Invicti — The Cyber Toolchain

Invicti Release 20261028 (2026-10-28)

Wed, 28 Oct 2026 12:00:00 GMT

Invicti adds client certificate secrets, sensitive-data labels in the API catalog, and a `INVICTI_FAIL_FAST` Scan CLI env var to stop DAST scans on first policy failure⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Store client certificate files as secrets and select them in a target's client certificate authentication settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • API catalog and API discovery now label each API and endpoint with the category of sensitive data it exposes — Secrets, PII, or Financials — so risk is visible without opening each finding. • Filter the API catalog by newly discovered or recently updated APIs using the new 'Requires scanning' filter to find endpoints that still need a DAST scan. • Receive bell notifications and emails when APIs are discovered or updated, with a direct link to the changed APIs in the API catalog; turn off email alerts in your profile notification settings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti changelog-20261017-8e05cd1b

Sat, 17 Oct 2026 07:52:27 GMT

Invicti adds bulk vulnerability retest, API key auth for CI/CD Source Scan, gRPC support, and SCIM bulk user removal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a scan failure mode triggered by authentication problems, so scans that never ran authenticated are flagged rather than silently returning incomplete results. • Adds target name and URL display and filtering, plus per-source discovery icons and a discovery-source column, to the API catalog so each API's origin is immediately visible. • Adds gRPC compatibility by sending the `trailers` header and an empty gRPC frame for parameterless RPCs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20261015 (2026-10-15)

Thu, 15 Oct 2026 12:00:00 GMT

Invicti adds bulk vulnerability retesting, API key auth for Source Scan, scan-on-auth-failure, and HAR export from login recordings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Retest found vulnerabilities` option in the `Scan again` dropdown on the scan summary to retest every vulnerability from a scan in one action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds API key authentication for Source Scan in CI/CD pipelines, with expiry date support on the `Profile API key` page, so pipelines no longer depend on short-lived tokens. • Adds a setting to fail a scan when authentication problems occur, preventing unauthenticated results from being silently accepted. • Improves the API catalog by adding target name and URL display with filtering by those fields, and by showing how each API was discovered via a distinct icon per API source. • Adds HAR file export from login sequence recording sessions, with sensitive headers masked, to assist Support troubleshooting. • Adds bulk removal of SCIM-provisioned users from Invicti Platform in a single operation. • Scopes API specification update permission to asset update permissions, allowing the ability to be granted without full API Security access. • Adds specific failure messages when login sequence playback, session recovery, or automatic login fails, replacing generic errors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti changelog-20261005-0d5b44c6

Mon, 05 Oct 2026 07:56:32 GMT

Invicti: Adds `AI Credit Usage` section under the Pentests nav item to review every credit addition and deduction alongside current available balance, with pending credits reserved at assessment start.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds real-time credit usage display in the `Summary` tab for each assessment, reflecting consumed credits as the run progresses. • Enables HTML format download for assessment reports, ready to open in any browser or share with stakeholders. • Enables download of scanner logs and raw agent traces as a single compressed archive per assessment. • Configures how long internal agents retain scan logs and where they store scan data. • Adds `Agentic Pentests` management directly from the platform UI, with findings flowing into the same pipeline as standard DAST scans for unified visibility and triage. • Adds agents column to the CSV sitemap export, listing which agents tested each endpoint. • Expands attack agent detection coverage to include Ruby deserialization vulnerabilities, additional JWT authentication bypass techniques, and path traversal that bypasses simple blocklist filters. • Enables the Recon agent to use documentation and diagrams inside uploaded source code archives (such as README files and architecture diagrams) to discover more attack surface. • Enforces scope boundaries via Octo blocking attack agent requests that fall outside target configuration and scope settings. • Adds automatic false positive marking for DAST findings when agentic analysis confirms they are false positives. • Surfaces sitemap coverage for scan-wide agents at the specific sitemap path tested rather than the root. • Prioritizes high-value inputs during agentic testing so the most promising attack paths are covered within time and credit limits. • Adds clearer messaging about maximum file size limits for API source uploads. Breaking changes: • Unused credits now expire at the end of your subscription term. • Credit values are now whole numbers instead of decimal values, which may affect any integrations or displays that expected decimal credit balances. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti changelog-20261004-0d5b44c6

Sun, 04 Oct 2026 07:49:58 GMT

Invicti adds agentic pentest management, credit ledger, HTML/archive report downloads, and scan log retention controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Octo now confirms time-based findings over multiple rounds with varied delay values to reduce false positives from network latency or server load. • Assessment confirmation dialog now references the `AI Services Addendum`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20261001 (2026-10-01)

