Invicti Security Launches Agentic Pentest for Web App Testing

Invicti Security has launched Invicti Agentic Pentest, a penetration testing capability for web applications and APIs, the company announced in a press release.

The tool combines autonomous AI reasoning with Dynamic Application Security Testing, or DAST, that validates exploitable findings. It maps an application attack surface, analyzes authentication flows, and creates attack plans based on application behavior.

Invicti said the system uses specialized AI agents across vulnerability classes including SQL injection, remote code execution, cross site scripting, server side request forgery, XML external entity injection, insecure deserialization, path traversal, and NoSQL injection. When source code is available, the tool can use code context to create attack payloads while validating findings from an external attacker view.

Each assessment includes reconnaissance, adaptive attack planning, validated findings, reproduction steps, payloads, remediation guidance, and reports for technical and executive users. Invicti Agentic Pentest is available as part of the Invicti platform.