separate from target or scan errors.
    • Scan CLI now automatically retries requests that receive a temporary authentication error.
    • Sitemap now surfaces findings from scan-wide agents at the specific path covered rather than at the site root.
    • The Recon agent now respects excluded paths, preventing discovery or probing of excluded assessment paths.
    • The Recon agent now ingests README files and architecture diagrams inside uploaded source code archives to broaden attack-surface discovery.
    • Octo now blocks attack-agent requests that fall outside the target scope and configuration settings.
    • Octo now automatically marks DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. findings as false positives when agentic analysis confirms they are false positives.
    • Time-based vulnerability confirmation now runs multiple rounds with varied delay values, including per-round timing evidence in finding reports.
    • Attack agents now prioritize the most relevant inputs first to maximize coverage within time and credit limits.
    • Credit values are now expressed as whole numbers instead of decimals.
    • Unused credits now expire at the end of the subscription term.
    • Adds an AI Credit Usage section under the Pentests nav item showing every credit addition, deduction, pending reservation, and current available balance in a transaction ledger.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables downloading assessment reports in HTML format for browser viewing or stakeholder sharing.
    • Enables downloading scanner logs and raw agent traces as a single compressed archive per assessment.
    • Adds configurable retention period and storage location for internal agent scan logs.
    • Unused credits now expire at the end of the subscription term.

    13 more in Everything

11. Release 20261001 Oct 1, 2026 · release notes

    New config keys for internal agent scan log retention and storage path.

    • Adds configurable internal agent scan log retention duration and storage path
    • Blends secret values in login sequence and business logic recording UI to hide sensitive data during capture
    • Improves Scan CLI authentication error reporting to distinguish credential rejections from target errors
    • Enables automatic retry for temporary authentication errors in Scan CLI

    4 details in Everything

12. docs update Sep 25, 2026 · issue 085

    Invicti v26.9.1 adds configurable auth verifier timeout, URI fragment iframe hijack detection, and CWE-524CWE-524A weakness category in MITRE's Common Weakness Enumeration describing when an application stores sensitive data in a cache that an attacker can read, exposing credentials or session tokens. mapping for Web Cache Deception.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds a configurable timeout setting for authentication verification to prevent failures during slow login or SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. processes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a security check that detects URI fragment-based iframe hijacking, where iframe content is loaded from a base64-encoded URI fragment to inject arbitrary third-party content into a trusted page.
    • Adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-524 mapping to the Web Cache Deception security check, surfacing the correct CWE identifier in API responses and security reports.
    • Adds a PolyShell (APSB25-94) security check that identifies Adobe Commerce and Magento installations where the unauthenticated guest-cart REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. allows PHP polyglot file upload, image validation bypass, and remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives..
    • Adds a configurable timeout setting for authentication verification to prevent failures during slow login or SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. processes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a security check that detects URI fragment-based iframe hijacking, where iframe content is loaded from a base64-encoded URI fragment to inject arbitrary third-party content into a trusted page.
    • Adds a PolyShell (APSB25-94) security check that identifies Adobe Commerce and Magento installations where the unauthenticated guest-cart REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. allows PHP polyglot file upload, image validation bypass, and remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives..

    1 more in Everything

13. docs update Sep 25, 2026 · issue 085

    Invicti v26.9.1 adds secrets support in custom authentication scripts and extends scan data retention periods.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds support for secrets in custom authentication scripts, enabling secure management and testing of sensitive credentials during automated scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Improves scan data retention settings to allow storing scan results for longer periods.
    • Adds support for secrets in custom authentication scripts, enabling secure management and testing of sensitive credentials during automated scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

14. changelog Sep 24, 2026 · issue 084

    Invicti adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. access for Website Discovery and surfaces API spec source locations in API Discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Exposes Website Discovery via the Invicti Platform REST API, enabling retrieval of discovered websites and integration of discovery results into external workflows and cyber tooling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds API specification source location display in API Discovery, showing where each specification was found and which endpoints were auto-detected during a scan.
    • Adds discovery date filtering, exact-match and exclusion text filters, and multi-select risk score filtering to the Website Discovery list.
    • Clicking a count in the Website Discovery list now filters the list to show only entries matching that value.
    • Exposes Website Discovery via the Invicti Platform REST API, enabling retrieval of discovered websites and integration of discovery results into external workflows and cyber tooling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    3 more in Everything

15. docs update Sep 18, 2026 · issue 078

    Invicti: Clicking a count in the Website Discovery list now filters to show only entries matching that value, enabling quick drill-down into specific subsets.

    ⤢ ⤢ ⤢ ⤢
16. Release 20260917 (2026-09-17) Sep 17, 2026 · issue 078

    Invicti adds a Website Discovery REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and exposes API specification source locations in API Discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds a Website Discovery REST API endpoint to retrieve discovered websites and integrate discovery results into external workflows and cyber tooling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Shows the source location of each API specification found during a scan in API Discovery, so you can see which endpoints were auto-detected and from where.
    • Enables filtering the Website Discovery list by discovery date, exact match and exclusion on text filters, and multiple risk score values simultaneously.
    • Adds a Website Discovery REST API endpoint to retrieve discovered websites and integrate discovery results into external workflows and cyber tooling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

17. Release 20260917 Sep 17, 2026 · release notes

    API Discovery shows spec source locations; Website Discovery exposed via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.

    └──▷ TRY IT
    Retrieve discovered websites programmatically to feed into a cyber toolchain or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
    copy

    $ GET /api/website-discovery

    Drill into specific subsets of discovered websites by clicking the count badge for a risk score in the UI.
    📍In Website Discovery, click the number next to a risk score value.
    • Adds source location display in the API Discovery UI to show where each specification was found during the scan
    • Adds Website Discovery via the Invicti Platform REST API for retrieving discovered websites and integrating results into workflows
    • Improves Website Discovery count filtering: clicking a number in the list filters entries matching that value without leaving the page
    • Improves Website Discovery filters with date range, exact match/exclusion text options, and multi-select risk score values

    4 details in Everything

18. changelog Sep 15, 2026 · issue 075

    Invicti scan location exports now include HTTP method and status code columns across CSV, JSON, and XML formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    After a scan completes, export locations in CSV to spot routes returning 401 or 403 — indicating authentication gaps in crawl coverage.
    📍In the scan results, go to Scan › Locations › Export, select CSV (Locations), then open the file and filter the Status Codes column for 401 or 403 responses.
    • Adds HTTP Methods and Status Codes columns to CSV (Locations) scan location exports, appended at the end of each row.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds HTTP method and HTTP response code fields to JSON and XML scan location export formats.
    • Adds HTTP Methods and Status Codes columns to CSV (Locations) scan location exports, appended at the end of each row.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

19. docs update Sep 11, 2026 · issue 071

    Invicti scan location exports now include HTTP method and status code columns across CSV, JSON, and XML formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds HTTP Methods and Status Codes columns to CSV (Locations) export, and equivalent fields to JSON and XML scan location export formats, enabling quick verification of scan coverage and authentication gaps (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ 401/403 responses on specific routes).

    1 detail in Everything

20. docs update Sep 11, 2026 · issue 071

    Invicti AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Core adds AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk. detection, bulk CSV target import, and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. statements for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Onboard a large batch of targets at once without manual entry — prepare a CSV with the supported columns and upload it from the Targets page.
    📍In Invicti AppSec Core, go to Targets › Import, then upload a CSV file with columns: name, URL, description, credentials, team assignment. Download the sample CSV from the import page to use as a template.
    • Adds bulk target import from the Targets page via manual URL entry or CSV file upload (supporting fields: name, URL, description, credentials, team assignment); imported targets get Not Scanned status and the Invicti DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Scanner assigned automatically, with a sample CSV available on the import page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly.) detection and inventory: scans now identify AI/ML frameworks and agentic libraries, surfaced in an AI inventory view and exportable in CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. format, aligned with OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. AIBOM and EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe. Article 53.
    • Adds VEX (Vulnerability Exploitability eXchangeVulnerability Exploitability eXchangeA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.) statement output alongside SCA scan results to distinguish exploitable findings from non-applicable ones and support compliance reporting.
    • Vulnerability groups sorted by Severity now default to rank order (Critical, High, Medium, Low), with an explicit Severity option in the Sort dropdown.
    • Adds bulk target import from the Targets page via manual URL entry or CSV file upload (supporting fields: name, URL, description, credentials, team assignment); imported targets get Not Scanned status and the Invicti DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Scanner assigned automatically, with a sample CSV available on the import page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly.) detection and inventory: scans now identify AI/ML frameworks and agentic libraries, surfaced in an AI inventory view and exportable in CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. format, aligned with OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. AIBOM and EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe. Article 53.
    • Adds VEX (Vulnerability Exploitability eXchangeVulnerability Exploitability eXchangeA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.) statement output alongside SCA scan results to distinguish exploitable findings from non-applicable ones and support compliance reporting.

    1 more in Everything

21. changelog Sep 8, 2026 · issue 068

    Invicti adds WebRTCWebRTCA browser-native, open standard for real-time peer-to-peer audio, video, and data exchange without plugins. Cyber tools use it to tunnel traffic or exfiltrate data through connections browsers treat as legitimate. chatbot detection, rate-limit-aware scan pacing, Agentic Pentesting management, and INVICTI_MINIMUM_CONFIDENCE independent scan failure in scan-cli.