Thu, 01 Oct 2026 12:00:00 GMT

Invicti adds AI credit ledger, HTML/log-archive downloads, and expanded agentic vuln detection in Release 20261001.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an `AI Credit Usage` section under the Pentests nav item showing every credit addition, deduction, pending reservation, and current available balance in a transaction ledger.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds real-time credit consumption to the Summary tab, showing credits used per assessment, with zero credit charge for failed assessments and pro-rated charges for canceled ones. • Enables downloading assessment reports in HTML format for browser viewing or stakeholder sharing. • Enables downloading scanner logs and raw agent traces as a single compressed archive per assessment. • Adds configurable retention period and storage location for internal agent scan logs. • Adds agent columns to the CSV sitemap export, listing which agents tested each endpoint. • Expands agentic detection coverage to include Ruby deserialization vulnerabilities, additional JWT authentication bypass techniques, and path-traversal bypasses against simple blocklist filters, plus more accurate login-field identification in the credential brute-force agent. • Scan CLI now distinguishes a rejected API token as a credential error, separate from target or scan errors. • Scan CLI now automatically retries requests that receive a temporary authentication error. • Sitemap now surfaces findings from scan-wide agents at the specific path covered rather than at the site root. • The Recon agent now respects excluded paths, preventing discovery or probing of excluded assessment paths. • The Recon agent now ingests README files and architecture diagrams inside uploaded source code archives to broaden attack-surface discovery. • Octo now blocks attack-agent requests that fall outside the target scope and configuration settings. • Octo now automatically marks DAST findings as false positives when agentic analysis confirms they are false positives. • Time-based vulnerability confirmation now runs multiple rounds with varied delay values, including per-round timing evidence in finding reports. • Attack agents now prioritize the most relevant inputs first to maximize coverage within time and credit limits. • Credit values are now expressed as whole numbers instead of decimals. • Unused credits now expire at the end of the subscription term. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti changelog-20260924-d4de806d

Thu, 24 Sep 2026 07:52:38 GMT

Invicti adds REST API access for Website Discovery and surfaces API spec source locations in API Discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exposes Website Discovery via the Invicti Platform REST API, enabling retrieval of discovered websites and integration of discovery results into external workflows and cyber tooling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds API specification source location display in API Discovery, showing where each specification was found and which endpoints were auto-detected during a scan. • Adds discovery date filtering, exact-match and exclusion text filters, and multi-select risk score filtering to the Website Discovery list. • Clicking a count in the Website Discovery list now filters the list to show only entries matching that value. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260917 (2026-09-17)

Thu, 17 Sep 2026 12:00:00 GMT

Invicti adds a Website Discovery REST API and exposes API specification source locations in API Discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Website Discovery REST API endpoint to retrieve discovered websites and integrate discovery results into external workflows and cyber tooling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Shows the source location of each API specification found during a scan in API Discovery, so you can see which endpoints were auto-detected and from where. • Enables filtering the Website Discovery list by discovery date, exact match and exclusion on text filters, and multiple risk score values simultaneously. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti changelog-20260915-35c4580b

Tue, 15 Sep 2026 13:01:47 GMT

Invicti scan location exports now include HTTP method and status code columns across CSV, JSON, and XML formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `HTTP Methods` and `Status Codes` columns to CSV (Locations) scan location exports, appended at the end of each row.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds HTTP method and HTTP response code fields to JSON and XML scan location export formats. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti changelog-20260908-29675a96

