Invicti vs New Relic IAST

Invicti is an application security platform for finding, prioritizing, and fixing application risk. Its testing engines cover DAST, SAST, software composition analysis, infrastructure as code, secrets, and container security. The platform discovers and tests REST, SOAP, and GraphQL APIs, including authorization flaws such as BOLA and BFLA. Invicti says Proof-Based Scanning confirms vulnerabilities with 99.98% accuracy. Findings are prioritized using runtime reachability, exploitability, business impact, and threat intelligence. DAST results can be correlated with SAST, developer ownership, reproduction context, and remediation guidance. Integrations include more than 110 tools, such as GitHub Actions, Jira, Jenkins, Azure Pipelines, ServiceNow, and Slack. Deployment varies by package; AppSec Flex includes cloud, on-premises, Bring Any Cloud, and air-gapped options. Compliance reports cover HIPAA, PCI DSS, OWASP Top 10, and other standards. Agentic Pentest costs $500, paid once for one application and its API suite, delivered within 24 hours with audit-ready PDF reports.

New Relic IAST probes running application code for vulnerabilities that could be exploited, helping DevOps and security teams address risk through the software development lifecycle. Dynamic assessment simulates attacks and can provide proof of exploit without code changes. New Relic APM agents deliver the capability, which can be enabled with a configuration setting change; supported languages are Go, Java, Node.js, and Ruby. Guided remediation can identify the code location, stack trace, HTTP trace, encountered URLs, exploit mechanism, and parameters involved. IAST is integrated with New Relic Vulnerability Management for ongoing discovery, fixing, and verification of high-risk vulnerabilities. Findings receive severity scores using CVSS version 3, with Low, Medium, High, and Critical ranges. The tool supports authenticated and API testing, CI/CD pipelines, and ticketing systems. A free New Relic plan is available, but IAST analysis is billed through an optional Compute Add On based on Compute Capacity Units consumed during analysis. Pricing for other plans is available on request.