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    Fail a CI pipeline when scan confidence exceeds a threshold, without also gating on severity — useful when you want confidence-only quality gates.
    copy

    $ export INVICTI_MINIMUM_CONFIDENCE=confirmed
    # INVICTI_MINIMUM_SEVERITY is intentionally not set
    scan-cli scan --target-url https://app.example.com

    Allow scan-cli to reach an Invicti platform instance behind a self-signed TLS certificate, ensuring all API calls (DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., Inventory, Identity, report/export) bypass SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. verification.
    copy

    $ export INVICTI_IGNORE_SSL_CHECKS=true
    scan-cli scan --target-url https://app.internal.example.com

    Generate a CI/CD script in GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. with no minimum severity gate, so the pipeline reports all findings without blocking on severity.
    📍In the Invicti platform, go to Integrations › CI/CD Script Generator, select GitHub Actions, leave the Minimum Severity field empty, and download the generated script.
    • The INVICTI_MINIMUM_CONFIDENCE environment variable in scan-cli now independently fails a scan when its threshold is exceeded, without also requiring INVICTI_MINIMUM_SEVERITY to be set.
    • The INVICTI_IGNORE_SSL_CHECKS environment variable in scan-cli now applies to all outbound platform API calls made during a scan — including DAST, Inventory, Identity, and report/export endpoints — not just the ephemeral agent.
    • Adds Bearer TokenBearer TokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. and API Key as dedicated, first-class authentication header types in target configuration, separate from functional headers, for easier authenticated scan setup.
    • Adds support for using Invicti Secrets Manager credentials (API key, basic auth, and bearer token types) for IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. authentication.
    • Adds WebRTC data channel (SDP) chatbot detection, expanding chatbot coverage to applications using real-time communication protocols.

    +18 more show less

    • The scan engine now automatically throttles request pacing when it receives Retry-After or X-RateLimit-* rate-limiting response headers, reducing incomplete coverage and false-negative findings.
    • The scan engine now applies exponential backoff with jitter when retrying requests that receive a 429 Too Many Requests response with no Retry-After header.
    • Enables creating a new API target directly from the API Catalog page, with or without an API specification attached.
    • Adds the ability to create scan schedules for an entire application or collection, automatically running DAST scans across all included targets on a chosen recurrence.
    • Adds the ability to toggle SCIM2SCIM2An IETF-standardized REST/JSON protocol for automating user and group provisioning across identity systems, letting cyber tools sync accounts and permissions without custom per-service integrations. provisioning endpoints on or off for an organization, giving administrators control over whether user and team updates or deletions through SCIM2-provisioned accounts are permitted.
    • The scalable internal scanning agent Helm chart now supports deployment on OpenShift and Red Hat OpenShift Service on AWS (ROSA) clusters.
    • Leaving the minimum severity field empty in the CI/CD script generator now produces a script with no minimum vulnerability threshold, applying to Azure Pipelines, CircleCI, GitHub Actions, GitLab CI/CD, and Jenkins.
    • Adds Agentic Pentesting management directly from the AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform UI, with findings flowing into the same pipeline as standard DAST scans for unified visibility and triage.
    • Adds a Vulnerability Chaining Agent that correlates individual findings to execute multi-step vulnerability chains, uncovering complex attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. that single-step analysis might miss.
    • Assessment reports can now be downloaded in Markdown (.md) and raw JSON formats.
    • The Recon agent can now import architectural diagrams and documentation files (PDF, DOCX, MD), enabling discovery of non-crawlable attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
    • Adds path-level and input-level coverage visualization to the sitemap, showing which endpoints were analyzed by scan-wide and input-specific agents.
    • Adds DAST technology fingerprinting for Attack Agents, automatically sharing detected technology and framework stacks with agents so exploit payloads are tailored to the target's actual stack.
    • Assessment Profiles now support input caps and credit spend limits for more granular control over agent resource use.
    • Adds the ability to exclude URL paths and parameters in the OCTO sitemap, bringing it in line with DAST scan exclusion capabilities.
    • The DAST Engine now appears as a distinct entry under Attack Agents so total vulnerability counts align across AI agents and traditional DAST scans.
    • Granular permission operations are now visible and configurable in Role Management, giving administrators full control over custom role definitions.
    • The character limit for authentication values in IDOR/BOLA credentials has been increased from 1,024 to 4,096 characters.
    • Adds Bearer TokenBearer TokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. and API Key as dedicated, first-class authentication header types in target configuration, separate from functional headers, for easier authenticated scan setup.
    • Adds WebRTC data channel (SDP) chatbot detection, expanding chatbot coverage to applications using real-time communication protocols.
    • The scan engine now automatically throttles request pacing when it receives Retry-After or X-RateLimit-* rate-limiting response headers, reducing incomplete coverage and false-negative findings.
    • The scan engine now applies exponential backoff with jitter when retrying requests that receive a 429 Too Many Requests response with no Retry-After header.
    • Adds the ability to create scan schedules for an entire application or collection, automatically running DAST scans across all included targets on a chosen recurrence.

    +6 more show less

    • Adds the ability to toggle SCIM2SCIM2An IETF-standardized REST/JSON protocol for automating user and group provisioning across identity systems, letting cyber tools sync accounts and permissions without custom per-service integrations. provisioning endpoints on or off for an organization, giving administrators control over whether user and team updates or deletions through SCIM2-provisioned accounts are permitted.
    • Adds Agentic Pentesting management directly from the AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform UI, with findings flowing into the same pipeline as standard DAST scans for unified visibility and triage.
    • Adds a Vulnerability Chaining Agent that correlates individual findings to execute multi-step vulnerability chains, uncovering complex attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. that single-step analysis might miss.
    • Assessment reports can now be downloaded in Markdown (.md) and raw JSON formats.
    • Adds DAST technology fingerprinting for Attack Agents, automatically sharing detected technology and framework stacks with agents so exploit payloads are tailored to the target's actual stack.
    • Adds the ability to exclude URL paths and parameters in the OCTO sitemap, bringing it in line with DAST scan exclusion capabilities.

    12 more in Everything

22. docs update Sep 4, 2026 · issue 064

    Invicti on-premises gains custom security checks, internal scan agents, ephemeral API targets, ZIP-based gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. proto upload, and SCIM2SCIM2An IETF-standardized REST/JSON protocol for automating user and group provisioning across identity systems, letting cyber tools sync accounts and permissions without custom per-service integrations. toggle

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    Retrieve full client credentials in a single API call using the new credentials expand parameter on the /clients endpoint.
    copy

    $ curl -X GET 'https://<invicti-host>/api/v1/clients?expand=credentials' \
      -H 'Authorization: Bearer <token>' \
      -H 'Accept: application/json'

    • Adds credentials expand parameter to the /clients endpoint, which now returns ClientId and ClientSecret values so API consumers can retrieve full client credential details in a single request.
    • Introduces Custom Security Checks, allowing practitioners to create and run organization-specific DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. checks in on-premises deployments to extend scan coverage beyond built-in checks.
    • Adds support for Internal Scan Agents in on-premises deployments, enabling agents deployed inside the environment to scan targets unreachable from the main Invicti Platform installation.
    • Adds Ephemeral API Targets with a dynamic base URL that resolves at scan time, removing the need to manually update target configuration before each scan of temporary or CI/CD-provisioned environments.
    • Supports uploading multiple gRPC proto file definitions as a single ZIP archive for gRPC scanning, eliminating one-by-one proto file imports for services spanning multiple files.

    +7 more show less

    • Adds a SCIM2 provisioning toggle for organizations, allowing administrators to enable or disable SCIM2 provisioning endpoints to control whether user and team updates or deletions via SCIM2 are permitted.
    • Displays a unique organization-specific SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. identifier on the SSO settings page that can be copied when registering Invicti as a SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. service provider in an identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    • Increases the character limit for authentication values in IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. credentials from 1,024 to 4,096 characters.
    • Adds SSO login support for organizations whose identity provider certificate is stored in bare base-64 DER format.
    • Paid multi-workspace license holders can now reuse expired FQDN registrations within their allocation.
    • The workspace FQDN usage breakdown now correctly distinguishes between licensed target FQDNs and the total allocation for accurate license consumption visibility.
    • Automation notification emails now report only open vulnerabilities, matching the view after configured filters are applied.