Tue, 08 Sep 2026 07:45:12 GMT

Invicti adds WebRTC chatbot detection, rate-limit-aware scan pacing, Agentic Pentesting management, and `INVICTI_MINIMUM_CONFIDENCE` independent scan failure in scan-cli. • The `INVICTI_MINIMUM_CONFIDENCE` environment variable in scan-cli now independently fails a scan when its threshold is exceeded, without also requiring `INVICTI_MINIMUM_SEVERITY` to be set. • The `INVICTI_IGNORE_SSL_CHECKS` environment variable in scan-cli now applies to all outbound platform API calls made during a scan — including DAST, Inventory, Identity, and report/export endpoints — not just the ephemeral agent. • Adds `Bearer Token` and `API Key` as dedicated, first-class authentication header types in target configuration, separate from functional headers, for easier authenticated scan setup. • Adds support for using Invicti Secrets Manager credentials (API key, basic auth, and bearer token types) for IDOR/BOLA authentication. • Adds WebRTC data channel (SDP) chatbot detection, expanding chatbot coverage to applications using real-time communication protocols. • The scan engine now automatically throttles request pacing when it receives `Retry-After` or `X-RateLimit-*` rate-limiting response headers, reducing incomplete coverage and false-negative findings. • The scan engine now applies exponential backoff with jitter when retrying requests that receive a `429 Too Many Requests` response with no `Retry-After` header. • Enables creating a new API target directly from the API Catalog page, with or without an API specification attached. • Adds the ability to create scan schedules for an entire application or collection, automatically running DAST scans across all included targets on a chosen recurrence. • Adds the ability to toggle SCIM2 provisioning endpoints on or off for an organization, giving administrators control over whether user and team updates or deletions through SCIM2-provisioned accounts are permitted. • The scalable internal scanning agent Helm chart now supports deployment on OpenShift and Red Hat OpenShift Service on AWS (ROSA) clusters. • Leaving the minimum severity field empty in the CI/CD script generator now produces a script with no minimum vulnerability threshold, applying to Azure Pipelines, CircleCI, GitHub Actions, GitLab CI/CD, and Jenkins. • Adds Agentic Pentesting management directly from the AppSec Platform UI, with findings flowing into the same pipeline as standard DAST scans for unified visibility and triage. • Adds a Vulnerability Chaining Agent that correlates individual findings to execute multi-step vulnerability chains, uncovering complex attack paths that single-step analysis might miss. • Assessment reports can now be downloaded in Markdown (`.md`) and raw JSON formats. • The Recon agent can now import architectural diagrams and documentation files (PDF, DOCX, MD), enabling discovery of non-crawlable attack surfaces. • Adds path-level and input-level coverage visualization to the sitemap, showing which endpoints were analyzed by scan-wide and input-specific agents. • Adds DAST technology fingerprinting for Attack Agents, automatically sharing detected technology and framework stacks with agents so exploit payloads are tailored to the target's actual stack. • Assessment Profiles now support input caps and credit spend limits for more granular control over agent resource use. • Adds the ability to exclude URL paths and parameters in the OCTO sitemap, bringing it in line with DAST scan exclusion capabilities. • The DAST Engine now appears as a distinct entry under Attack Agents so total vulnerability counts align across AI agents and traditional DAST scans. • Granular permission operations are now visible and configurable in Role Management, giving administrators full control over custom role definitions. • The character limit for authentication values in IDOR/BOLA credentials has been increased from 1,024 to 4,096 characters. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260903 (2026-09-03)

Thu, 03 Sep 2026 12:00:00 GMT

Invicti adds rate-limit-aware scan pacing, WebRTC chatbot detection, first-class Bearer Token/API Key auth, and Agentic Pentesting enhancements. • Adds `INVICTI_MINIMUM_CONFIDENCE` as an independent scan-failure threshold in `scan-cli`, so scans fail on confidence alone without requiring `INVICTI_MINIMUM_SEVERITY` to also be set. • Extends `INVICTI_IGNORE_SSL_CHECKS` in `scan-cli` to cover all outbound platform API calls during a scan — DAST, Inventory, Identity, and report/export endpoints — not just the ephemeral agent. • Introduces rate-limit-aware scan pacing: the scan engine now automatically throttles request timing when it receives `Retry-After` or `X-RateLimit-*` response headers, reducing incomplete coverage on rate-limited targets. • Adds Bearer Token and API Key as dedicated, first-class authentication header types in target configuration, separate from functional headers, simplifying authenticated scan setup. • Enables use of Invicti Secrets Manager credentials (API key, basic auth, bearer token) for IDOR/BOLA authentication configurations. • Adds WebRTC data channel (SDP) chatbot detection, extending chatbot analysis to applications using real-time communication protocols. • Enables direct API target creation from the API Catalog page, with or without an attached API specification, without navigating to the Targets section first. • Adds a Vulnerability Chaining Agent to the Agentic Pentesting assessment engine, capable of correlating individual findings to execute multi-step attack chains. • Adds Markdown (`.md`) and raw JSON report export formats for Agentic Pentesting assessments, enabling import into automated pipelines and external tools. • Enables the Recon agent to import architectural diagrams and documentation files (PDF, DOCX, MD) to discover non-crawlable attack surfaces. • Adds sitemap path-level and input-level agent coverage visualization, showing which endpoints were analyzed by scan-wide and input-specific agents. • Adds DAST technology fingerprinting sharing with Agentic Pentesting Attack Agents, so exploit payloads are tailored to the target's detected technology stack. • Enables management of Agentic Pentests directly from the AppSec Platform UI, with findings flowing into the same pipeline as standard DAST scans. • Adds URL path and parameter exclusions to the OCTO sitemap in Agentic Pentesting, matching DAST scan exclusion capabilities. • Adds input caps, prioritization limits, and credit spend limits to Agentic Pentesting Assessment Profiles for granular control over agent resource use. • Makes all permission group operations visible and configurable in Role Management, giving administrators full control over custom role definitions. • Assigns the WAF upload permission group to Security Manager, Administrator, and Account Owner roles. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti changelog-20260824-d73297dd

