G2

Verified User in Information Technology and Services

Mid-Market (51-1000 emp.)

5/4/2026

"Scalable Enterprise Security: Deep Endpoint Coverage via Invicti"

4.5/5

What do you like best about Invicti?

In my experience conducting deep security posture analysis, the most valuable aspect of Invicti is its ability to bridge the gap between active vulnerability scanning and dependency management. While many tools focus only on active threats, Invicti provides the Software Composition Analysis (SCA) depth we need for enterprise portfolios.

In practice, we use it to manage the security implications of complex, nested packages, ensuring we remain accountable for dependencies built on top of other packages in our Java and Spring Boot environments. Its integration with our CI/CD pipelines (such as Jenkins) also lets us automate endpoint testing across the full application interface.

What stands out most is the accuracy with which it discovers available endpoints without requiring significant manual configuration. Rather than spending hours defining what to test, the automated crawling produces a comprehensive report that categorizes issues by severity. This makes it easier to prioritize remediation right away, instead of manually filtering through noise. Review collected by and hosted on G2.com.

What do you dislike about Invicti?

The primary challenge we've encountered involves performance overhead and scalability when integrating multiple scanning agents across a large portfolio of applications. When running concurrent scans for several enterprise-grade microservices, the resource consumption can lead to significantly longer scan times, which occasionally creates a bottleneck in our rapid deployment cycles.

Additionally, while the automation is robust, it can require extensive manual configuration for complex authentication flows (such as custom headers or multi-step SSO). Without this "fine-tuning," the scanner can sometimes struggle with context-awareness, leading to false positives that require manual triage. For a security team managing a high volume of vulnerabilities, investigating these non-exploitable findings can be time-consuming and reduce the overall efficiency of the automated reporting. Review collected by and hosted on G2.com.

What problems is Invicti solving and how is that benefiting you?

We previously struggled with a fragmented security approach: vulnerability data was scattered across multiple tools, which made it hard to maintain a clear, unified view of risk across a large application portfolio. Invicti addressed this by bringing DAST, SAST, and SCA together into a single automated workflow. This has been especially valuable for our API security and microservices architecture, where manual endpoint discovery is often error-prone and time-consuming.

The biggest improvement for us has been the shift to automated Application Security Posture Management (ASPM). Rather than manually triaging individual findings from different sources, we now rely on a centralized, detailed report that helps prioritize vulnerabilities based on their real impact. As a result, team productivity has improved noticeably by reducing the “security bottleneck” during deployment cycles. With automated discovery of hidden endpoints and secrets scanning, we’ve been able to focus remediation where it matters most and keep better control of costs by catching vulnerabilities much earlier in the development lifecycle. Review collected by and hosted on G2.com.