    12 details in Everything

23. docs update Sep 4, 2026 · issue 064

    Invicti adds rate-limit-aware scan pacing, WebRTCWebRTCA browser-native, open standard for real-time peer-to-peer audio, video, and data exchange without plugins. Cyber tools use it to tunnel traffic or exfiltrate data through connections browsers treat as legitimate. chatbot detection, Agentic Pentesting management, and multiple CLI/auth improvements

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Generate a GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. CI/CD script with no minimum severity threshold so every finding is reported without a hard gate.
    📍In the Invicti AppSec Platform, go to Integrations › CI/CD Script Generator, select GitHub Actions, leave the Minimum Severity field empty, then click Generate Script.
    • The INVICTI_MINIMUM_CONFIDENCE environment variable in scan-cli now independently fails a scan when the threshold is exceeded, without also requiring INVICTI_MINIMUM_SEVERITY to be set.
    • Adds the ability to create a new API target directly from the API Catalog page, with or without an API specification attached.
    • Scan engine now automatically throttles request pacing when rate-limiting response headers (Retry-After, X-RateLimit-*) are received, reducing false-negative risk on rate-limited targets.
    • Scan engine applies exponential backoff with jitter when retrying requests that receive a 429 response with no Retry-After header.
    • SCIM2SCIM2An IETF-standardized REST/JSON protocol for automating user and group provisioning across identity systems, letting cyber tools sync accounts and permissions without custom per-service integrations. provisioning endpoints can now be toggled on or off per organization, preventing user and team updates or deletions through SCIM2-provisioned accounts when disabled.

    +8 more show less

    • Scan schedules can now be created for an entire application or collection, automatically running DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans across all included targets on a chosen recurrence.
    • Leaving the minimum severity field empty in the CI/CD script generator now produces a script with no minimum vulnerability threshold, applicable to Azure Pipelines, CircleCI, GitHub Actions, GitLab CI/CD, and Jenkins.
    • The scalable internal scanning agent Helm chart now supports deployment on OpenShift and Red Hat OpenShift Service on AWS (ROSA) clusters.
    • Technologies and framework stacks detected by DAST scans are now automatically shared with Attack Agents so exploit payloads are tailored to the target's actual technology stack.
    • New Vulnerability Chaining Agent in the assessment engine correlates individual findings to execute multi-step vulnerability chains, uncovering complex attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
    • Assessment reports can now be downloaded in Markdown (.md) and raw JSON formats.
    • Assessment Profiles now support input caps and credit spend limits for more granular agent resource budgeting.
    • DAST Engine now appears as a distinct entry under Attack Agents, aligning vulnerability counts across AI agents and traditional DAST scans.

    13 details in Everything

24. Release 20260903 (2026-09-03) Sep 3, 2026 · issue 064

    Invicti adds rate-limit-aware scan pacing, WebRTCWebRTCA browser-native, open standard for real-time peer-to-peer audio, video, and data exchange without plugins. Cyber tools use it to tunnel traffic or exfiltrate data through connections browsers treat as legitimate. chatbot detection, first-class Bearer TokenBearer TokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else./API Key auth, and Agentic Pentesting enhancements.

    ⤢ ⤢ ⤢ ⤢
    • Adds INVICTI_MINIMUM_CONFIDENCE as an independent scan-failure threshold in scan-cli, so scans fail on confidence alone without requiring INVICTI_MINIMUM_SEVERITY to also be set.
    • Extends INVICTI_IGNORE_SSL_CHECKS in scan-cli to cover all outbound platform API calls during a scan — DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., Inventory, Identity, and report/export endpoints — not just the ephemeral agent.
    • Introduces rate-limit-aware scan pacing: the scan engine now automatically throttles request timing when it receives Retry-After or X-RateLimit-* response headers, reducing incomplete coverage on rate-limited targets.
    • Adds Bearer Token and API Key as dedicated, first-class authentication header types in target configuration, separate from functional headers, simplifying authenticated scan setup.
    • Enables use of Invicti Secrets Manager credentials (API key, basic auth, bearer token) for IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. authentication configurations.

    +12 more show less

    • Adds WebRTC data channel (SDP) chatbot detection, extending chatbot analysis to applications using real-time communication protocols.
    • Enables direct API target creation from the API Catalog page, with or without an attached API specification, without navigating to the Targets section first.
    • Adds a Vulnerability Chaining Agent to the Agentic Pentesting assessment engine, capable of correlating individual findings to execute multi-step attack chains.
    • Adds Markdown (.md) and raw JSON report export formats for Agentic Pentesting assessments, enabling import into automated pipelines and external tools.
    • Enables the Recon agent to import architectural diagrams and documentation files (PDF, DOCX, MD) to discover non-crawlable attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
    • Adds sitemap path-level and input-level agent coverage visualization, showing which endpoints were analyzed by scan-wide and input-specific agents.
    • Adds DAST technology fingerprinting sharing with Agentic Pentesting Attack Agents, so exploit payloads are tailored to the target's detected technology stack.
    • Enables management of Agentic Pentests directly from the AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform UI, with findings flowing into the same pipeline as standard DAST scans.
    • Adds URL path and parameter exclusions to the OCTO sitemap in Agentic Pentesting, matching DAST scan exclusion capabilities.
    • Adds input caps, prioritization limits, and credit spend limits to Agentic Pentesting Assessment Profiles for granular control over agent resource use.
    • Makes all permission group operations visible and configurable in Role Management, giving administrators full control over custom role definitions.
    • Assigns the WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. upload permission group to Security Manager, Administrator, and Account Owner roles.

    17 details in Everything

25. Release 20260903 Sep 3, 2026 · release notes

    New API target creation in Catalog, rate-limit scan pacing, WebRTCWebRTCA browser-native, open standard for real-time peer-to-peer audio, video, and data exchange without plugins. Cyber tools use it to tunnel traffic or exfiltrate data through connections browsers treat as legitimate. chatbot detection, and dedicated auth header types

    └──▷ HOW TO FIND IT
    Create a new API target directly from the Catalog without leaving the page
    📍In the Invicti Platform UI, navigate to the API Catalog page and select Create Target with or without an API specification attached.
    Configure a target to use dedicated authentication headers instead of functional headers
    📍In the target configuration, set Bearer Token or API Key as the authentication type.
    Use Secrets Manager for IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. authentication in a scan
    📍In the target's Login Sequence Recorder or IDOR settings, select Secrets Manager and choose an API key, basic auth, or bearer token credential type.
    • API Catalog page now creates new targets with or without an attached specification without navigating to Targets
    • Scan engine automatically throttles request pacing on Retry-After and X-RateLimit-* response headers for rate-limit-aware scanning
    • Detects and analyzes chatbots communicating via WebRTC data channels (SDP) in the target application
    • Bearer TokenBearer TokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. and API Key are now dedicated first-class authentication header types in target configuration, separate from functional headers
    • Secrets Manager credentials for IDOR/BOLA authentication support API key, basic auth, and bearer token credential types

    5 details in Everything

26. Agentic Pentesting: Release 20260831 Aug 31, 2026 · release notes

    Invicti Agentic Pentesting adds agent-managed DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans, vulnerability chaining, and multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. recon inputs.

    └──▷ HOW TO FIND IT
    Visualize which endpoints and inputs were covered by the current agentic scan via the sitemap interface.
    📍In the Assessment view, open the sitemap panel to inspect path-level and input-level coverage metrics.
    Export scan results in machine-readable formats for CI/CD integration or external analysis pipelines.
    📍Click Download Report and select JSON or Markdown (.md) from the export options.
    Provide architectural context to the Recon agent to discover non-crawlable surfaces using uploaded documentation.
    📍Upload PDF, DOCX, or MD files in the Recon agent settings under Multimodal reference document imports.
    • Adds direct UI management of Agentic Pentests with findings flowing into the standard DAST triage pipeline.
    • Automatically shares DAST technology fingerprinting results to Attack Agents for tailored exploit payloads.
    • Displays path-level and input-level coverage on the sitemap to visualize agent analysis scope.
    • Introduces Vulnerability Chaining Agent to correlate findings into multi-step attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
    • Enables downloading assessment reports in Markdown (.md) and raw JSON formats.

    +1 more show less

    • Allows Recon agent to import architectural diagrams and docs (PDF, DOCX, MD) as reference inputs.

    6 details in Everything

27. changelog Aug 24, 2026 · issue 055

    Invicti adds application-level scan schedules, ephemeral API targets, incremental scan-cli scanning, and org SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. identifiers.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Exclude a detected third-party API from discovery results so it no longer appears in the API Catalog.
    📍In API Discovery, locate the API, open its action menu, select Exclude API, choose Third-party as the type, and enter a reason for the exclusion.
    • Adds INVICTI_INCREMENTAL_SCAN environment variable to scan-cli to limit a scan to new or changed endpoints, reducing scan time in CI/CD pipelines.
    • Adds scheduled scans for entire applications or collections, automatically running DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans across all included targets on a chosen recurrence (previously schedules were per-target only).
    • Adds ephemeral API targets with a dynamic base URL that resolves at scan time, enabling scanning of temporary or CI/CD-provisioned environments without manual target reconfiguration.
    • Adds a unique organization identifier on the SSO settings page that can be copied for use when registering Invicti as a SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. service provider in an identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    • Adds {Asset URL} placeholder support in Jira, Azure Boards, GitHub, and GitLab integration field mappings.

    +7 more show less

    • Adds custom Jira fields of type Label to integration field mapping, enabling automatic tagging of Jira issues created by Invicti.
    • Adds SSO login support for organizations whose identity provider certificate is stored in bare base-64 DER format.
    • API Catalog now filters displayed targets based on the user's collection-level permissions, removing the requirement to have account-wide target access.
    • Adds an Exclude API action in API Discovery (replacing Hide API) that labels APIs as third-party and requires a reason for exclusion.
    • Scan engine now applies exponential backoff with jitter when retrying requests that receive a 429 Too Many Requests response with no Retry-After header, improving crawl coverage on rate-limited targets.
    • Request and response payloads over 2 MB in vulnerability details are now offered as a download instead of being rendered inline, supporting very large scan results.
    • Updates scan-cli runtime to .NET 10.