Mon, 24 Aug 2026 14:31:02 GMT

Invicti adds application-level scan schedules, ephemeral API targets, incremental scan-cli scanning, and org SSO identifiers. • Adds `INVICTI_INCREMENTAL_SCAN` environment variable to `scan-cli` to limit a scan to new or changed endpoints, reducing scan time in CI/CD pipelines. • Adds scheduled scans for entire applications or collections, automatically running DAST scans across all included targets on a chosen recurrence (previously schedules were per-target only). • Adds ephemeral API targets with a dynamic base URL that resolves at scan time, enabling scanning of temporary or CI/CD-provisioned environments without manual target reconfiguration. • Adds a unique organization identifier on the SSO settings page that can be copied for use when registering Invicti as a SAML service provider in an identity provider. • Adds `{Asset URL}` placeholder support in Jira, Azure Boards, GitHub, and GitLab integration field mappings. • Adds custom Jira fields of type Label to integration field mapping, enabling automatic tagging of Jira issues created by Invicti. • Adds SSO login support for organizations whose identity provider certificate is stored in bare base-64 DER format. • API Catalog now filters displayed targets based on the user's collection-level permissions, removing the requirement to have account-wide target access. • Adds an 'Exclude API' action in API Discovery (replacing 'Hide API') that labels APIs as third-party and requires a reason for exclusion. • Scan engine now applies exponential backoff with jitter when retrying requests that receive a 429 Too Many Requests response with no `Retry-After` header, improving crawl coverage on rate-limited targets. • Request and response payloads over 2 MB in vulnerability details are now offered as a download instead of being rendered inline, supporting very large scan results. • Updates `scan-cli` runtime to .NET 10. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti changelog-20260817-ad34ccb5

Mon, 17 Aug 2026 09:39:24 GMT

Invicti adds HashiCorp Vault integration, multi-file gRPC ZIP upload, API scan profile, custom scan speed, and LSR HTTP traffic logging. • Adds support for uploading multiple gRPC proto file definitions as a single ZIP archive, eliminating one-by-one imports for multi-file services. • Adds HashiCorp Vault integration with Invicti Platform's Secrets Manager, enabling credentials to be retrieved directly from Vault when configuring scan authentication. • Adds a new dedicated API scan profile applied by default to all new API targets for comprehensive API vulnerability coverage. • Adds a new 'Custom' scan speed option in scan configuration to set the number of concurrent requests and throttling delay for precise throughput control. • Expands Login Sequence Recorder (LSR) reports to include the full HTTP request and response for each recorded step, with automatic obfuscation of sensitive tokens in headers and bodies. • Secrets configured for a target are now accessible to the Login Sequence Recorder (LSR) during recording, so stored credentials can be used instead of entering them manually. • Increases the character limit for authentication values in IDOR/BOLA credentials from 1,024 to 4,096 characters, accommodating long JWT Bearer Tokens. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260806 (2026-08-06)

Thu, 06 Aug 2026 12:00:00 GMT

Invicti now accepts a ZIP archive of multiple gRPC proto files for scanning multi-file gRPC services. • Supports uploading multiple gRPC proto file definitions as a single ZIP archive for gRPC scanning, removing the need to import proto files one by one for services that span multiple files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti changelog-20260801-aaaa1934

Sat, 01 Aug 2026 19:07:03 GMT

• Adds AI-aided Login recovery: when an LSR playback fails during a scan, Invicti can now use AI to recover and complete authentication, reducing scan failures caused by login issues. • Increases the character limit for authentication values in IDOR/BOLA credentials from 1,024 to 4,096 characters, enabling long JWT Bearer Tokens to be saved. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260723 (2026-07-23)

Thu, 23 Jul 2026 12:00:00 GMT

LSR reports now capture full HTTP request/response traffic with automatic token obfuscation for each recorded login step. • Adds full HTTP request and response details for each step in Login Sequence Recorder (LSR) reports, with automatic obfuscation of sensitive tokens in headers and bodies. • Adds a direct link to the Invicti Azure Pipelines plugin in the Azure Marketplace within the CI/CD integration setup, enabling plugin-based integration alongside the existing script-based method. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260709 (2026-07-09)

Thu, 09 Jul 2026 12:00:00 GMT

Invicti adds LDAP sync, HashiCorp Vault integration, a new API scan profile, custom scan speed, and expanded API discovery. • New LDAP user synchronization: automates user provisioning from OpenLDAP or Microsoft Active Directory into Invicti Platform. • New HashiCorp Vault integration: Secrets Manager can now retrieve credentials directly from HashiCorp Vault for scan authentication. • New dedicated API scan profile applied by default to all new API targets for comprehensive API vulnerability coverage. • New Custom scan speed option lets you set the number of concurrent requests and send frequency for precise scan throughput control. • Sensorless API Discovery now reports APIs found on out-of-scope sites, expanding visibility of your full API surface. • All scan profiles are now selectable for API targets — no longer locked to OWASP Top 10 API. • Client certificates can now be stored in Secrets Manager in base64 format. • Secrets configured for a target are now accessible inside the Login Sequence Recorder during session recording. • Vulnerability states (Ignored, False Positive) are now persisted and carried forward into subsequent DAST scans. • Severity filter in the Vulnerabilities page expanded view is now available when browsing by individual vulnerability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260625 (2026-06-25)

