Detectify vs Invicti
Invicti combines proof-based DAST with code and supply chain scanning in one AppSec platform, while Detectify tests your web apps and APIs with payloads built with ethical hackers.
Last updated 26 October 2026
| Detectify | Invicti | |
|---|---|---|
| How tests are built | Payload-based tests, including 1,765+ Crowdsource modules from ethical hackers | Proof-based scanning safely exploits many common vulnerabilities to confirm them* |
| Attack surface monitoring | Subdomains, IPs and IP ranges, open ports and technologies, plus subdomain takeover checks every 8 hours | Discovers web apps on your domains and subdomains, plus sites found by reverse IP lookup* |
| Web app scanning | Headless Chrome crawler with full SPA support | Scans web apps built with JavaScript, AJAX and single-page app technologies* |
| Authenticated scanning | Basic, Recorded Login and Recorded Crawling | Form login, login sequence recorder, OAuth2, HTTP auth, client certificates and smart cards* |
| API scanning | OpenAPI v2, v3, v3.1 and GraphQL. OAuth, Basic and API key | REST, SOAP and GraphQL. Imports OpenAPI 3, Swagger 2, RAML, WADL, Postman, WSDL and GraphQL schemas or introspection. Basic auth and OAuth2* |
| Internal scanning | Internal Scanning, deployed with Terraform (AWS) or Helm. Outbound-only connection | Internal scan agents on Linux (Docker), Windows or Kubernetes. Agents need outbound access to the platform* |
| Cloud configuration checks | Not covered. DNS connectors import assets only | IaC scanning finds insecure configurations before deployment* |
| Emerging threats | New Crowdsource tests for newly disclosed vulnerabilities | New security checks and CVE coverage added in each platform release* |
| Integrations | Jira (two-way), Slack, Microsoft Teams, PagerDuty, Opsgenie, ServiceNow, Splunk, webhooks, Workato, REST API | Jira (bi-directional status mapping), Slack, Microsoft Teams, ServiceNow, Splunk, webhooks, REST API* |
| Free trial | 2 weeks | Free trial sign-up, plus proof-of-concept licenses for evaluation in your own environment* |
Detectify helps 10,000+ users manage their attack surfaces
Which one fits your team
Detectify
Choose Detectify if
- Your biggest risk sits in internet-facing web apps, APIs and subdomains
- You want testing that goes beyond known CVEs
- You want attack surface monitoring and application testing in one platform
Invicti
Choose Invicti if
- You want DAST in the same platform as SAST, SCA, IaC, secrets and container scanning
- Your apps use NTLM, Kerberos, client certificate or smart card logins
- You want to check infrastructure as code for insecure configurations before deployment
Why teams choose Detectify
1,765+
1,765+ Crowdsource modules from ethical hackers run against the assets you add
- Crowdsource ethical hackers submit payloads for vulnerabilities they find in the wild
- 1,765+ modules run against the assets you add
- New tests ship when a vulnerability is disclosed, as with Log4Shell on the same day
- Maps subdomains from certificate transparency logs, DNS enumeration and brute-forcing
- Checks your subdomains for takeover every 8 hours, including GCP bucket takeover
- DNS connectors pull in assets from AWS, Azure, GCP, Cloudflare and more
- Import an OpenAPI spec or GraphQL schema and pick the operations to test
- OAuth, Basic Auth and API key authentication
- Prompt injection tests for AI and LLM endpoints
Crowdsource from submission to test
01
Ethical hacker submits a payloadCrowdsource · path traversal
GET /static/..%2f..%2f..%2fetc/passwd
02
Reviewed, then shipped as a test moduleJoins 1,765+ modules
03
Finding
trade.go-hack-yourself.netPath traversalHigh
Surface Monitoring subdomain takeover
01
New subdomain foundCertificate transparency logs
promo.go-hack-yourself.net CNAME deprovisioned cloud resource
02
Checked for takeoverEvery 8 hours
03
Finding
promo.go-hack-yourself.netSubdomain takeoverHigh
API Scanning from spec to scan
01
Import your spec, pick the operationsOpenAPI or GraphQL · auth: OAuth
# openapi.json
GET /orders/{id} ✓
POST /orders ✓
POST /assistant/chat ✓
02
Payloads sent to each operationRotated between runs
03
Finding
api.go-hack-yourself.net/assistant/chatPrompt injectionHigh
“There are a lot of extremely noisy tools, and they generate a lot of findings, but to get to the true positives, you have to spend a lot of time analyzing the results. So we were very happy with the low rate of Detectify's false positives.”
FAQs
Yes, for teams whose main risk is internet-facing web apps, APIs and subdomains. Detectify monitors your external attack surface and tests applications with payload-based tests. Invicti is an AppSec platform that uses proof-based DAST alongside SAST, SCA, IaC, secrets and container scanning.
How the tests are built. Detectify's tests come from its own research and from Crowdsource, a program of ethical hackers who submit payloads for real vulnerabilities. Invicti's proof-based scanning confirms many common vulnerabilities by safely exploiting them.
Yes. API Scanning tests the operations you choose in an OpenAPI v2, v3 or v3.1 spec or a GraphQL schema that you import. It supports OAuth, Basic and API key authentication.
Yes. Internal Scanning runs inside your network and connects outbound only. You deploy it with Terraform on AWS or with Helm.
Yes. Application Scanning supports Basic authentication, Recorded Login and Recorded Crawling.
Pricing depends on the products you use and how many assets you cover. Surface Monitoring is priced by the number of domains in scope, and Internal Scanning by the number of internal apps. Start a 2-week free trial, or talk to sales for a quote.
Yes. They run independently, so you can use Invicti for code and supply chain scanning and Detectify for web apps and APIs.
See Detectify on your own domains
Start a free trial, or book a demo to walk through Detectify with our team.