    12 details in Everything

28. Release 20260820 (2026-08-20) Aug 20, 2026 · release notes

    New scheduled scans, ephemeral API targets, CLI incremental scanning, and permission-scoped API Catalog.

    └──▷ USE IT
    Run incremental scans in CI/CD to only process new or changed endpoints, reducing scan time.
    shell copy

    export INVICTI_INCREMENTAL_SCAN=true && ./scan-cli -t https://api.example.com

    Retrieve the unique organization identifier needed to register Invicti as a SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. service provider in your identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    📍steps: Go to Settings › SSO and copy the organization-specific SSO identifier displayed on the page.
    • Adds the ability to create scan schedules for an entire application or collection
    • Introduces support for Ephemeral API targets with a dynamic base URL that resolves at scan time
    • Adds the INVICTI_INCREMENTAL_SCAN environment variable to scan-cli to enable incremental scanning of new or changed endpoints
    • Displays an organization-specific SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. identifier on the SSO settings page for SAML registration

    4 details in Everything

29. Release 20260820 Aug 20, 2026 · release notes

    Invicti adds app-level scheduled scans, ephemeral API targets, incremental scan CLI env var, and permission-scoped API Catalog.

    └──▷ TRY IT
    Run an incremental scan in CI/CD to target only changed endpoints and reduce execution time.
    copy

    $ INVICTI_INCREMENTAL_SCAN=true ./scan-cli --target https://api.example.com

    Use dynamic base URLs for ephemeral API environments that are provisioned during CI/CD.
    📍steps: Go to API Targets › New Target › Select Ephemeral type, then set the Dynamic Base URL field.
    Create a recurring DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scan schedule across an entire application or collection without manual intervention.
    📍steps: Navigate to the Application or Collection, open Schedules, and create a new recurrence rule for all included targets.
    • Adds INVICTI_INCREMENTAL_SCAN environment variable to scan-cli for limiting scans to new or changed endpoints
    • Adds Organization-specific SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. identifier displayed in the SSO settings page for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. registration
    • Adds Ephemeral API targets with dynamic base URL resolution at scan time
    • Adds App-level and Collection-level Scheduled Scans for DAST runs across all included targets
    • Adds permission-filtered view to the API Catalog, showing only targets accessible via collection-level permissions

    5 details in Everything

30. changelog Aug 17, 2026 · issue 048

    Invicti adds HashiCorp Vault integration, multi-file gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. ZIP upload, API scan profile, custom scan speed, and LSR HTTP traffic logging.

    ⤢ ⤢ ⤢ ⤢
    • Adds support for uploading multiple gRPC proto file definitions as a single ZIP archive, eliminating one-by-one imports for multi-file services.
    • Adds HashiCorp Vault integration with Invicti Platform's Secrets Manager, enabling credentials to be retrieved directly from Vault when configuring scan authentication.
    • Adds a new dedicated API scan profile applied by default to all new API targets for comprehensive API vulnerability coverage.
    • Adds a new Custom scan speed option in scan configuration to set the number of concurrent requests and throttling delay for precise throughput control.
    • Expands Login Sequence Recorder (LSR) reports to include the full HTTP request and response for each recorded step, with automatic obfuscation of sensitive tokens in headers and bodies.

    +2 more show less

    • Secrets configured for a target are now accessible to the Login Sequence Recorder (LSR) during recording, so stored credentials can be used instead of entering them manually.
    • Increases the character limit for authentication values in IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. credentials from 1,024 to 4,096 characters, accommodating long JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Bearer Tokens.

    7 details in Everything

31. docs update Aug 11, 2026 · issue 042

    Invicti Platform adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. sync, HashiCorp Vault integration, a dedicated API scan profile, custom scan speed, and client-certificate storage in Secrets Manager.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Throttle an API scan to a precise request rate to avoid overwhelming a rate-limited target during a scheduled scan.
    📍In Invicti Platform, open the scan configuration for your API target, select Custom scan speed, set the desired number of concurrent requests and the delay between request batches, then save and launch the scan.
    Pull scan authentication credentials from HashiCorp Vault instead of storing them directly in Invicti, reducing secret sprawl.
    📍In Invicti Platform, go to Secrets Manager, add a new secret, choose HashiCorp Vault as the provider, supply your Vault address and token, then reference that secret in the Authentication settings of your scan target.
    Export newly discovered websites to CSV after a Website Discovery run for offline triage and asset-tracking.
    📍In Invicti Platform, open Website Discovery results and click Export to CSV to download the full list of discovered sites as a portable file.
    • Adds Custom scan speed option in scan configuration, letting you set the number of concurrent requests and their send frequency for precise control over scan throughput.
    • Adds HashiCorp Vault integration with Invicti Platform's Secrets Manager, enabling credentials to be retrieved directly from Vault when configuring scan authentication.
    • Adds support for storing client certificates in Secrets Manager by supplying the certificate in base64 format.
    • Adds LDAP user synchronization from OpenLDAPOpenLDAPAn open-source implementation of the Lightweight Directory Access Protocol, maintained by the OpenLDAP Project, used to store and query structured identity data like users and groups over a network. or Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. into Invicti Platform for automated user provisioning and team membership management.
    • New dedicated API scan profile available in all accounts; all new API targets use it by default for comprehensive API vulnerability coverage.

    +15 more show less

    • All scan profiles in an account are now selectable for API targets — no longer locked to OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 API.
    • Secrets configured for a target are now accessible inside the Login Sequence Recorder (LSR) during recording, enabling use of stored credentials instead of entering them manually.
    • LSR reports now include full HTTP request and response for each recorded step, with automatic obfuscation of sensitive tokens in headers and bodies.
    • Website Discovery results can now be exported to a CSV file for portable tracking and reporting outside Invicti Platform.
    • Offline activation for Windows on-premises installations is now supported directly from the Windows installer, requiring no internet access during setup.
    • Sensorless API Discovery now surfaces APIs found on out-of-scope sites, broadening API attack-surface visibility beyond scanned targets.
    • Vulnerabilities marked as Ignored or False Positive are now carried forward to subsequent DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans, preserving assigned states across scan runs.
    • Severity filter on the Vulnerabilities page is now available in the expanded (individual vulnerability) view, not only in the by-type view.
    • Endpoints identified by the AI Business Logic Recorder (BLR) are now marked in the site structure view for visibility into AI-assisted recording coverage.
    • Azure Pipelines CI/CD integration setup now includes a direct link to the Invicti plugin in the Azure Marketplace, adding a plugin-based option alongside the existing script-based method.
    • Columns across all list views in Invicti Platform are now resizable.
    • Character limit for authentication values in IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. credentials increased from 1,024 to 4,096 characters, accommodating long JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Bearer Tokens.
    • Comprehensive and Sarbanes-Oxley reports now include HTTP response data alongside request data.
    • The Last position option is now available when configuring ordinal monthly scan schedules (e.g., last Monday or last Friday of the month).
    • Advanced Target Settings section is now visible to all users with appropriate permissions, not only account Owners.

    20 details in Everything

32. docs update Aug 11, 2026 · issue 042

    Invicti adds HashiCorp Vault integration, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. ZIP proto upload, API scan profile, custom scan speed, and LSR HTTP traffic inspection.

    ⤢ ⤢ ⤢ ⤢
    • Adds support for uploading multiple gRPC proto file definitions as a single ZIP archive, eliminating the need to import proto files one by one for multi-file services.
    • Adds HashiCorp Vault integration with Invicti Platform's Secrets Manager, enabling credentials to be retrieved directly from Vault when configuring scan authentication.
    • Adds a new API-specific scan profile available by default for all new API targets, providing comprehensive API vulnerability coverage out of the box.
    • Adds a new Custom scan speed option in scan configuration to set the number of concurrent requests and request frequency for precise throughput control.
    • Expands Login Sequence Recorder (LSR) reports to include the full HTTP request and response for each recorded step, with automatic obfuscation of sensitive tokens in headers and bodies.

    +3 more show less

    • Increases the character limit for authentication values in IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. credentials from 1,024 to 4,096 characters, resolving save errors for long JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Bearer Tokens.
    • Enables secrets configured for a target to be accessible to the Login Sequence Recorder (LSR) during recording, so stored credentials can be used instead of entering them directly.
    • Scans configured with a custom scan speed and a throttling delay now correctly run at the configured request rate.

    8 details in Everything

33. Release 20260806 (2026-08-06) Aug 6, 2026 · issue 042

    Invicti now accepts a ZIP archive of multiple gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. proto files for scanning multi-file gRPC services.