Thu, 25 Jun 2026 12:00:00 GMT

Invicti adds gRPC scanning, bulk scan suspension, collection dashboards, and richer CSV exports in this release. • Supports scanning of gRPC services by uploading .proto definition files, extending DAST coverage to gRPC-based APIs. • New 'Suspend all scheduled scans' control lets organization administrators pause all future scheduled scans across the account in one action. • Adds a dedicated dashboard for Collections, providing at-a-glance security posture visibility at the collection level. • New AI-aided Login setting enables AI recovery when Login Sequence Recorder (LSR) playback fails during a scan, reducing authentication-related scan failures. • Extends auditing to SCIM configuration changes, recording who changed provisioning settings and when in the audit log. • Interactive login (manual CAPTCHA/MFA completion) is now available for scans run through internal agents, not just cloud agents. • CSV exports of targets now include tags, vulnerability counts, and last scan date for richer bulk reporting. • Adds ordinal monthly scan scheduling, allowing scans to be scheduled on a specific weekday of the month (e.g., first Monday, second Thursday). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260625 (2026-06-25)

Thu, 25 Jun 2026 12:00:00 GMT

Invicti adds gRPC scanning via .proto uploads, account-wide scan suspension, and collection dashboards in Release 20260625. • Adds `gRPC` scanning support by uploading `.proto` definition files to extend DAST coverage • Adds organization-level ability to suspend all future scheduled scans across the account • Adds dedicated dashboard for Collections to view security posture at a glance Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260611 (2026-06-11)

Thu, 11 Jun 2026 12:00:00 GMT

New asset and vulnerability page filters, bulk list selection, and improved GraphQL schema parsing in Invicti Platform • Adds `asset name` filter on the Technologies page to narrow down identified technologies for a specific asset • Adds `collection` filter on the Vulnerabilities page to scope results to specific collections alongside existing filters • Enables shift-select bulk selection in Targets, Vulnerabilities, and Scans lists to select a range of items by holding Shift Breaking changes: • API-only scans are now restricted to imported API specification files only; probes to other endpoints are no longer performed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260611

Thu, 11 Jun 2026 00:00:00 GMT

Invicti 20260611 adds asset and collection filters to the UI, Shift-select for bulk actions, and more resilient GraphQL schema parsing. No breaking changes. • Adds `Collection filter` on the Vulnerabilities page so you can narrow vulnerabilities down to specific collections alongside your other filters • Adds `Asset filter` on the Technologies page by asset name • Enables Shift-select in lists (hold Shift and click another item) for bulk selection of Targets, Vulnerabilities, and Scans • Improves GraphQL schema import resilience: unrecognized directives such as `oneOf` input directive no longer cause syntax errors Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260528 (2026-05-28)

Thu, 28 May 2026 12:00:00 GMT

Invicti adds multi-credential HTTP auth per target, SCIM2 toggle per org, business criticality filter, and support access for admins • `HTTP authentication credentials` multiple entries per target with URL routing for different site sections. • `SCIM2 provisioning` toggle per organization in Ultimate license settings. • Support access request capability added to `Administrator` role (no longer restricted to account owners). • New `Business Criticality` filter and `Business Impact` column in the DAST vulnerabilities list view. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260528

Thu, 28 May 2026 00:00:00 GMT

Invicti adds multi-credential HTTP auth per target, SCIM2 toggle per org, business criticality filter, and consolidated API auth settings • Allows configuring multiple HTTP authentication credentials per target to support web apps with different auth sections • Adds a 'Business Criticality' filter and 'Business Impact' column in the DAST vulnerabilities list to focus on high-value targets • Consolidates API target authentication settings (including IDOR/BOLA) into the API Target Authentication configuration area, removing them from the API Catalog • Enables or disables SCIM2 provisioning endpoints per organization for Ultimate license customers • Allows administrators to request support access directly without requiring an account owner Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260514 (2026-05-14)

Thu, 14 May 2026 12:00:00 GMT

Invicti adds isolated Workspaces, AI crawl prediction, and cross-credential Secrets Manager support in release 20260514 • Adds `Workspaces` to create isolated, self-managed environments for teams, projects, or independent organization • AI-enhanced crawl path prediction expands scan coverage on modern web apps and APIs by predicting likely new paths and endpoints • Secrets Manager credentials can now be referenced in every credential field when configuring a Target, not just simple form authentication • Login Sequence Recorder (LSR) and Business Logic Recorder (BLR) sessions can now be recorded for Targets assigned to an internal scanning agent • Scan schedules now support deleting the scans they created upon schedule deletion via `Delete scans created by a schedule` • Debug logs for failed scans are now downloadable, previously limited to successful ones • OWASP Top 10 report is now available on all licenses, including Essentials • Persistent vulnerabilities view remembers grouped or ungrouped state across page loads • Import file limit per Target increased from 5 to 10 files • Invicti AI Assistant, including the `Get help` feature, is now available to all users in the account • APIs discovered by a scan are linked back to that scan from the API catalog for endpoint traceability • Auditing for Target configuration changes now captures previous and new values for business criticality, authentication, scan configuration, agent settings, excluded hours, IAST settings, name, and tags Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260514