    ⤢ ⤢ ⤢ ⤢
34. Release 20260806 Aug 6, 2026 · release notes

    Invicti allows uploading multiple gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. proto files as a single ZIP for scanning

    • gRPC scanning now accepts multiple .proto file definitions packed into a single ZIP archive

    1 detail in Everything

35. changelog Aug 1, 2026 · issue 032
    └──▷ HOW TO FIND IT
    Enable AI-aided login recovery so scans can automatically recover from LSR playback failures without manual intervention.
    📍In the Invicti console, open your scan policy or scan settings, locate the AI-aided Login setting, and enable it.
    • Adds AI-aided Login recovery: when an LSR playback fails during a scan, Invicti can now use AI to recover and complete authentication, reducing scan failures caused by login issues.
    • Increases the character limit for authentication values in IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. credentials from 1,024 to 4,096 characters, enabling long JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Bearer Tokens to be saved.
36. docs update Jul 31, 2026 · issue 031

    Invicti v26.7.1 adds agent-page alerts for failed vulnerability database updates.

    • Adds a notification on the Agents page when vulnerability database updates fail due to connection issues, including guidance on how to resolve the problem.

    1 detail in Everything

37. docs update Jul 31, 2026 · issue 031

    Invicti v26.7.1 adds agent page alerts for failed vulnerability database updates.

    • Adds a notification on the Agents page when vulnerability database updates fail due to connection issues, including guidance on how to resolve the problem.

    1 detail in Everything

38. docs update Jul 31, 2026 · issue 031

    Invicti adds API Full Scan profile, JavaScript source map exposure check, COEP header check, and crawling/WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. detection scripts to default profiles.

    • Adds an API Full Scan profile for scanning API targets with a comprehensive set of security checks tailored to API structures.
    • Adds a new security check for JavaScript source map exposure.
    • Adds a new security check for the Cross-Origin-Embedder-Policy (COEP) HTTP response header.
    • Adds crawling, discovery, and web application firewall (WAF) detection scripts to the default scan profiles.
    • Adds a new security check for the PolyShell vulnerability (APSB25-94).

    +3 more show less

    • Adds vulnerability detection for Caddy, Envoy, GeoServer, IBM RTC, markdown-it, moveittransfer, OpenResty, OpenVPN Access Server, Spring Cloud Gateway, WebLogic, IIS, LiteSpeed, and math.js.
    • Updates CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. classifications for 23 vulnerability types, replacing discouraged CWE identifiers with currently recommended alternatives.
    • Updates the Polyfill.io Supply Chain Compromise check to include the CWE-829 classification.

    8 details in Everything

39. docs update Jul 31, 2026 · issue 031

    Invicti adds AI-aided login recovery for LSR failures and HTTP traffic details in LSR reports.

    └──▷ HOW TO FIND IT
    Reduce scan failures caused by brittle login sequences by letting AI recover authentication when LSR playback fails.
    📍In the console, go to your scan policy or target settings and enable the AI-aided Login setting.
    • LSR reports now include full HTTP request and response details for each recorded step, with sensitive tokens automatically obfuscated.
    • Azure Pipelines CI/CD integration setup now includes a direct link to the Invicti plugin in the Azure Marketplace, enabling plugin-based integration alongside the existing script method.
    • New AI-aided Login setting enables Invicti to use AI to recover and complete authentication when LSR playback fails during a scan, reducing scan failures.
    • IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. credential authentication values now support up to 4,096 characters (up from 1,024), accommodating long JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Bearer Tokens.

    4 details in Everything

40. Release 20260723 (2026-07-23) Jul 23, 2026 · issue 031

    LSR reports now capture full HTTP request/response traffic with automatic token obfuscation for each recorded login step.

    • Adds full HTTP request and response details for each step in Login Sequence Recorder (LSR) reports, with automatic obfuscation of sensitive tokens in headers and bodies.
    • Adds a direct link to the Invicti Azure Pipelines plugin in the Azure Marketplace within the CI/CD integration setup, enabling plugin-based integration alongside the existing script-based method.

    2 details in Everything

41. Release 20260723 Jul 23, 2026 · release notes

    LSR reports now include full HTTP request/response details with automatic token obfuscation.

    • Adds full HTTP request and response details to Login Sequence Recorder (LSR) reports
    • Includes a direct link to the Invicti plugin in Azure Marketplace for Azure Pipelines CI/CD integration

    2 details in Everything

42. Release 20260709 (2026-07-09) Jul 9, 2026 · issue 015

    Invicti adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. sync, HashiCorp Vault integration, a new API scan profile, custom scan speed, and expanded API discovery.

    └──▷ HOW TO FIND IT
    Tune scan throughput for a sensitive target without triggering rate-limiting or WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. blocks.
    📍In the scan configuration, open Scan Speed and select Custom, then set the number of concurrent requests and the request send frequency to values appropriate for your target environment.
    • New LDAP user synchronization: automates user provisioning from OpenLDAPOpenLDAPAn open-source implementation of the Lightweight Directory Access Protocol, maintained by the OpenLDAP Project, used to store and query structured identity data like users and groups over a network. or Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. into Invicti Platform.
    • New HashiCorp Vault integration: Secrets Manager can now retrieve credentials directly from HashiCorp Vault for scan authentication.
    • New dedicated API scan profile applied by default to all new API targets for comprehensive API vulnerability coverage.
    • New Custom scan speed option lets you set the number of concurrent requests and send frequency for precise scan throughput control.
    • Sensorless API Discovery now reports APIs found on out-of-scope sites, expanding visibility of your full API surface.

    +5 more show less

    • All scan profiles are now selectable for API targets — no longer locked to OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 API.
    • Client certificates can now be stored in Secrets Manager in base64 format.
    • Secrets configured for a target are now accessible inside the Login Sequence Recorder during session recording.
    • Vulnerability states (Ignored, False Positive) are now persisted and carried forward into subsequent DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans.
    • Severity filter in the Vulnerabilities page expanded view is now available when browsing by individual vulnerability.

    10 details in Everything

43. Release 20260709 Jul 9, 2026 · release notes

    New LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. sync, HashiCorp Vault integration, API scan profile, and persistent vulnerability states in Invicti Platform 20260709

    • LDAP user synchronization: Automate user provisioning by syncing from OpenLDAPOpenLDAPAn open-source implementation of the Lightweight Directory Access Protocol, maintained by the OpenLDAP Project, used to store and query structured identity data like users and groups over a network. or Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. directly into Invicti Platform.
    • HashiCorp Vault integration connects Secrets Manager to retrieve credentials for scan authentication via your vault.
    • New API scan profile is now the default for all new API targets, providing comprehensive API vulnerability coverage.
    • Persistent vulnerability state carries Ignored and False Positive states from previous DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans into subsequent runs without resetting.

    4 details in Everything

44. Release 20260625 (2026-06-25) Jun 25, 2026 · issue 014

    Invicti adds gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. scanning, bulk scan suspension, collection dashboards, and richer CSV exports in this release.

    └──▷ HOW TO FIND IT
    Add gRPC DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. coverage to a microservice by supplying its Protobuf contract at scan configuration time.
    📍In the Invicti console, go to New Scan › API Scanning, select gRPC as the API type, and upload the service's .proto definition file before launching the scan.
    Pause all automated scanning org-wide during a change-freeze window without touching each schedule individually.
    📍In the Invicti console, go to Scheduled Scans and use the Suspend All Scheduled Scans control to halt every future scheduled scan across the account at once.
    Reduce scan failures on sites with CAPTCHA or MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. when scanning through an internal agent by enabling interactive login.
    📍In the scan profile settings for an internal agent scan, enable the AI-aided Login setting so Invicti can use AI to recover failed Login Sequence Recorder playbacks automatically.
    • Supports scanning of gRPC services by uploading .proto definition files, extending DAST coverage to gRPC-based APIs.
    • New Suspend all scheduled scans control lets organization administrators pause all future scheduled scans across the account in one action.
    • Adds a dedicated dashboard for Collections, providing at-a-glance security posture visibility at the collection level.
    • New AI-aided Login setting enables AI recovery when Login Sequence Recorder (LSR) playback fails during a scan, reducing authentication-related scan failures.
    • Extends auditing to SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. configuration changes, recording who changed provisioning settings and when in the audit log.

    +3 more show less

    • Interactive login (manual CAPTCHA/MFA completion) is now available for scans run through internal agents, not just cloud agents.
    • CSV exports of targets now include tags, vulnerability counts, and last scan date for richer bulk reporting.
    • Adds ordinal monthly scan scheduling, allowing scans to be scheduled on a specific weekday of the month (e.g., first Monday, second Thursday).

    8 details in Everything

45. Release 20260625 (2026-06-25) Jun 25, 2026 · release notes

    Invicti adds gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. scanning via .proto uploads, account-wide scan suspension, and collection dashboards in Release 20260625.