Thu, 14 May 2026 00:00:00 GMT

Invicti adds isolated workspaces, AI crawl path prediction, LSR/BLR for internal agents, and more. • Adds `Workspaces` to create isolated, self-managed environments for teams, projects, or scopes within an organization. • AI-enhanced crawl path prediction expands scan coverage on modern web apps and APIs by predicting likely new paths. • Enables Login Sequence Recorder (LSR) and Business Logic Recorder (BLR) sessions for Targets assigned to internal scanning agents. • Allows Secrets Manager credentials to be referenced in every credential field when configuring a Target, not just simple form authentication. • OWASP Top 10 report is now available on all licenses, including Essentials. • Scan progress indicator uses a more accurate algorithm for clearer status views and better ETAs. • Vulnerabilities page persists the last viewed grouped or ungrouped layout across sessions. • Increases import file limit to up to 10 files per Target, up from 5. • Invicti AI Assistant, including Get help, is now available to all users in the account. • APIs discovered by a scan are linked back to that scan from the API catalog for traceability. • Improved auditing captures previous and new values for Target configuration changes (business criticality, authentication, etc.). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260430 (2026-04-30)

Thu, 30 Apr 2026 12:00:00 GMT

Invicti adds interactive DAST login, reusable form credentials, Windows WSL install, and VB6 static analysis support. • Adds `interactive login` configuration for DAST scans to allow manual CAPTCHA/MFA completion • Adds `Scans > Secrets` storage for form authentication credentials, replacing plain-text entry • Adds Windows installation via WSL for the on-premises Invicti Platform • Adds VB6 source code support in Invicti Source Scan static analysis • Adds scalable internal agent Helm chart support for OpenShift and ROSA clusters • Adds incremental scan type indicator in scan details view • Adds partial URL filtering for the DAST scans list • Adds machine resource information to the internal agent details panel Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260430

Thu, 30 Apr 2026 00:00:00 GMT

Adds interactive DAST login, reusable scan secrets, Windows/WSL install, and VB6 support • Adds interactive login for DAST scans to handle CAPTCHAs or MFA manually at start • Adds reusable credentials storage in Scans > Secrets for form authentication • Enables on-premises installation of Invicti Platform on Windows via WSL • Adds VB6 source code support in Invicti Source Scan Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260416 (2026-04-16)

Thu, 16 Apr 2026 12:00:00 GMT

Invicti adds source code and eBPF API discovery, IP session restrictions, and configurable banners. • Adds `Invicti Source Scan` to discover APIs directly from source code, expanding inventory without live traffic dependency • Adds `eBPF`-based API discovery from encrypted network traffic with no infrastructure changes required • Adds IP address restrictions for user sessions to limit access by source IP • Adds a customizable header banner across all platform pages for organizational communications • Adds a configurable login warning banner with acknowledgment and decline options for strict access control • Improves asset visibility in collections so mapped application assets appear automatically without manual mapping • Expands tag support to accept any character, including spaces and multiple `:` separators, across all services • Adds the ability to delete scheduled scans directly from the platform UI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260416

Thu, 16 Apr 2026 00:00:00 GMT

New API discovery via Source Scan and eBPF, IP-restricted sessions, configurable banners. • Adds API Discovery from source code using Invicti Source Scan to expand your API inventory without relying solely on live traffic • Adds API Discovery from encrypted traffic using eBPF with no infrastructure changes required • Adds IP address restrictions for user sessions to improve security and compliance • Adds a customizable platform header banner displayable across all platform pages • Adds a configurable login warning banner at login with acknowledgment and decline options for strict access control requirements Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260402 (2026-04-02)

Thu, 02 Apr 2026 12:00:00 GMT

Invicti Release 20260402 adds scan-cli export, SCIM OAuth tokens, and report/catalog enhancements • Adds `--export` capability to scan-cli for exporting scan results directly from the CLI. • Implements long-lived OAuth tokens for SCIM integration with Microsoft Entra ID. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260402

Thu, 02 Apr 2026 00:00:00 GMT

Invicti Release 20260402 adds scan-cli export, SCIM OAuth, and report details • Adds `scan-cli` export capability for sharing or processing findings in CI/CD pipelines • SCIM integration with Microsoft Entra ID now uses long-lived OAuth tokens instead of short-lived bearer tokens • Comprehensive Report now includes the full HTTP request and response for each finding • Site structure now shows the content type (e.g. `application/json`) for each path • API catalog endpoints now display their parameters • Scan profiles now show the highest severity level reported by each check and support filtering checks by severity Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260330 (2026-03-30)