    └──▷ HOW TO FIND IT
    Scan gRPC-based APIs by providing their protocol buffer definitions directly to the scanner.
    📍Upload .proto files via the New Scan wizard's service configuration panel
    Pause all automated scanning for an entire organization during a maintenance window.
    📍Organization Settings › Scheduled Scans › Suspend All Future Scans
    Monitor the security posture of a specific collection without navigating to individual applications.
    📍Collections › [Select Collection] › Dashboard
    • Adds gRPC scanning support by uploading .proto definition files to extend DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. coverage
    • Adds organization-level ability to suspend all future scheduled scans across the account
    • Adds dedicated dashboard for Collections to view security posture at a glance

    3 details in Everything

46. Release 20260611 (2026-06-11) Jun 11, 2026 · release notes

    New asset and vulnerability page filters, bulk list selection, and improved GraphQL schema parsing in Invicti Platform

    └──▷ HOW TO FIND IT
    Filter vulnerabilities by a specific collection (e.g., Customer-Facing) on the Vulnerabilities page
    📍In the UI, go to Vulnerabilities › Filters › Collection and select your target collection
    Filter technologies identified on a specific asset (e.g., app.invicti.com) on the Technologies page
    📍In the UI, go to Technologies › Filters › Asset Name and type app.invicti.com
    Bulk-select a range of vulnerabilities by shift-clicking the first and last items in the list
    📍In the UI, click the first vulnerability row, hold Shift, and click the last vulnerability row to select all in between
    • Adds asset name filter on the Technologies page to narrow down identified technologies for a specific asset
    • Adds collection filter on the Vulnerabilities page to scope results to specific collections alongside existing filters
    • Enables shift-select bulk selection in Targets, Vulnerabilities, and Scans lists to select a range of items by holding Shift

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !API-only scans are now restricted to imported API specification files only; probes to other endpoints are no longer performed
47. Release 20260611 Jun 11, 2026 · release notes

    Invicti 20260611 adds asset and collection filters to the UI, Shift-select for bulk actions, and more resilient GraphQL schema parsing. No breaking changes.

    └──▷ HOW TO FIND IT
    Narrow your vulnerability list to findings belonging to a specific collection in the Invicti UI.
    📍In the console, go to Vulnerabilities and use the Collection filter dropdown.
    Filter identified technologies for a specific asset name on the Technologies page.
    📍In the console, go to Technologies and use the Asset filter input.
    • Adds Collection filter on the Vulnerabilities page so you can narrow vulnerabilities down to specific collections alongside your other filters
    • Adds Asset filter on the Technologies page by asset name
    • Enables Shift-select in lists (hold Shift and click another item) for bulk selection of Targets, Vulnerabilities, and Scans
    • Improves GraphQL schema import resilience: unrecognized directives such as oneOf input directive no longer cause syntax errors

    4 details in Everything

48. Release 20260528 (2026-05-28) May 28, 2026 · release notes

    Invicti adds multi-credential HTTP auth per target, SCIM2SCIM2An IETF-standardized REST/JSON protocol for automating user and group provisioning across identity systems, letting cyber tools sync accounts and permissions without custom per-service integrations. toggle per org, business criticality filter, and support access for admins

    • HTTP authentication credentials multiple entries per target with URL routing for different site sections.
    • SCIM2 provisioning toggle per organization in Ultimate license settings.
    • Support access request capability added to Administrator role (no longer restricted to account owners).
    • New Business Criticality filter and Business Impact column in the DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. vulnerabilities list view.

    4 details in Everything

49. Release 20260528 May 28, 2026 · release notes

    Invicti adds multi-credential HTTP auth per target, SCIM2SCIM2An IETF-standardized REST/JSON protocol for automating user and group provisioning across identity systems, letting cyber tools sync accounts and permissions without custom per-service integrations. toggle per org, business criticality filter, and consolidated API auth settings

    └──▷ HOW TO FIND IT
    When scanning a complex app where login, admin, and API sections each require different HTTP auth credentials, configure multiple entries in the target settings to ensure full coverage.
    📍In the Invicti UI, open the Target Configuration screen. Under HTTP Authentication Credentials, add multiple entries, ensuring each has a distinct URL for correct routing during scans.
    For Ultimate license admins wanting to prevent accidental user/team deletions via SCIM2, disable the provisioning endpoint for the organization.
    📍Navigate to Organization Settings › Identity Management. Toggle SCIM2 Provisioning off for this organization.
    Filter the vulnerabilities dashboard to show only high-priority issues from business-critical assets.
    📍Go to DAST › Vulnerabilities. In the filter sidebar, select Business Criticality and choose the desired level (e.g., Critical).
    • Allows configuring multiple HTTP authentication credentials per target to support web apps with different auth sections
    • Adds a Business Criticality filter and Business Impact column in the DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. vulnerabilities list to focus on high-value targets
    • Consolidates API target authentication settings (including IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data.) into the API Target Authentication configuration area, removing them from the API Catalog
    • Enables or disables SCIM2 provisioning endpoints per organization for Ultimate license customers
    • Allows administrators to request support access directly without requiring an account owner

    5 details in Everything

50. Release 20260514 (2026-05-14) May 14, 2026 · release notes

    Invicti adds isolated Workspaces, AI crawl prediction, and cross-credential Secrets Manager support in release 20260514

    └──▷ HOW TO FIND IT
    Configure a target to use Secrets Manager for all credential fields instead of just simple form auth.
    📍Reference Secrets Manager credentials in every field when configuring a Target
    Download debug logs for a failed scan to troubleshoot the issue.
    📍Select the failed scan and choose Download logs for failed scans
    Organize teams into isolated, self-managed environments within your organization.
    📍Create a new Workspace via the Workspaces management interface
    • Adds Workspaces to create isolated, self-managed environments for teams, projects, or independent organization
    • AI-enhanced crawl path prediction expands scan coverage on modern web apps and APIs by predicting likely new paths and endpoints
    • Secrets Manager credentials can now be referenced in every credential field when configuring a Target, not just simple form authentication
    • Login Sequence Recorder (LSR) and Business Logic Recorder (BLR) sessions can now be recorded for Targets assigned to an internal scanning agent
    • Scan schedules now support deleting the scans they created upon schedule deletion via Delete scans created by a schedule

    +7 more show less

    • Debug logs for failed scans are now downloadable, previously limited to successful ones
    • OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 report is now available on all licenses, including Essentials
    • Persistent vulnerabilities view remembers grouped or ungrouped state across page loads
    • Import file limit per Target increased from 5 to 10 files
    • Invicti AI Assistant, including the Get help feature, is now available to all users in the account
    • APIs discovered by a scan are linked back to that scan from the API catalog for endpoint traceability
    • Auditing for Target configuration changes now captures previous and new values for business criticality, authentication, scan configuration, agent settings, excluded hours, IAST settings, name, and tags

    12 details in Everything

51. Release 20260514 May 14, 2026 · release notes

    Invicti adds isolated workspaces, AI crawl path prediction, LSR/BLR for internal agents, and more.

    • Adds Workspaces to create isolated, self-managed environments for teams, projects, or scopes within an organization.
    • AI-enhanced crawl path prediction expands scan coverage on modern web apps and APIs by predicting likely new paths.
    • Enables Login Sequence Recorder (LSR) and Business Logic Recorder (BLR) sessions for Targets assigned to internal scanning agents.
    • Allows Secrets Manager credentials to be referenced in every credential field when configuring a Target, not just simple form authentication.
    • OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 report is now available on all licenses, including Essentials.

    +6 more show less

    • Scan progress indicator uses a more accurate algorithm for clearer status views and better ETAs.
    • Vulnerabilities page persists the last viewed grouped or ungrouped layout across sessions.
    • Increases import file limit to up to 10 files per Target, up from 5.
    • Invicti AI Assistant, including Get help, is now available to all users in the account.
    • APIs discovered by a scan are linked back to that scan from the API catalog for traceability.
    • Improved auditing captures previous and new values for Target configuration changes (business criticality, authentication, etc.).

    11 details in Everything

52. Release 20260430 (2026-04-30) Apr 30, 2026 · release notes

    Invicti adds interactive DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. login, reusable form credentials, Windows WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. install, and VB6 static analysis support.

    └──▷ HOW TO FIND IT
    Scan a site requiring MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. by allowing manual interaction at scan start.
    📍Configure DAST scan › Enable Interactive login in authentication settings
    Use stored secrets for form authentication instead of plain text.
    📍Navigate to Scans › Secrets, store credentials, then reference them in form auth fields
    Install Invicti Platform on-premises on Windows using WSL.
    📍Run the Invicti Platform installer in a WSL environment
    • Adds interactive login configuration for DAST scans to allow manual CAPTCHA/MFA completion
    • Adds Scans > Secrets storage for form authentication credentials, replacing plain-text entry
    • Adds Windows installation via WSL for the on-premises Invicti Platform
    • Adds VB6 source code support in Invicti Source Scan static analysis
    • Adds scalable internal agent Helm chart support for OpenShift and ROSA clusters

    +3 more show less

    • Adds incremental scan type indicator in scan details view
    • Adds partial URL filtering for the DAST scans list
    • Adds machine resource information to the internal agent details panel

    8 details in Everything

53. Release 20260430 Apr 30, 2026 · release notes

    Adds interactive DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. login, reusable scan secrets, Windows/WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. install, and VB6 support

    • Adds interactive login for DAST scans to handle CAPTCHAs or MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. manually at start
    • Adds reusable credentials storage in Scans > Secrets for form authentication
    • Enables on-premises installation of Invicti Platform on Windows via WSL
    • Adds VB6 source code support in Invicti Source Scan

    4 details in Everything

54. Release 20260416 (2026-04-16) Apr 16, 2026 · release notes

    Invicti adds source code and eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. API discovery, IP session restrictions, and configurable banners.

    └──▷ HOW TO FIND IT
    Configure a header banner message displayed to all users across the platform.
    📍Navigate to Platform Settings › Customization › Header Banner and enter your message
    Restrict user sessions to specific IP addresses for compliance.
    📍Navigate to User Management › Security Settings and add allowed IP ranges to the session restriction field
    • Adds Invicti Source Scan to discover APIs directly from source code, expanding inventory without live traffic dependency
    • Adds eBPF-based API discovery from encrypted network traffic with no infrastructure changes required
    • Adds IP address restrictions for user sessions to limit access by source IP
    • Adds a customizable header banner across all platform pages for organizational communications
    • Adds a configurable login warning banner with acknowledgment and decline options for strict access control

    +3 more show less

    • Improves asset visibility in collections so mapped application assets appear automatically without manual mapping
    • Expands tag support to accept any character, including spaces and multiple : separators, across all services
    • Adds the ability to delete scheduled scans directly from the platform UI

    8 details in Everything

55. Release 20260416 Apr 16, 2026 · release notes

    New API discovery via Source Scan and eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic., IP-restricted sessions, configurable banners.

    └──▷ HOW TO FIND IT
    Discover APIs from your codebase to populate inventory before scanning live traffic.
    📍Use Invicti Source Scan within the platform to link your repository and run the source-based discovery workflow
    Restrict specific user accounts to only connect from trusted corporate IPs.
    📍Configure IP address restrictions for user sessions in the platform's security settings
    Display a critical security notice to all users immediately upon accessing any platform page.
    📍Set up a customizable banner in the platform's header configuration settings
    • Adds API Discovery from source code using Invicti Source Scan to expand your API inventory without relying solely on live traffic
    • Adds API Discovery from encrypted traffic using eBPF with no infrastructure changes required
    • Adds IP address restrictions for user sessions to improve security and compliance
    • Adds a customizable platform header banner displayable across all platform pages
    • Adds a configurable login warning banner at login with acknowledgment and decline options for strict access control requirements

    5 details in Everything

56. Release 20260402 (2026-04-02) Apr 2, 2026 · release notes

    Invicti Release 20260402 adds scan-cli export, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. OAuth tokens, and report/catalog enhancements

    • Adds --export capability to scan-cli for exporting scan results directly from the CLI.
    • Implements long-lived OAuth tokens for SCIM integration with Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..

    2 details in Everything

57. Release 20260402 Apr 2, 2026 · release notes

    Invicti Release 20260402 adds scan-cli export, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. OAuth, and report details

    • Adds scan-cli export capability for sharing or processing findings in CI/CD pipelines
    • SCIM integration with Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. now uses long-lived OAuth tokens instead of short-lived bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else.
    • Comprehensive Report now includes the full HTTP request and response for each finding
    • Site structure now shows the content type (e.g. application/json) for each path
    • API catalog endpoints now display their parameters

    +1 more show less

    • Scan profiles now show the highest severity level reported by each check and support filtering checks by severity

    6 details in Everything

58. Release 20260330 (2026-03-30) Mar 30, 2026 · release notes

    Invicti adds rotating API auth tokens, incremental instant scans, and site structure improvements

    • Adds dynamic (rotating) authentication tokens for API scanning to prevent mid-scan failures
    • Introduces estimated time to completion for ongoing scans in the UI
    • Enables incremental scans for instant and one-time scheduled assessments
    • Re-includes previously excluded paths directly from the site structure tab
    • Displays HTTP response codes for each path in the site structure tab

    +1 more show less

    • Visual marking of excluded paths in the site structure tab

    6 details in Everything

59. Release 20260330 Mar 30, 2026 · release notes

    Rotating API auth tokens, scan duration estimates, site structure path visibility, and incremental scan support for instant/scheduled scans

    └──▷ HOW TO FIND IT
    Verify your API scanner can now handle token rotation without interruption during long-running assessments.
    📍Configure the scan target to use dynamic/rotating tokens in the scan setup wizard.
    Use incremental scans for immediate follow-up checks on changed code without re-scanning the whole app.
    📍Initiate an Instant scan and select Incremental mode in the scan options.
    Rerun a previous assessment with identical configuration to validate remediation quickly.
    📍Click Repeat Scan on the completed scan entry in the dashboard.
    • Adds rotating authentication token support for API scans to prevent mid-scan failures.
    • Shows estimated time to completion for ongoing scans in the UI.
    • Displays full paths and HTTP response codes in the site structure tab.
    • Visually marks excluded paths and allows re-including them directly from the site structure tab.
    • Adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. indication during scans to clarify firewall influence on results.

    +3 more show less

    • Enables filtering scans by target collection.
    • Adds a one-click repeat scan feature using identical settings.
    • Extends incremental scan support to instant and one-time scheduled scans.

    8 details in Everything

60. Release 20260305 (2026-03-05) Mar 5, 2026 · release notes

    Adds Microsoft Teams webhook integration, site structure GET/POST indicators, and 7-day scan duration limit.

    └──▷ HOW TO FIND IT
    Configure Microsoft Teams to receive Invicti vulnerability notifications via webhook.
    📍In Invicti Platform, navigate to Settings › Integrations › Webhooks and select Microsoft Teams from the supported communicators list.
    • Added webhook integrations for issue trackers and communicators
    • Added Microsoft Teams integration
    • Increased the Maximum scan duration setting to allow scans of up to 7 days
    • Updated the Site structure tab to indicate if the path has any GET or POST parameters

    4 details in Everything

61. Release 20260305 Mar 5, 2026 · release notes

    Adds Microsoft Teams integration, webhook endpoints for issue trackers/communicators, and site path parameter visibility in Site structure tab.

    • Added Microsoft Teams integration to the list of available communicators.
    • Added webhook integrations for issue trackers and communicators.
    • Updated the Site structure tab to indicate if a path has GET or POST parameters.
    • Scan details now include information on the scan agent used for each scan.

    4 details in Everything

62. Release 20260219 (2026-02-19) Feb 19, 2026 · release notes

    Invicti adds scan tags and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. internal agent support

    • Adds the ability to assign tags to scans for better organization and filtering
    • Docker image of internal scanning agent now supports ARM64 architecture

    2 details in Everything

63. Release 20260219 Feb 19, 2026 · release notes

    Adds tag assignment for scans and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. support for internal scanning agent Docker image

    • Docker image of internal scanning agent now supports ARM64 architecture
    • Added the ability to assign tags to scans for better organization and filtering

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Scan schedules are no longer shown in the DAST scans page.
64. Release 20260205 (2026-02-05) Feb 5, 2026 · release notes

    Invicti allows overriding vulnerability severity, screenshot capture during scans, and custom scheduled scan names.

    └──▷ HOW TO FIND IT
    Manually adjust a detected vulnerability's severity to better match your internal risk tolerance.
    📍In the vulnerability details view, locate the Severity field and select Override.
    Assign a descriptive name to a recurring scan for easier identification in the dashboard.
    📍In the Scheduling interface, enter your desired label in the Custom Name field before saving.
    • overrides now allow users to manually override the severity of vulnerabilities detected in DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans.
    • Screenshot capture is now enabled during DAST scans to improve visibility of the scanning process and authentication failures.
    • Compliance classification information is included in vulnerability details for regulatory alignment and audit readiness.
    • AI-powered features are enabled by default for new accounts (configurable at creation).
    • DAST scans page sorting by status now uses scan date as a secondary sort key.

    +1 more show less

    • Scheduled scans can now be assigned custom names via the scheduling interface.

    6 details in Everything

65. Release 20260205 Feb 5, 2026 · release notes

    Invicti allows overriding vulnerability severity, captures DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scan screenshots, includes compliance classification in vuln details, and enables AI features by default.

    • Adds the ability to override the severity of vulnerabilities detected in DAST scans for individual findings or globally
    • Captures screenshots during DAST scans to improve visibility of authentication failures and scanning progress
    • Includes compliance classification information in vulnerability details to support regulatory alignment and audit readiness
    • Enables AI-powered features by default for new accounts, with an option for account owners to turn them off during creation

    4 details in Everything

66. Release 20260122 (2026-01-22) Jan 22, 2026 · release notes

    Invicti adds target config snapshots, proxy support for internal agents, and URL rewrite rules for DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans

    • Adds the ability to store a snapshot of target configuration for each scan
    • Adds proxy support when the internal scanning agent connects back to the platform
    • Adds custom URL rewrite rules for DAST scans on larger sites

    3 details in Everything

67. Release 20260122 Jan 22, 2026 · release notes

    Invicti adds target config snapshots, custom URL rewrites for DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., and auto-pause for recurring scans.

    • Adds functionality to store a snapshot of target configuration for each scan
    • Introduces custom URL rewrite rules for DAST scans on larger sites to improve scan efficiency
    • Adds safeguards to automatically pause recurring scans after five consecutive failures

    3 details in Everything

68. Release 20260108 (2026-01-08) Jan 8, 2026 · release notes

    Supports IdP-initiatedIdP-initiatedA SAML or OIDC login flow where the identity provider starts the session and pushes an assertion to the service provider without the user first requesting access, removing the SP-side redirect step. SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. user provisioning and non-standard OAuth authorization flows in the scanning engine

    • Adds support for automatic user provisioning during IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-initiated SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. login
    • Enhances the scanning engine to support non-standard OAuth authorization flows

    2 details in Everything

69. Release 20251204 Dec 4, 2025 · release notes

    Invicti 20251204 adds API spec URL loading, bulk comments/tags, dark mode, and auto-scalable agents.