Mon, 30 Mar 2026 12:00:00 GMT

Invicti adds rotating API auth tokens, incremental instant scans, and site structure improvements • Adds dynamic (rotating) authentication tokens for API scanning to prevent mid-scan failures • Introduces estimated time to completion for ongoing scans in the UI • Enables incremental scans for instant and one-time scheduled assessments • Re-includes previously excluded paths directly from the site structure tab • Displays HTTP response codes for each path in the site structure tab • Visual marking of excluded paths in the site structure tab Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260330

Mon, 30 Mar 2026 00:00:00 GMT

Rotating API auth tokens, scan duration estimates, site structure path visibility, and incremental scan support for instant/scheduled scans • Adds rotating authentication token support for API scans to prevent mid-scan failures. • Shows estimated time to completion for ongoing scans in the UI. • Displays full paths and HTTP response codes in the site structure tab. • Visually marks excluded paths and allows re-including them directly from the site structure tab. • Adds WAF indication during scans to clarify firewall influence on results. • Enables filtering scans by target collection. • Adds a one-click repeat scan feature using identical settings. • Extends incremental scan support to instant and one-time scheduled scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260305 (2026-03-05)

Thu, 05 Mar 2026 12:00:00 GMT

Adds Microsoft Teams webhook integration, site structure GET/POST indicators, and 7-day scan duration limit. • Added webhook integrations for issue trackers and communicators • Added Microsoft Teams integration • Increased the Maximum scan duration setting to allow scans of up to 7 days • Updated the Site structure tab to indicate if the path has any GET or POST parameters Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260305

Thu, 05 Mar 2026 00:00:00 GMT

Adds Microsoft Teams integration, webhook endpoints for issue trackers/communicators, and site path parameter visibility in Site structure tab. • Added `Microsoft Teams` integration to the list of available communicators. • Added webhook integrations for issue trackers and communicators. • Updated the Site structure tab to indicate if a path has GET or POST parameters. • Scan details now include information on the scan agent used for each scan. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260219 (2026-02-19)

Thu, 19 Feb 2026 12:00:00 GMT

Invicti adds scan tags and ARM64 internal agent support • Adds the ability to assign tags to scans for better organization and filtering • Docker image of internal scanning agent now supports ARM64 architecture Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260219

Thu, 19 Feb 2026 00:00:00 GMT

Adds tag assignment for scans and ARM64 support for internal scanning agent Docker image • Docker image of internal scanning agent now supports ARM64 architecture • Added the ability to assign tags to scans for better organization and filtering Breaking changes: • DAST Scan schedules are no longer shown in the DAST scans page. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260205 (2026-02-05)

Thu, 05 Feb 2026 12:00:00 GMT

Invicti allows overriding vulnerability severity, screenshot capture during scans, and custom scheduled scan names. • `overrides` now allow users to manually override the severity of vulnerabilities detected in DAST scans. • Screenshot capture is now enabled during DAST scans to improve visibility of the scanning process and authentication failures. • Compliance classification information is included in vulnerability details for regulatory alignment and audit readiness. • AI-powered features are enabled by default for new accounts (configurable at creation). • DAST scans page sorting by status now uses scan date as a secondary sort key. • Scheduled scans can now be assigned custom names via the scheduling interface. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260205

Thu, 05 Feb 2026 00:00:00 GMT

Invicti allows overriding vulnerability severity, captures DAST scan screenshots, includes compliance classification in vuln details, and enables AI features by default. • Adds the ability to override the severity of vulnerabilities detected in DAST scans for individual findings or globally • Captures screenshots during DAST scans to improve visibility of authentication failures and scanning progress • Includes compliance classification information in vulnerability details to support regulatory alignment and audit readiness • Enables AI-powered features by default for new accounts, with an option for account owners to turn them off during creation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260122 (2026-01-22)

Thu, 22 Jan 2026 12:00:00 GMT

Invicti adds target config snapshots, proxy support for internal agents, and URL rewrite rules for DAST scans • Adds the ability to store a snapshot of target configuration for each scan • Adds proxy support when the internal scanning agent connects back to the platform • Adds custom URL rewrite rules for DAST scans on larger sites Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260122

Thu, 22 Jan 2026 00:00:00 GMT

Invicti adds target config snapshots, custom URL rewrites for DAST, and auto-pause for recurring scans. • Adds functionality to store a snapshot of target configuration for each scan • Introduces custom URL rewrite rules for DAST scans on larger sites to improve scan efficiency • Adds safeguards to automatically pause recurring scans after five consecutive failures Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20260108 (2026-01-08)

Thu, 08 Jan 2026 12:00:00 GMT

Supports IdP-initiated SAML user provisioning and non-standard OAuth authorization flows in the scanning engine • Adds support for automatic user provisioning during IdP-initiated SAML SSO login • Enhances the scanning engine to support non-standard OAuth authorization flows Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20251204