    • Adds URL reference support in target settings to load API specs at runtime from targets not accessible to Invicti cloud services
    • Enables adding bulk comments and tags to vulnerabilities
    • Adds Dark mode UI theme
    • Introduces Auto-scalable agents for scan infrastructure
    • Adds preview capability for REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. specifications (OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., Swagger, RAML) after upload

    +1 more show less

    • Reports WAFs detected by DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scanner in the Scan activity log

    6 details in Everything

70. Release 20251120 Nov 20, 2025 · release notes

    Invicti adds bulk retesting, API export, hostname variation handling, and NTA upgrade context preservation.

    └──▷ HOW TO FIND IT
    Retest multiple vulnerabilities at once from the dashboard or scan results.
    📍In the UI, select multiple vulnerability entries and choose Bulk Retest.
    Export API specifications for downstream consumption without manual copy-paste.
    📍Navigate to API Discovery or API Catalog and use the new export capability.
    • Adds a bulk action for retesting vulnerabilities.
    • Updated visibility of items in API discovery to show only unlinked API specs.
    • Implemented API information export capability for API discovery and API catalog.
    • Implemented hostname variation handling during web crawling to ensure links with different subdomain formats are considered within the same scope.

    4 details in Everything

71. Release 20251106 Nov 6, 2025 · release notes

    Adds Fixed (Unconfirmed) vuln status, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, Sensorless API discovery, custom cookies via LSR API, and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. debug logs.

    • Added toggle in Settings to control automatic retest of vulnerabilities after selecting Fixed (Unconfirmed) status
    • Added SCIM user provisioning support for Invicti Ultimate users
    • Added ability to filter the user list by user creation method (manually created vs. auto-provisioned)

    3 details in Everything

72. Release 20251023 Oct 23, 2025 · release notes

    Invicti adds Zero-Config API discovery, API-only scans, automated report emailing, and Rediscovered vuln tracking in dashboards.

    └──▷ HOW TO FIND IT
    Scan only API endpoints to reduce noise and improve speed compared to a full web app scan.
    📍In the scan profile, enable API-only capability for the target URL.
    Automate report delivery by configuring the system to email a specific recipient upon completion.
    📍Configure the new automation feature in Settings › Automation to trigger an email with the scan report.
    View newly discovered APIs and their reconstructed specifications directly from the discovery interface.
    📍Navigate to the API Discovery view to see reconstructed REST API specifications and filtered third-party APIs.
    • Added Engine-based Zero-Config API discovery service
    • Implemented API-only scan capability to improve scan speed and efficiency
    • Implemented a new automation feature to automatically email a specified scan report upon scan completion
    • Updated requirements for the Internal Agent to specify CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed., and disk space
    • Added an ability to copy custom scan profiles

    +4 more show less

    • The Executive and API Insights dashboards now include Rediscovered vulnerabilities in the total open counts
    • Reconstructed REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. specifications are now displayed in the API Discovery view
    • Implemented filtering out third-party APIs during web application scans to improve API discovery accuracy
    • Added an updates panel to the Application dashboard showing last scanned status and tags

    9 details in Everything

73. Release 20251009 Oct 9, 2025 · release notes

    Invicti 20251009 adds API tag filtering, API scan HTTP stats, LSR auth scripts and debug logs.

    └──▷ HOW TO FIND IT
    Filter scan results by tags using the API
    📍curl -X GET https://<invicti-url>/api/scans/results?tags=production
    Configure LSR with authentication scripts for advanced login flows
    📍Upload authentication script to Standalone LSR configuration in the Invicti UI
    Import targets with form auth credentials via CSV
    📍Include username and password columns in your target CSV file before importing into Invicti
    • GET /api/scans/results now supports filtering scan results by tags
    • API engine statistics for scans include the number of 2xx status codes
    • Added support for authentication scripts in the LSR (Standalone LSR)
    • Users can download debug scan logs via a new button in the UI
    • Inventory Endpoints added to the API Hub

    +2 more show less

    • API dashboard now has a filter to show only vulnerable APIs when navigating to the API catalog
    • CSV import of Targets allows specifying username and password for form authentication

    7 details in Everything

74. Release 20250925 Sep 25, 2025 · release notes

    Invicti adds API tagging for vulns, per-target scan duration limits, and CI/CD scan scheduling from Targets.

    └──▷ TRY IT
    Filter the vulnerabilities API to only return critical issues for a report.
    copy

    $ GET /api/v1/vulnerabilities?severity=critical

    Set a short scan duration (e.g. 30 seconds) for a fast CI/CD pipeline target.
    copy

    $ POST /api/v1/targets/<id>/settings
    {
      "max_scan_duration": 30
    }

    Schedule a new scan for a specific target without leaving the target's context.
    📍In the Invicti UI, open the Target drawer and select Create Scan Schedule.
    • GET /api/v1/vulnerabilities accepts a new severity parameter to filter vulnerabilities by severity level
    • The /targets/<id>/drawer in the UI now allows creating a new scan schedule directly from the target view
    • /target-settings exposes a new config key for max_scan_duration to set per-target scan limits for CI/CD
    • API targets are now tagged with an API label on detected vulnerabilities to distinguish them from web vulns
    • The Application Trend Matrix UI gains a 'view by time range' dropdown for trend analysis

    5 details in Everything

75. Release 20250911 Sep 11, 2025 · release notes

    Adds Trend Matrix for Applications with CSV export, filtering, and vulnerability widgets; enables automatic DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans in GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure..

    • Introduces the Trend Matrix for Applications as a new view displaying Mean Time to Remediate grouped by severity and indicating vulnerabilities exceeding MTTR
    • Adds the ability to export the Trend Matrix to CSV format
    • Implements automatic DAST scans in the GitHub Actions CI/CD pipeline
    • Makes Scan Profiles required for all CI/CD integrations
    • Displays the custom User Agent option in Scan Configuration for Targets

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Scan Profiles are now required for CI/CD integrations; prior configurations without explicit profiles may fail or require migration.
76. Release 20250828 Aug 28, 2025 · release notes

    New SCIM 2.0SCIM 2.0A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, AI-LSSR token tracking, auto-scan stop on 429, and Trend Matrix

    • Adds user provisioning with SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. 2.0 for Teams
    • Implements Trend Matrix for DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Targets
    • Added a filter on the Vulnerabilities page to show vulnerabilities found on APIs
    • Implemented AI-Aided Login to automatically regenerate invalid reused LSR files and save AI-generated LSR files
    • Added support for tracking session tokens in URL Parameters for LSR recorder

    +2 more show less

    • DeepScan now scans all path fragments discovered in locations for potential vulnerabilities
    • Updated the design of the Agents Page and Added the Technologies tab to the Application dashboard

    7 details in Everything

77. Release 20250814 Aug 14, 2025 · release notes

    Invicti 20250814 adds HTTP method restriction for DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., bulk actions, NTA standalone mode, and automated vulnerability sync

    └──▷ HOW TO FIND IT
    Restrict a DAST scan to only test GET and POST methods on a target URL
    📍Steps: In the Invicti UI, navigate to Scan Configuration › Target Settings and enable HTTP Methods, then select GET and POST.
    View which SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. sources were last modified to audit recent changes in your scan configuration
    📍Steps: In the Invicti UI, go to Projects › SAST Sources and check the Last updated column for each source.
    Filter vulnerabilities in a specific environment to isolate testing issues
    📍Steps: In the Invicti UI, go to Vulnerabilities page, select Environment from the filter dropdown, and choose your target.
    • DAST scan targets can now be restricted to specific HTTP methods during configuration
    • Added Export to file bulk action in Projects to export multiple items simultaneously
    • Added Sync vulnerabilities bulk action in Projects for batch synchronization
    • SAST sources in Projects now display a Last updated timestamp per source
    • Standard and compliance reports can now consolidate all SAST asset vulnerabilities for an application overview

    +7 more show less

    • Application dashboard includes a new Most vulnerable technologies list
    • Vulnerabilities page supports filtering by application, asset, and environment
    • NTA Standalone mode is available as a new deployment option for Network Traffic Analysis
    • API catalog now displays details about an API operation
    • Past scans tab includes a new Scan comparison feature
    • Automation now pushes vulnerabilities to issue trackers upon discovery, creating or updating work items automatically
    • Vulnerabilities can be assigned to a specific user via the assignment interface

    12 details in Everything

78. Release 20250730 Jul 30, 2025 · release notes

    Invicti adds IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data./BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. detection, Docker agents, CI/CD dynamic targets, and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. vulnerability scanning

    • Adds IDOR (Insecure Direct Object Reference) and BOLA (Broken Object Level Authorization) vulnerability detection in APIs.
    • Supports Dynamic targets for integration into CI/CD pipelines.
    • Adds Docker-based internal scanning agents with concurrent scan support.
    • Introduces LLM vulnerability detection capabilities including Command Injection, SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., Insecure Output Handling, Tool Usage Exposure, Prompt Injection, System Prompt Leakage, and Fingerprinting.

    4 details in Everything