Thu, 04 Dec 2025 00:00:00 GMT

Invicti 20251204 adds API spec URL loading, bulk comments/tags, dark mode, and auto-scalable agents. • Adds `URL reference` support in target settings to load API specs at runtime from targets not accessible to Invicti cloud services • Enables adding bulk comments and tags to vulnerabilities • Adds Dark mode UI theme • Introduces Auto-scalable agents for scan infrastructure • Adds preview capability for REST API specifications (OpenAPI, Swagger, RAML) after upload • Reports WAFs detected by DAST scanner in the Scan activity log Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20251120

Thu, 20 Nov 2025 00:00:00 GMT

Invicti adds bulk retesting, API export, hostname variation handling, and NTA upgrade context preservation. • Adds a bulk action for retesting vulnerabilities. • Updated visibility of items in API discovery to show only unlinked API specs. • Implemented API information export capability for API discovery and API catalog. • Implemented hostname variation handling during web crawling to ensure links with different subdomain formats are considered within the same scope. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20251106

Thu, 06 Nov 2025 00:00:00 GMT

Adds 'Fixed (Unconfirmed)' vuln status, SCIM provisioning, Sensorless API discovery, custom cookies via LSR API, and SAML debug logs. • Added toggle in Settings to control automatic retest of vulnerabilities after selecting "Fixed (Unconfirmed)" status • Added SCIM user provisioning support for Invicti Ultimate users • Added ability to filter the user list by user creation method (manually created vs. auto-provisioned) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20251023

Thu, 23 Oct 2025 00:00:00 GMT

Invicti adds Zero-Config API discovery, API-only scans, automated report emailing, and Rediscovered vuln tracking in dashboards. • Added Engine-based Zero-Config API discovery service • Implemented API-only scan capability to improve scan speed and efficiency • Implemented a new automation feature to automatically email a specified scan report upon scan completion • Updated requirements for the Internal Agent to specify CPU, RAM, and disk space • Added an ability to copy custom scan profiles • The Executive and API Insights dashboards now include Rediscovered vulnerabilities in the total open counts • Reconstructed REST API specifications are now displayed in the API Discovery view • Implemented filtering out third-party APIs during web application scans to improve API discovery accuracy • Added an updates panel to the Application dashboard showing last scanned status and tags Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20251009

Thu, 09 Oct 2025 00:00:00 GMT

Invicti 20251009 adds API tag filtering, API scan HTTP stats, LSR auth scripts and debug logs. • `GET /api/scans/results` now supports filtering scan results by tags • API engine statistics for scans include the number of 2xx status codes • Added support for authentication scripts in the LSR (Standalone LSR) • Users can download debug scan logs via a new button in the UI • `Inventory Endpoints` added to the API Hub • API dashboard now has a filter to show only vulnerable APIs when navigating to the API catalog • CSV import of Targets allows specifying username and password for form authentication Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20250925

Thu, 25 Sep 2025 00:00:00 GMT

Invicti adds API tagging for vulns, per-target scan duration limits, and CI/CD scan scheduling from Targets. • `GET /api/v1/vulnerabilities` accepts a new `severity` parameter to filter vulnerabilities by severity level • The `/targets//drawer` in the UI now allows creating a new scan schedule directly from the target view • `/target-settings` exposes a new config key for `max_scan_duration` to set per-target scan limits for CI/CD • API targets are now tagged with an `API` label on detected vulnerabilities to distinguish them from web vulns • The Application Trend Matrix UI gains a 'view by time range' dropdown for trend analysis Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20250911

Thu, 11 Sep 2025 00:00:00 GMT

Adds Trend Matrix for Applications with CSV export, filtering, and vulnerability widgets; enables automatic DAST scans in GitHub Actions. • Introduces the `Trend Matrix for Applications` as a new view displaying Mean Time to Remediate grouped by severity and indicating vulnerabilities exceeding MTTR • Adds the ability to export the `Trend Matrix` to CSV format • Implements automatic DAST scans in the GitHub Actions CI/CD pipeline • Makes Scan Profiles required for all CI/CD integrations • Displays the custom User Agent option in Scan Configuration for Targets Breaking changes: • Scan Profiles are now required for CI/CD integrations; prior configurations without explicit profiles may fail or require migration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti

Invicti Release 20250828

Thu, 28 Aug 2025 00:00:00 GMT

New SCIM 2.0 provisioning, AI-LSSR token tracking, auto-scan stop on 429, and Trend Matrix • Adds user provisioning with SCIM 2.0 for Teams • Implements Trend Matrix for DAST Targets • Added a filter on the Vulnerabilities page to show vulnerabilities found on APIs • Implemented AI-Aided Login to automatically regenerate invalid reused LSR files and save AI-generated LSR files • Added support for tracking session tokens in URL Parameters for LSR recorder • DeepScan now scans all path fragments discovered in locations for potential vulnerabilities • Updated the design of the Agents Page and Added the Technologies tab to the Application dashboard Full history on Cyber Toolchain: https://cybertoolchain.io/tools/invicti